PACT Act compliance checklist: what smoke shops need to get age verification right in 2026
One missed ID check can cost more than a fine — it can cost your license. Here's a plain-language walkthrough of what the PACT Act actually requires at the register and at the door.
In this guide
If you run a smoke shop, you've probably heard "PACT Act" thrown around in supplier emails or compliance webinars without much explanation of what it means for your day-to-day register operations. That gap is where most violations happen — not from shops deliberately selling to minors, but from owners who assumed their existing habits were enough.
This guide breaks down what the PACT Act requires in practice: who needs to register, what counts as valid age verification, and where shops most often get caught out during inspections or mystery-shop audits.
What the PACT Act actually covers
The Prevent All Cigarette Trafficking (PACT) Act was originally written to stop untaxed cigarette trafficking across state lines. In 2021, the Consolidated Appropriations Act amended it to fold in Electronic Nicotine Delivery Systems (ENDS) — meaning vapes, e-cigars, vape pens, and related components are now covered under the same federal framework as traditional tobacco. According to the Bureau of Alcohol, Tobacco, Firearms and Explosives, the law mandates age verification and packaging requirements, restricts mailing of covered products, and gives the ATF authority to inspect anyone involved in delivery sales.
In practical terms: if your shop sells vapes, disposables, or tobacco accessories — in person or online — the PACT Act's age verification expectations apply to you, regardless of whether you think of yourself as a "tobacco retailer."
Federal age minimum vs. state law
The federal floor is 21 for tobacco and ENDS products. But federal law is a floor, not a ceiling — a number of states and municipalities set higher minimums, additional licensing requirements, or flavor restrictions on top of it. If you operate near a state line or ship product across state borders, the applicable rule is whichever is stricter: yours, or the destination's.
Practical takeaway: don't rely on your state's minimum as your only reference point. If you ship product anywhere, check the destination state's requirements before every shipment, not just at setup.
ATF registration — do you need it?
If your business sells, ships, or advertises cigarettes, smokeless tobacco, or ENDS products in interstate commerce, you likely need to register with the ATF and with the tobacco tax administrator in every state you ship to. This applies even if your storefront is entirely local — the moment your website is accessible to a customer in another state, that counts as advertising in that state under PACT Act guidance.
Registration isn't a one-time formality. Many shops treat it that way and then miss the monthly reporting obligations that come with it — which is itself a separate compliance failure from age verification.
In-store age verification checklist
This is the part inspectors and mystery shoppers actually test. Here's what "doing it right" looks like at the counter:
Check ID on every age-restricted sale — not just when someone looks young. Test purchasers used in compliance checks are frequently of-age adults specifically chosen because they don't look underage.
Accept only current, government-issued photo ID — driver's license, state ID, passport, or military ID. Expired ID doesn't count.
Confirm the photo matches the person in front of you, not just the birthdate.
Use POS prompts that require a birthdate entry or ID scan before the sale completes, so the check is timestamped and recorded.
Post age-restriction signage at the point of sale — a small compliance detail that inspectors do check for.
Keep a written ID-check policy on file so you can show inspectors your process, not just describe it.
Common failure point: selective carding. If your staff only checks ID on customers who "look young," that pattern is exactly what compliance audits are designed to catch.
Online sales and shipping requirements
If you sell online or ship product to consumers, the PACT Act layers on additional obligations beyond the in-store checklist:
- Age verification at checkout — typically through a database check or ID verification service, before the order is placed, not just at delivery.
- Adult signature at delivery — the person receiving the package must show ID and sign, confirming they're the verified purchaser.
- Shipping restrictions — USPS generally cannot be used to mail cigarettes, ENDS, or smokeless tobacco directly to consumers. Private carriers with age-verification capability are the compliant route.
- Delivery sale recordkeeping — retain records of who bought what, when, and how age was verified.
A mistake worth flagging here: checking ID only at the door is not sufficient on its own. Regulators expect verification before checkout in addition to the delivery signature — relying on one without the other is treated as a gap, not a compliant workaround.
Related reading
- How to increase smoke shop profit margins in 2026Compliance costs eat into margin — this guide covers where to recover it through smarter wholesale buying.
- 7-OH kratom DEA scheduling: what it means for your shelfAnother fast-moving compliance shift affecting smoke shop inventory in 2026.
- Set up a wholesale account with Get Glass DistributionStock compliant, in-demand product without the guesswork.
What a violation actually costs you
PACT Act penalties scale with severity and repetition, and they're not limited to fines:
- Civil penalties that can run into the thousands of dollars per violation
- Placement on the ATF's non-compliant list, which restricts anyone from legally shipping covered products to you
- Criminal penalties in cases involving repeated or willful violations
- Suspension or loss of state tobacco/vapor retail licensing
- Increased inspection frequency going forward — once flagged, you stay on the radar
The reputational cost is harder to quantify but often more damaging in a tight local market — a publicized compliance failure follows a shop's name long after the fine is paid.
Training your staff so compliance doesn't depend on you
The owner is rarely the one at the register during every shift. The single highest-leverage compliance fix most shops can make is treating ID checks as a non-negotiable step built into the sale — not a judgment call left to whoever's on shift. A five-minute training refresh covering the checklist above, repeated quarterly, closes more compliance gaps than any signage or software purchase on its own.
Frequently asked questions
What is the minimum age to sell vape and tobacco products under the PACT Act?
The federal minimum is 21. States can set a higher minimum, so always check state and local requirements in addition to federal law.
Do smoke shops need to register with the ATF?
Businesses that sell, ship, or advertise covered tobacco or ENDS products in interstate commerce generally must register with the ATF and with tobacco tax administrators in states where they ship.
Does checking ID at delivery satisfy PACT Act requirements?
No. Regulators expect verification before checkout in addition to an adult signature at delivery — verification at the door alone is considered insufficient.
Stock compliant, staff your shop right
Get Glass Distribution supplies smoke shops nationwide with wholesale product and the guidance to sell it responsibly.
Set up your wholesale account →
