GuideLast updated September 15, 2026

Age verification for CBD and alcohol stores on Shopify

If your licence depends on not selling to minors, the app you install matters less than understanding what it does. This covers what a Shopify age gate actually gives you, where it stops, and what to keep for the day someone asks.

Start with which check your rules actually require

There are two products in this category and they are not interchangeable.

• Self-declaration. The shopper asserts their age, by answering yes or no, entering a date of birth, or accepting terms. A shopper who answers untruthfully passes.
• Identity verification. A service that checks identity evidence, such as a document. Hatchway does not provide this service.

Some jurisdictions and some payment processors require the second. Work out which applies to you before comparing apps, because a self-declaration gate will not satisfy a hard verification requirement no matter how it is marketed.

Gate the restricted lines, not your whole store

Many CBD and alcohol merchants sell a mixed catalog: accessories, apparel, glassware, or wellness products that carry no restriction at all. A sitewide gate makes every visitor answer for the restricted line, including people who arrived for something else entirely.

Product-level targeting solves that. Tag the restricted items, or gate a collection you already merchandise, and leave the rest of the catalog open. Our guide to gating specific products covers the mechanics.

One caution specific to this vertical: keep the tagging current. A new SKU that nobody tagged is ungated, and there is no error message for it. Whatever app you choose, check it can show you which products a rule actually matches.

Make sure the check survives the cart

A modal on the product page decides what a visitor is shown. It does not, by itself, stop an order. If you are gating for licensing reasons rather than brand safety, you want a check evaluated on Shopify’s side when the cart is submitted.

Hatchway’s enforcement claim covers your Online Store. It does not reach marketplace channels such as Amazon or eBay, which have their own restricted-goods processes. Selling a restricted product through a marketplace is a separate compliance problem from the one your Shopify app solves. Our guide on checkout enforcement goes into the mechanism.

Keep a record, because the question arrives later

Pro records let you inspect individual confirmations and export them for your own review.

Growth analytics summarize recorded responses. Pro adds reference lookup and CSV records so you can inspect individual confirmations.

What is worth having:

• A durable record of each age check: when it happened, what age was asked for, and which product triggered it.
• An optional reference on future orders, enabled separately, that you can look up in the ledger.
• An export you can hand to somebody, rather than a dashboard they have to trust.

Be precise about what such a record proves. It shows a recorded confirmation. It does not prove that an order completed. It does not show the assertion was true. That is a real and useful thing to be able to demonstrate, and overstating it helps nobody.

A workable setup

• Confirm the age threshold for every jurisdiction you ship to. Thresholds differ, and 18 is not universal.
• Tag your restricted products with one consistent tag, decided before you start.
• Verify the rule matches what you expect, in an incognito window, on a restricted product and an unrestricted one.
• Turn on server-side enforcement if your rules call for more than a display gate.
• Decide what should happen if the age check cannot run, and make that choice deliberately rather than discovering it.
• Check your records are accumulating, once, a week after launch.

Where Hatchway fits

Hatchway Age Gate is built for exactly this shape of store: Growth analytics showing recorded responses by product, age threshold, reason, and locale. Pro adds reference lookup, CSV exports, and opt-in Online Store checkout enforcement. Product-tag targeting is available on every plan.

It is a self-declaration gate. It does not verify identity, it stores no shopper personal data, and a date of birth entered into it is compared in the browser and discarded rather than sent to us. If your rules require document verification, we are not the product you need, and we would rather say that here than after you install.