Age Restrictions For NZ Online Sellers: Legal Risks & Best Practices

Running an online store is one of the fastest ways to start (or scale) a small business in New Zealand. But if you sell anything that’s age-restricted (or even could be treated as age-restricted depending on how it’s marketed), you need to think about compliance early.

Age restrictions aren’t just a “big retailer problem”. If you’re a small online seller, you can still face customer complaints, payment disputes, platform takedowns, regulatory attention, or reputational damage if you get it wrong.

This guide breaks down the practical legal issues around age restrictions that online sellers should be aware of in NZ, and the steps you can take to reduce risk and sell with confidence.

What Do “Age Restrictions” Mean For NZ Online Sellers?

In simple terms, age restrictions are rules that limit who you can sell certain products (or services) to, based on the customer’s age.

For online sellers, the tricky part is that you often don’t meet the customer face-to-face. That means you need to design your online checkout, delivery, and customer processes to reduce the risk of sales to minors.

Depending on what you sell, age restrictions can come from different places, including:

• Specific product laws (for example, laws controlling alcohol, vaping and tobacco products, and certain objectionable publications).
• Consumer protection laws that regulate marketing and misleading conduct (even if your product isn’t “banned” for minors, the way you advertise it matters).
• Contract and payment risk (transactions may be harder to enforce when the buyer is a minor, and disputes can get messy).
• Platform and payment provider rules (marketplaces, social platforms, and payment processors may impose strict compliance requirements).

Even if you’re not 100% sure your product is age-restricted, it’s worth checking early. The cost of adding a few verification steps is usually far lower than dealing with the consequences later.

Common Examples Of Age-Restricted (Or Age-Sensitive) Products

Different rules apply depending on the product, but in practice, online sellers often run into age-related compliance issues when selling:

• Alcohol
• Vapes / e-cigarettes and related products
• Tobacco and nicotine products
• Adult or explicit content and products (including “objectionable” material)
• Some knives / weapons-related products (depending on what it is and how it’s supplied)
• Products marketed in a way that targets or appeals to children (which can trigger consumer law issues)

If your business sells in any of these categories, or you’re building a new ecommerce store and considering adding them, you’ll want a compliance plan from day one.

Which NZ Laws Matter For Age-Restricted Online Sales?

There isn’t one single “age restriction law” that covers everything. The rules depend on what you’re selling, how you’re advertising, and how you deliver it.

That said, there are a few legal areas that come up again and again for NZ online sellers.

Alcohol-specific rules (Sale and Supply of Alcohol Act 2012)

If you sell alcohol online, you’ll need to consider the Sale and Supply of Alcohol Act 2012, which restricts sales and supply to minors and has rules that can affect online ordering, promotions, and delivery. Alcohol is an area where “best practice” steps (like delivery ID checks) often sit alongside legal requirements, so it’s worth getting advice specific to your sales model and where you operate.

Vaping/tobacco-specific rules (Smokefree Environments and Regulated Products Act 1990)

If you sell vaping products, smokeless tobacco, heated tobacco products, or related regulated products, the Smokefree Environments and Regulated Products Act 1990 (and associated regulations) is central. This area is heavily regulated, including age restrictions and limits on marketing and product presentation in certain cases. If you’re in this category, you should build compliance into your store and marketing from day one.

Fair Trading Act 1986 (Advertising And Misleading Conduct)

The Fair Trading Act 1986 is one of the most important laws for online sellers. It broadly prohibits misleading or deceptive conduct and false representations in trade.

Age restriction risk under the Fair Trading Act often shows up when businesses:

• Make unclear statements about age requirements (for example, “18+ only” in one place but not at checkout).
• Use advertising that could be seen as targeting minors (especially for products that are meant to be for adults).
• Rely on tiny disclaimers that don’t match the overall impression of the website or ad.

From a practical perspective, you want your age restriction messaging to be consistent across:

• Product pages
• Website banners/pop-ups
• Cart and checkout
• Order confirmation emails
• Delivery process

Consumer Guarantees Act 1993 (Customer Rights Still Apply)

The Consumer Guarantees Act 1993 (CGA) gives consumers automatic guarantees for products and services bought “in trade” (subject to some exceptions, including where customers buy for business use).

If you sell age-restricted products, it doesn’t mean customers lose their usual consumer rights. You still need to think about:

• Returns and refunds processes
• Faulty product remedies
• Clear product descriptions
• Shipping and delivery promises

Age verification steps should be designed so they don’t accidentally create new consumer law problems (for example, taking payment and then cancelling later without having clear terms about verification failures).

Privacy Act 2020 (If You Collect ID Or Date Of Birth)

Age verification often involves collecting personal information, such as a customer’s date of birth or identification document.

That means the Privacy Act 2020 becomes a key part of your compliance plan. The big idea is: only collect what you need, keep it secure, and be transparent about what you’re doing with it.

If your age-check process involves collecting personal information, you’ll usually want a clear Privacy Policy that covers:

• What information you collect (and why)
• How you store it and how long you keep it
• Who you share it with (for example, delivery partners or verification providers)
• How customers can access or correct their information

Privacy compliance isn’t just about “having a policy”. It’s also about having the right operational practices behind it.

What Are The Biggest Legal Risks If You Get Age Restrictions Wrong?

When people think about age restrictions, they often focus on one risk: “Will I get in trouble for selling to minors?”

That’s definitely a key risk. But for online sellers, the fallout can be broader (and often faster).

1) Regulatory Action And Penalties

If you sell products that are legally restricted by age, failing to verify age or allowing supply to minors can lead to enforcement action. The exact consequences depend on the law that applies to your product category (for example, alcohol and regulated vaping products have specific regimes).

Even if enforcement is unlikely for a small seller, it’s still not a risk you want to “hope your way out of” - especially as your business grows.

2) Customer Disputes, Chargebacks, And Refund Pressure

If a minor buys an age-restricted product (or a parent/guardian discovers it later), you can end up dealing with:

• refund demands
• payment disputes and chargebacks
• complaints to regulators or platforms
• negative reviews

Clear terms at checkout can help set expectations about what happens if age verification fails. For many online sellers, strong Website Terms And Conditions are a practical starting point.

3) Marketing And “Targeting Minors” Risk

Sometimes the biggest risk isn’t the sale itself - it’s the marketing.

If your ads, influencer posts, website copy, imagery, or product names create the impression you’re targeting or appealing to minors for an adult product category, that can raise red flags quickly.

This is where it’s worth having a consistent “adult-only” brand and messaging approach, including:

• clear age gating on your site
• platform settings that restrict underage audiences
• marketing review processes (even if it’s just a checklist you follow internally)

4) Privacy And Data Breach Risk (If You Collect ID)

Collecting ID documents can be high-risk. If you store copies of driver licences or passports, and you suffer a breach, you can face significant reputational and compliance issues.

Even without a “hack”, privacy risks can arise if you:

• collect more personal information than needed
• store it longer than needed
• give broad staff access without a reason
• use insecure tools for uploading and storing documents

If you’re unsure about how to design a compliant process, it’s worth getting privacy advice early rather than patching it later.

Best Practice Age Verification For Online Sellers (What Actually Works)

There’s no one-size-fits-all approach to age verification. The “right” method depends on what you sell, your sales channels, your customer base, and your delivery method.

But there are a few best practices that are widely used because they’re practical and reduce risk.

Use Layered Verification (Not Just A Checkbox)

A simple “I confirm I am over 18” checkbox is easy to implement, but on its own it can be weak protection for truly age-restricted goods.

A more robust approach is layered verification, such as:

• Age gate on site entry (basic filter and messaging)
• Date of birth entry at checkout (adds friction and a record)
• Delivery controls (for example, adult signature or ID check on delivery where appropriate)

The goal is to build a process you can reasonably defend if something goes wrong - not to create a perfect system (because perfection online is hard).

Make Your Age Restriction Rules Obvious At The Right Moments

Age restriction messaging should show up where it matters:

• On product pages (before the customer adds to cart)
• In the cart and checkout flow (before payment)
• In order confirmation emails (so there’s no “surprise” later)
• In shipping updates (especially if an adult signature/ID check is required)

If customers only discover the rule after you’ve taken payment, you’re much more likely to face refund disputes or complaints.

Train Staff And Document Your Process

If your business has staff (even casual fulfilment help), document your age-verification and delivery procedure.

This can be as simple as a one-page internal checklist covering:

• what products are age-restricted
• what steps must happen before dispatch
• when an order must be cancelled/refunded
• what to do if a customer complains

If you employ team members, you can also reinforce expectations through your Employment Contract and workplace policies (especially around customer data handling and privacy).

Be Careful With Third-Party Tools And Contractors

Many online sellers use third parties for:

• order fulfilment
• couriers
• customer support
• age verification tools
• marketing contractors

Whenever someone else is handling a key compliance step (or customer personal information), you’ll want your contracts to clearly allocate responsibility.

For example, if a contractor is building your ecommerce site or checkout flow, a properly drafted Service Agreement can help set expectations around security, scope, and liability.

What Legal Documents Should Online Sellers Use To Manage Age Restriction Risk?

You don’t need to drown your business in paperwork. But the right legal documents make it much easier to run your store consistently and defend decisions when something goes wrong.

For most online sellers dealing with age restrictions, these are the documents to consider.

Website Terms And Conditions

Your website terms can help you set rules like:

• your minimum purchase age
• your right to cancel orders that fail verification
• refund or restocking rules (where legally permitted)
• delivery requirements (eg adult signature/ID check)
• limitations of liability (as far as the law allows)

Many businesses start with Website Terms And Conditions and tailor from there based on product category and risk profile.

Privacy Policy (And A Collection Notice If Needed)

If you collect date of birth, store identity documents, or use verification providers, privacy transparency is essential.

A Privacy Policy is the baseline, but you should also think about:

• how consent is obtained (if needed)
• where and how customers upload documents
• retention periods and deletion processes

As a general rule, don’t collect ID “just in case” - collect it only if you genuinely need it for compliance.

Supplier And Distribution Agreements (If You’re Not The Manufacturer)

If you source age-restricted goods from suppliers (local or overseas), your supplier contract should cover things like:

• product compliance warranties (that the goods meet NZ requirements)
• labelling and marketing responsibilities
• recall processes (if needed)
• indemnities where appropriate

If you distribute someone else’s products, a Distribution Agreement can help clarify who is responsible for what, especially around marketing, compliance, and customer complaints.

Internal Policies (Especially If You Have Staff)

Even a small ecommerce business benefits from having internal guidance, particularly if you’re delegating fulfilment and customer support.

Policies can cover:

• age verification steps
• privacy and customer data handling
• social media and advertising approvals
• incident management (what to do if a restricted item is delivered to a minor)

It’s not about bureaucracy - it’s about consistency, especially as you grow.

Key Takeaways

• For online sellers, managing age restrictions usually means thinking beyond a simple “18+ checkbox” - layered verification and delivery controls are often more defensible for genuinely restricted goods.
• In NZ, age-restricted compliance is often product-specific. For example, alcohol sellers should consider the Sale and Supply of Alcohol Act 2012, and vaping/regulated product sellers should consider the Smokefree Environments and Regulated Products Act 1990 (and related regulations), alongside their operational processes.
• Age restriction compliance can overlap with broader obligations under the Fair Trading Act 1986 (marketing and misleading conduct) and the Consumer Guarantees Act 1993 (customer rights still apply).
• If you collect date of birth or ID documents for verification, you must handle that data carefully under the Privacy Act 2020, including having a clear Privacy Policy and strong security practices.
• Clear Website Terms And Conditions can help you manage cancellations, verification failures, delivery requirements, and customer expectations.
• If third parties are involved (developers, fulfilment partners, couriers, marketing contractors), use well-drafted contracts like a Service Agreement to allocate responsibilities and reduce gaps in your compliance process.
• If you distribute or resell age-restricted products, contracts such as a Distribution Agreement can help clarify product compliance responsibilities and reduce disputes with suppliers.

Note: This article provides general information only and does not constitute legal advice. Because age restrictions are highly product- and fact-specific, you should get advice tailored to your business and sales channels.

If you’d like help setting up your online store’s age restriction compliance (including your terms, privacy documents, and practical processes), you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.