URL indicates uniform resource locator.
aOf the 5 orders rejected owing to age verification, 3 were from websites that used a social security number in addition to date of birth to verify age. One order was from a website using an online age verification system; the website emailed the buyer to request photo identification after the initial age verification failed and canceled the order after not getting a response. One order was blocked after the buyer entered his or her real date of birth; a second attempt using a fake date of birth was also blocked, presumably owing to the tracking of cookies or Internet Protocol addresses.
Williams RS, Derrick J, Ribisl KM. Electronic Cigarette Sales to Minors via the Internet. JAMA Pediatr. 2015;169(3):e1563. doi:10.1001/jamapediatrics.2015.63
Electronic cigarettes (e-cigarettes) entered the US market in 2007 and, with little regulatory oversight, grew into a $2-billion-a-year industry by 2013. The Centers for Disease Control and Prevention has reported a trend of increasing e-cigarette use among teens, with use rates doubling from 2011 to 2012. While several studies have documented that teens can and do buy cigarettes online, to our knowledge, no studies have yet examined age verification among Internet tobacco vendors selling e-cigarettes.
To estimate the extent to which minors can successfully purchase e-cigarettes online and assess compliance with North Carolina’s 2013 e-cigarette age-verification law.
Design, Setting, and Participants
In this cross-sectional study conducted from February 2014 to June 2014, 11 nonsmoking minors aged 14 to 17 years made supervised e-cigarette purchase attempts from 98 Internet e-cigarette vendors. Purchase attempts were made at the University of North Carolina Internet Tobacco Vendors Study project offices using credit cards.
Main Outcome and Measure
Rate at which minors can successfully purchase e-cigarettes on the Internet.
Minors successfully received deliveries of e-cigarettes from 76.5% of purchase attempts, with no attempts by delivery companies to verify their ages at delivery and 95% of delivered orders simply left at the door. All delivered packages came from shipping companies that, according to company policy or federal regulation, do not ship cigarettes to consumers. Of the total orders, 18 failed for reasons unrelated to age verification. Only 5 of the remaining 80 youth purchase attempts were rejected owing to age verification, resulting in a youth buy rate of 93.7%. None of the vendors complied with North Carolina’s e-cigarette age-verification law.
Conclusions and Relevance
Minors are easily able to purchase e-cigarettes from the Internet because of an absence of age-verification measures used by Internet e-cigarette vendors. Federal law should require and enforce rigorous age verification for all e-cigarette sales as with the federal PACT (Prevent All Cigarette Trafficking) Act’s requirements for age verification in Internet cigarette sales.
Electronic cigarettes (e-cigarettes) entered the US market in 2007 and, with little regulatory oversight, grew into a $2-billion-a-year industry by 2013. Analysts forecast e-cigarette sales to reach $10 billion by 2017 and eclipse cigarette sales by 2023.1 At least 466 unique brands and 7764 unique flavors of e-cigarettes can be purchased online.2
The Centers for Disease Control and Prevention3 has reported increasing e-cigarette use by teens, with rates doubling from 2011 (4.5%) to 2012 (10%). From 2011 to 2013, the number of US youth who used e-cigarettes but had never used cigarettes more than tripled from 79 000 to more than 263 000; these youth were almost twice as likely to intend to smoke cigarettes than youth who had never used e-cigarettes.4 In 2014, 17% of 12th graders reported e-cigarette use, more than twice as many than those who used cigarettes.5
Several studies have documented that teens can6- 9 and do10- 12 buy cigarettes online, easily bypassing the ineffective age verification of Internet tobacco vendors (ITVs).7,9 One million adolescents reported purchasing cigarettes, cigars, and smokeless tobacco online in 2012.13 To our knowledge, no studies have yet examined youth access to e-cigarettes online.
The federal PACT (Prevent All Cigarette Trafficking) Act14 bans cigarette sales to minors and restricts all major US carriers from shipping cigarettes. In April 2014, the Food and Drug Administration announced its intention to assert jurisdiction over e-cigarettes15 and may ban e-cigarette sales to minors; however, it may be several years before federal regulations are implemented. Currently, 41 states ban e-cigarette sales to minors.16 To our knowledge, compliance with these state laws has not yet been assessed.
To our knowledge, this is the first study to estimate the extent to which minors can successfully purchase e-cigarettes online and the first to assess compliance with North Carolina’s 2013 e-cigarette age-verification law.17
We identified the 103 most popular Internet e-cigarette vendors from the parent Internet Tobacco Vendors Study, which assesses the sales and marketing practices of the population of English-language ITVs. The Figure depicts the study sampling sources and procedures, purchase attempts, and order results.
Highly complex automated search algorithms developed and annually updated since 2004 searched 148 million websites, message boards, news groups, and spam emails, identifying 14 171 potential ITVs. Huang et al18 identified an additional 17 102 URLs (uniform resource locators, or web addresses) from a concurrent analysis of Twitter posts containing e-cigarette–related keywords including counts of how many times each URL was tweeted. URLs were tweeted from 1 to 219 087 times, with a mean of 26.1 tweets. Pilot screening indicated that URLs tweeted fewer than 20 times were typically not valid ITV links (eg, Facebook or personal blog posts), resulting in removal of 16 705 URLs. The remaining websites were identified from prior studies by our team (n = 522), websites identified by R. J. Reynolds (n = 129) (Stephen A. Grimaldi, CPP, R. J. Reynolds Director of Corporate Security, written communication, February 2013), and websites linked from those identified during screening (n = 474).
Trained data collectors manually screened all websites, identifying 988 ITVs that sold nicotine e-cigarettes for home delivery. Alexa panel-based traffic rankings19 were used to identify the most popular vendors for inclusion. We removed 413 websites that lacked rankings and 26 more that became defunct between identification and when buyers began making purchases. Ten more met additional exclusion criteria (did not ship to North Carolina, did not accept online orders, or had a minimum order of more than $150, which would likely be cost prohibitive to minors).
From the remaining 539 ITVs, we selected the 103 most popular vendors for purchase attempts. During the course of the study, 1 computer’s default parental controls blocked access to 5 vendor websites. These websites were excluded from the final purchase study sample of 98 vendors.
Buyers were 10 English-speaking minors aged 14 to 17 years. They provided youth assent and their parents provided written consent. Buyers were recruited via email flyers posted to university listservs and local youth groups. Monitored telephone numbers and email accounts were created for each participant to avoid ITV correspondence sent to their personal accounts. The local police chief and district attorney provided letters of immunity from arrest or prosecution protecting all staff and participants involved in the study.
Between February 2014 and June 2014, with 1-on-1 staff supervision and using procedures approved by the University of North Carolina institutional review board, buyers visited the study websites and attempted to purchase the cheapest available disposable nicotine e-cigarette or, if unavailable, the cheapest nicotine e-cigarette starter kit, while staff tracked the details of the purchase (eg, items purchased, cost, and age-verification attempts). We tracked whether e-cigarette sellers provided age verification at delivery (AVAD), a service offered by UPS, DHL, and FedEx, but not by the US Postal Service (USPS). When available, buyers chose USPS to assess the proportion of vendors shipping e-cigarettes without the possibility of AVAD.
When encountering age verification, buyers were allowed to misrepresent their age and identity in several ways identified by teens in a prior study assessing tobacco company websites’ age-verification techniques.20 For instance, buyers were allowed to click check boxes or type false birth dates to attempt to bypass age verification. In that study, all participants said they had easy access to their parents’ driver’s licenses and no qualms about using parents’ driver’s licenses to bypass age verification, indicating that past studies prohibiting teen buyers from using another individual’s driver’s license probably underestimated true youth purchase success rates. To address this, youth buyers were recruited with a parent who gave written permission for his or her child to use the parent’s driver’s license to attempt to bypass age verification. The legal definition of identity theft is using someone’s identity without their permission, so no laws were broken.
This also allowed for the first ever testing, to our knowledge, of whether ITVs used challenge questions and whether they worked. Challenge questions verify that the submitter of a driver’s license is the owner of the driver’s license by asking multiple-choice questions based on public records information that someone other than the owner would unlikely know, such as “Which model car did you own in 1993?” Providing teens with their parents’ driver’s licenses allowed us to assess which websites were using challenge questions and whether the questions thwarted youth access.
All purchases were made with credit cards issued for each youth buyer in his or her own name or his or her parent’s name. The buyers first attempted to make purchases using their own identities and, if those purchases failed owing to age verification, they made a subsequent attempt posing as their parent.
Youth buyers were instructed to answer the door for deliveries when they were home. When packages were delivered, buyers noted the date and age-verification attempts. Parents maintained control of the packages and staff regularly retrieved packages from buyers’ homes.
Six vendors offered disposable e-cigarettes (average price, $14.24) and 92 offered reusable e-cigarette starter kits (average price, $35.54). Youth attempted to purchase orders from these 98 vendors.
Only 5 of 98 youth purchase attempts were rejected owing to age verification. Seventy-five orders (76.5%) were successfully received. There were no attempts to verify age at delivery; 95% of received orders were simply left at the door. The remaining 18 orders failed for reasons unrelated to age verification, generally because the website had problems processing payments and/or orders failed because of poorly designed functionality (Figure).
Of the 5 orders rejected owing to age verification:
•Three were from websites using a social security number (SSN) plus date of birth (DOB) to verify age.
•One was from a website using an online age-verification service; the website emailed the buyer to request a driver’s license after initial age verification failed and canceled the order after not receiving a timely response.
•One was blocked after the buyer entered his or her real DOB; a second attempt using a fake DOB was also blocked.
After removing the 18 orders that failed for reasons other than age verification from the sample, the 5 of 80 orders that were rejected based on age verification represented a youth e-cigarette purchase rate of 93.7%.
The Table describes age-verification strategies used by vendors. The order attempts column describes the number and percentage of all orders (N = 98) that claimed to use each strategy (eg, 6.1% of vendors claimed to use an online age-verification service to verify age) and the buy rate column represents the number and percentage of successfully received orders that used each youth–access prevention strategy. For instance, 83.3% of order attempts from vendors that claimed to use an online age-verification service were successfully received.
Many vendors used multiple age-verification strategies and 18.3% of orders failed for reasons unrelated to age verification (such as problems with partially broken websites not processing payments). While most vendors featured some form of age verification, 82.7% featured strategies that clearly could not effectively verify age (such as a check box) and 17.3% featured no attempts to verify age at all.
Few vendors used age-verification strategies that could potentially be effective at verifying age. Date of birth was by far the most common strategy, featured by 38.8% of vendors. While DOB could potentially be used in conjunction with name and address to verify customers’ age in public records databases (PRDs), in most cases, it clearly was not. The 3 websites that used DOB in combination with a SSN to verify age successfully rejected the youth order. The remainder of failed orders that collected DOBs failed for reasons related to processing payment, not age verification.
There was very little use of other potentially effective age-verification strategies by ITVs. Six vendors claimed to use an online age-verification service, and minors successfully received 5 of those orders. The sixth order likely would have been received had staff responded quickly enough to a follow-up email from the vendor requesting submission of a driver’s license but the message was not reviewed until after the order had been canceled.
No vendors required buyers to submit driver’s license numbers, which could be used to verify age with PRDs. One vendor claimed that buyers might need to send their driver’s licenses if third-party age verification failed. The buyer entered a fake DOB, successfully bypassing age verification and negating the need to send a copy of a driver’s license. The order was successfully received, indicating that third-party age verification was either not in use or ineffective.
All delivered packages arrived via shipping companies that, according to company policy or federal regulation, do not ship cigarettes to consumers; 88.0% of orders were delivered by USPS (with the remainder delivered by UPS, FedEx, and DHL). Eighty-one percent of received orders were shipped from within the United States, with the remainder arriving from foreign countries.
While 5 vendors claimed to verify age at delivery, none actually did. Three of those vendors delivered packages to youth buyers (via USPS, which does not provide an AVAD service), 1 was blocked at the point of order by verifying age with a SSN and DOB combined strategy, and the other was simply never charged or delivered by the vendor without explanation. Only 5 vendors rejected a purchase attempt with a youth identity, prompting the use of their parents’ identity and assessment of challenge question use, and none of the vendors used challenge questions. Only 1 of these purchases failed, owing to a problem accepting payment rather than identity verification.
Among the 23 unsuccessful order attempts, we failed to receive order confirmation or response to follow-up inquiries for 4 orders. These may have been dummy websites that appeared operational but where no one was actually reading messages, collecting money, or delivering products. One participant’s study email account became irretrievably inaccessible during the study (possibly owing to hacking), resulting in our being unable to fully verify order information for 2 of the unsuccessful order attempts, which may have resulted in a slightly lower buy rate if they were rejected owing to age verification.
As of August 2013, North Carolina law requires that online e-cigarette sellers verify customers’ ages with a government records database at the point of order but few, if any, vendors comply with the law. Only 7 vendors claimed to use age verification techniques that could potentially comply with North Carolina’s law. One vendor requested a copy of the buyer’s driver’s license and 6 claimed to use an online age-verification service. However, only 1 of these 7 purchases failed owing to age verification, indicating that 6 of the 7 websites claiming to use age verification that could allow compliance with North Carolina’s law failed to actually do so.
This study demonstrated that teens can easily obtain e-cigarettes online. Only 5 of 98 orders were rejected owing to age verification, indicating 93.7% of e-cigarette vendors failed to properly verify their customers’ ages, a youth buy rate similar to that (91.6%) of ITVs selling cigarettes in that industry’s preregulation infancy.7
The only age-verification strategy used that consistently led to rejection of an order was using DOB in conjunction with a SSN, which was presumably used to verify the buyer with a PRD. However, we cannot recommend using an SSN for age verification because it presents substantial risk of identity theft, especially on poorly designed websites with inaccurate payment processing methods that call into question the safety of customers’ submitted identity information.
Date of birth (without a SSN) was the most commonly used age-verification strategy, used at virtually the same rate by ITVs as by Internet alcohol vendors,21 and could potentially be used in conjunction with name and address to verify age with PRDs. It is unlikely that most vendors that collected a DOB used it to verify age with PRDs, considering all but 1 vendor using DOB (without a SSN) failed to reject the order based on age verification.
Driver’s licenses, the standard for age verification in face-to-face tobacco sales, were not effectively used by ITVs. No ITVs required buyers to submit a license number to be used to verify age with PRDs and the single vendor that claimed the buyer might need to send a copy of his or her license accepted and processed the order with a fake DOB, indicating that PRD verification was either not in use or ineffective. Examining driver’s licenses at the point of delivery is also the standard for age verification in retail sales, with the potential to also be effective in the delivery of age-restricted online sales. Prior studies by our team have shown that it is infrequently used7,9 and ineffective when used.21 In this study, none of the 5 vendors who claimed to verify age at delivery actually did so and the 3 delivered orders arrived via USPS, which does not offer AVAD.
Age verification at delivery has the potential to effectively prevent tobacco deliveries to minors, but only if it is consistently used by ITVs and administered consistently by delivery companies. Vendors and delivery companies included in our youth online alcohol purchase study did neither, resulting in two-thirds of packages marked as requiring AVAD being left with a minor or at the door.21
All major US carriers, including USPS, UPS, FedEx, and DHL, ban the delivery of cigarettes. If those bans are expanded to include e-cigarettes and carefully enforced, they have the potential to heavily restrict deliveries of e-cigarettes to minors. If delivery of e-cigarettes is allowed to continue, it may be important to ensure that AVAD is a viable (and carefully administered) option for any delivery company delivering e-cigarettes.
To our knowledge, this study was the first to assess the use and success of challenge questions for age verification among online vendors (of any products). Considering only 5 vendors even rejected a purchase attempt with a youth driver’s license (prompting the use of a parent’s driver’s license) and not a single vendor used challenge questions, the question of whether challenge questions are an effective age-verification strategy to block teens with their parent’s driver’s license remains unanswered. Further research is needed to determine whether challenge questions can effectively prevent youth access to age-restricted content.
The lack of age verification used by ITVs is of substantial concern because more than 4 million US youth report using e-cigarettes.3 As with cigarettes, as youth access becomes more difficult locally, teens may move increasingly to buy e-cigarettes online.10,22 With 83% of vendors using strategies that clearly cannot effectively verify age, including 17% that made no attempts to verify age at all, this is an easily accessible source of e-cigarettes for youth. Considering the historical lack of voluntary adoption of age-verification strategies among online tobacco sellers,7,9,21,23- 26 e-cigarette vendors are unlikely to improve age-verification practices in the absence of carefully enforced regulations.
Federal policies were passed in 200527- 29 and 200914 to prohibit the shipping of cigarettes via any of the national carriers (USPS, UPS, FedEx, and DHL) but the lack of enforcement and highly adaptable vendors in an international marketplace have severely limited their effectiveness.30,31 All packages in this study were delivered by USPS, UPS, or FedEx. Expansion of the current bans on cigarette deliveries to include e-cigarettes, together with careful enforcement, could heavily restrict such deliveries.
Despite having been in place for 6 months at the start of this study’s purchases, only 1 vendor complied with North Carolina’s e-cigarette age-verification law. Only 7 vendors used verification techniques that could have potentially complied with the law; the only 1 that failed owing to age verification (as just described ) might have passed had the buyer submitted the requested driver’s license from their parent.
In the absence of federal regulation, youth e-cigarette use has increased and e-cigarette sellers online operate in a regulatory vacuum, using few, if any, efforts to prevent sales to minors. Even in the face of state laws like North Carolina’s requiring age verification, most vendors continue to fail to even attempt to verify age in accordance with the law, underscoring the need for careful enforcement.
Federal law should require rigorous age verification for all e-cigarette sales similar to a federal policy under the PACT Act that bans Internet cigarette sales to minors. This could be implemented by either the Food and Drug Administration or by expanding the PACT Act to include e-cigarettes. Regardless, experience with regulation of online cigarette sales (and North Carolina’s e-cigarette law) indicates that without careful enforcement, these laws will be ineffective at restricting e-cigarette sales to minors. Future studies should assess the success, extent, and enforcement of these regulations.
Corresponding Author: Rebecca S. Williams, MHS, PhD, University of North Carolina at Chapel Hill, CB 7424, Chapel Hill, NC 27599 (firstname.lastname@example.org).
Accepted for Publication: January 11, 2015.
Published Online: March 2, 2015. doi:10.1001/jamapediatrics.2015.63.
Author Contributions: Dr Williams had full access to all of the data in the study and takes responsibility for the integrity of the data and the accuracy of the data analysis.
Study concept and design: Williams, Ribisl.
Acquisition, analysis, or interpretation of data: All authors.
Drafting of the manuscript: Williams, Derrick.
Critical revision of the manuscript for important intellectual content: Williams, Ribisl.
Statistical analysis: Derrick.
Obtained funding: Williams, Ribisl.
Administrative, technical, or material support: Williams.
Study supervision: Williams.
Conflict of Interest Disclosures: Dr Ribisl has served as an expert consultant in litigation against tobacco companies. No other disclosures were reported.
Funding/Support: Research reported in this publication was supported by grant 5R01CA169189-02 from the National Cancer Institute and the US Food and Drug Administration Center for Tobacco Products.
Role of the Funder/Sponsor: The National Cancer Institute had no role in the design and conduct of the study; collection, management, analysis, and interpretation of the data; preparation, review, or approval of the manuscript; and decision to submit the manuscript for publication.
Disclaimer: The content is solely the responsibility of the authors and does not necessarily represent the official views of the National Institutes of Health or the US Food and Drug Administration.
Corrections: This article was corrected on March 9, 2015, for a change made in Funding/Support and a Disclaimer addition and on March 16, 2015, for a change in wording in the Results section.