Key takeaways
- First establish whether a product may be sold unattended at that site at all. The verification method comes second.
- A barcode scan reads what a document says. Authentication and liveness address whether it's genuine and whether the holder owns it. Each step adds friction and data.
- Keep the answer, not the ID: store pass or fail, method, time and device, and discard document images and data.
- Restricted compartments should fail closed when verification is unavailable, while the rest of the store keeps selling.
- Rules for nicotine, alcohol and hemp-derived products vary by state and locality and change often. Re-check them for every new site.
A cashier glances at an ID and makes a judgment call that nobody logs. A machine can’t make judgment calls, but it can log everything, which is both the opportunity and the risk. Selling age-restricted products unattended means deciding what the machine must prove, how much friction a shopper will tolerate, and how little personal data you can keep while still showing a check happened.
This article is general guidance, not legal advice. Age-restriction rules come from federal, state and local law, and they change often. Confirm requirements for each product and each site with counsel and the relevant licensing authority.
First question: may this be sold unattended here at all?
Before choosing a verification method, establish whether an unattended device may legally sell the product at the specific site. For several categories the answer is no, or yes only under narrow conditions.
| Category | Federal baseline | What varies by state and locality | Unattended outlook |
|---|---|---|---|
| Tobacco and nicotine | Minimum sales age of 21; federal rules restrict cigarette and smokeless tobacco vending machines to facilities that underage people can’t enter | Retail licensing, flavor restrictions, local ordinances, rules for vapes and nicotine pouches | Narrow: adult-only venues, where allowed at all |
| Alcohol | Purchase age of 21 in every state | Whether automated sales are allowed, license type, sales hours, attendant or monitoring requirements | Often prohibited; where allowed, usually with staff involvement |
| Hemp-derived and CBD products | Federal treatment has been shifting | Age limits (often 21), product and labeling rules, outright bans in some places | Changing fast; re-check before each deployment |
| Certain OTC medicines | Some ingredients, such as pseudoephedrine, carry federal sales controls that rule out vending | Some states set minimum ages for products such as cough medicine containing dextromethorphan | Avoid controlled ingredients; check state age limits |
| Locally restricted items | Generally none | Some states and cities restrict sales of items such as spray paint to minors | Check local codes |
Notice the shape of the table. The federal layer sets a floor, and the real decisions sit with states, counties and cities. A program that’s fine in one city can be unlawful two exits down the highway. Treat each site as its own compliance review.
The verification ladder
Once a product and site are cleared, choose the lightest method that satisfies the rule. Each rung adds assurance, and each adds friction and data.
| Method | What it establishes | What it doesn’t | Data touched | Friction |
|---|---|---|---|---|
| Barcode scan of a license or state ID | The date of birth encoded on the document | Whether the document is genuine or belongs to the holder | Whatever the barcode encodes, typically name, address and date of birth | Low |
| Document authentication | That the document’s security features look genuine | Whether the holder is the owner | Document images | Medium |
| Face match with liveness | That a live person is present and resembles the ID photo | Whether a well-made fake ID is genuine, unless paired with authentication | Biometric data | Medium to high |
| Pre-verified account | That someone passed a stronger check earlier | Who is holding the phone or badge today | An account record and a verification result | Very low after enrollment |
| Attended release | That a trained person looked at the ID | Anything beyond what that person saw | Usually nothing stored | Depends on staff availability |
A few notes from the field:
- Barcode-only checks are the weakest rung. Fake IDs can carry valid-looking barcodes, and a borrowed real ID passes perfectly. Use barcode reading as a convenience layer, not the whole defense.
- Liveness answers the photo-of-a-photo attack. Passive liveness looks for signs of a real face, such as depth, texture and natural micro-movement, without asking the shopper to do anything. Active liveness asks them to turn or blink. Both are sensitive to lighting, glare and camera height, which in a dim lobby at night is a real constraint.
- Pre-verified accounts move friction to enrollment. A shopper verifies once through a stronger process, then buys with a tap. Account sharing becomes the risk, so bind the account to a device, re-verify periodically, and watch for impossible patterns such as one account buying at two sites an hour apart.
- Attended release is underrated. At a hotel pantry, the front desk checks ID and releases a locked compartment remotely. The store stays unattended, with an attended exception, and some rules require exactly that human judgment in the loop. See how hotel lobby markets work on our hospitality page.
Worked example: what friction costs
Suppose a residential building’s lobby market sells 60 restricted items a day, where local rules allow it, mostly to the same 200 residents. Compare two designs.
Design 1: scan plus face match at every purchase. If verification adds 30 seconds and one attempt in ten needs a retry, shoppers spend about 33 minutes a day verifying: 60 × 30 seconds, plus 6 retries. If even 1 shopper in 15 gives up, that’s 4 lost sales a day, or 1,460 a year.
Design 2: verify once, then tap. Residents complete a stronger check once, at enrollment, and buy with a tap afterward. Visitors use an attended release through the front desk. For most transactions, time spent verifying at the cabinet drops to near zero, and the stronger check happens once, under better conditions.
The lesson generalizes. The right method depends on how often the same people come back. Repeat shoppers justify one strong enrollment; a transit kiosk full of strangers has to verify every time, which is one more reason it may not be the right place for restricted items at all. Our apartment micro market page covers how resident accounts work.
Privacy: keep the answer, not the ID
Age verification can collect sensitive data very fast: names, home addresses, dates of birth, document images and, with face matching, biometric data. Almost none of it is needed after the decision is made.
A privacy-first design keeps four fields per check: result (pass or fail), method (barcode, authentication, face match, attended), timestamp and device. That’s enough to show a check happened and how, without building a database of driver’s licenses next to a snack cooler.
- Parse the document, compute the yes or no, and discard the raw data on the device or at the verification provider
- If face matching is used, run it through a specialist provider, with clear notice and consent, and contract terms covering deletion and no secondary use
- Never reuse verification data for marketing, loyalty or analytics
- Keep verification records separate from purchase records where the rules allow
- Post plain signage explaining what’s checked and what’s kept
- Review state biometric privacy laws before deploying any face-based step; Illinois’s Biometric Information Privacy Act is the best known, and several other states regulate biometric data in some form
Data you never stored can’t leak, can’t be subpoenaed and can’t become a headline. Minimization is a security control as much as a privacy one.
Failure modes to design for
- Pass-back. An adult buys and hands the product to a minor. Unattended retail can’t prevent this any more than a cashier can watch the parking lot. Placement in adult-only areas and per-account purchase limits reduce it.
- Outages. If the verification service is unreachable, restricted compartments should fail closed. The rest of the store can keep selling on offline-buffered payments, as described in our guide to unattended checkout design.
- Accessibility. Camera height, reach ranges and screen contrast matter for wheelchair users and shoppers with low vision. Offer an alternative path, such as attended verification, so the restricted aisle isn’t closed to some adults by design.
- Document variety. Out-of-state licenses, passports, military IDs and older card formats all show up. Know which documents your method accepts, and say so on the screen before the shopper starts.
- Rule drift. A product that’s legal to sell this quarter may be restricted next quarter. Name an owner for each restricted category and site, and re-check the rules on a schedule.
Checklist: before the first restricted sale
- Written confirmation that the category may be sold unattended at this site, and under what conditions
- Any required license or permit in place, and its conditions reflected in the device setup
- Verification method chosen, with the reasoning documented
- Restricted items in a separately locking compartment
- Fail-closed behavior tested by unplugging the network
- Data retention limited to result, method, time and device
- Signage, accessibility alternative and escalation contact in place
- A review date on the calendar
How 8Kava approaches this
We treat age-restricted dispensing the way we treat temperature compliance: as a compliance project before it’s a hardware project. With a host, our first step is establishing whether a category can be sold unattended at that site at all, and only then choosing the lightest verification that meets the rule. Restricted items belong behind their own lock, such as a Kava Lockers compartment with per-compartment door sensors and code, QR, badge or app access, so the rest of the assortment stays tap-and-go.
Our privacy principles carry over from the rest of the platform: Kava Cooler’s recognition runs on the device and looks at products, not people, and no images of faces are stored or sent. Read more on Security & Trust and in our privacy policy.