How to prepare for the FDA under-30 tobacco ID rule before January 2026 enforcement.

What the FDA changed in 2024

In August 2024, the FDA finalized changes to the federal Tobacco 21 enforcement rules:

• The age threshold for the photo ID check moved from "under 27" to "under 30." A cashier must check ID for any customer who appears younger than 30.
• The rule applies to all tobacco products, e-cigarettes, vaping products, nicotine pouches, and any other deemed product.
• The legal sale age remains 21 (Tobacco 21, federal since December 2019).
• Effective date: September 30, 2024. Active FDA enforcement begins January 12, 2026.

The 16-month window between effective date and enforcement is the retailer preparation period. By December 12, 2025 (roughly 30 days before enforcement), every station should have updated POS prompts, retrained staff, and built a documented training and compliance program.

Step 1: update POS prompts

The POS age verification prompt is the cashier's primary defense. The prompt should:

• Fire on every tobacco, e-cig, vape, and nicotine SKU
• Require the cashier to enter or scan the date of birth from the ID
• Calculate age automatically (not ask the cashier to do math)
• Block the sale if the calculated age is under 21
• Log the date of birth and verification timestamp to the transaction record
• Require a manager override to bypass

Most c-store POS systems support all of the above. Many operators have the feature turned off or configured to ask only for "visual under 30 check, no scan required." That is not enough for FDA defense; the date of birth should be captured.

Audit your POS settings this week:

• Pull a sample of 20 tobacco transactions from the last week
• Verify each one has a date of birth captured in the transaction log
• Verify the override count is low (under 1 percent of tobacco transactions)
• If gaps exist, fix the POS configuration immediately

Step 2: retrain every employee

Annual tobacco compliance training is required by most states. Under FDA scrutiny, the training quality matters as much as the training existence.

Effective training covers:

• The under-30 visual threshold (not 27)
• The acceptable ID types (driver license, state ID, passport, military ID)
• The legal sale age (21, federal)
• How to read an ID for date of birth and expiration
• How to spot a fake ID
• What to do when a customer pushes back or becomes hostile
• The consequences for the cashier and for the store of a failed sale

Document training. Each cashier signs an acknowledgment that they received and understood the training. Keep signed forms in the employee file. The training record is the single most-requested document during an FDA compliance review.

Step 3: run undercover buys yourself

FDA contracts with undercover buyers (often 18 to 20 year olds) who attempt to purchase tobacco. If the sale goes through without ID check, the violation is recorded.

Run your own version. Have a friend, family member, or contracted secret shopper attempt to buy tobacco at each of your stores once per quarter. Report back what happened. Use the results to target additional training.

Operators who run their own compliance buys typically catch one cashier per 3 to 6 months who is skipping the ID check. Better to catch internally and retrain than to catch via FDA penalty.

Step 4: post the required signage

Federal law requires specific signage at the point of sale wherever tobacco is sold. The current required text:

"Federal law prohibits sale of cigarettes to persons under 21 years of age."

Sign should be visible to the customer at the register. Some states require additional state-specific signage. Order the sign through the FDA website (free) or buy a compliant version from a vendor.

What happens during an FDA compliance inspection

The undercover buy

An FDA contractor sends an underage buyer to attempt a purchase. The buyer either provides a real ID showing underage, refuses to show ID, or has no ID. The cashier either:

• Asks for ID, sees the customer is underage, refuses the sale (no violation)
• Asks for ID, sees the customer is underage, sells anyway (violation)
• Does not ask for ID, sells (violation)

The follow-up

If a violation occurs, the buyer immediately notifies the on-site FDA observer. The observer enters the store and identifies as FDA. They will:

• Document the violation
• Speak with the cashier and manager
• Request to see the training record for the cashier
• Request to see the POS log of the transaction
• Take photos of the sale area and required signage

The notice

2 to 8 weeks later, you receive a violation letter from FDA. First-time violations are typically warning letters. Second and subsequent violations carry monetary penalties. Repeat offenders face 30-day no-tobacco-sales bans, which for a typical c-store mean a 20 to 40 percent revenue drop during the ban window.

The compliance trail that defends a violation

If FDA does flag a violation, the defense depends on what documentation you produce. Strong documentation can downgrade a penalty (warning instead of fine, smaller fine instead of larger) and can support a clean record at subsequent inspections.

Documents to maintain:

• Cashier hire date and termination date
• Signed training acknowledgments (date and topic)
• POS configuration documentation (the age verification settings)
• POS transaction logs showing date-of-birth captures
• Manager override logs
• Self-conducted compliance buy results
• Required signage photos with date stamps

A back-office system that links employees to training records, to POS transaction logs, to compliance buy results produces this defense package in 10 minutes. A filing cabinet system produces it in 3 days, if at all.

The 4 mistakes that get c-stores penalized

1. POS prompt configured for visual check only

Many POS systems have an option for "visual under-30 check, no scan." The cashier confirms they checked but does not enter the date of birth. This is not enough for FDA defense. Configure the POS to capture date of birth on every tobacco sale.

2. New employees not trained before their first shift

A new cashier on day one who sells to an undercover buyer is your liability, not theirs. Training before the first shift, signed acknowledgment in the file, no exceptions.

3. Manager override used as a shortcut

When the cashier sees a regular customer who is "obviously 50," some cashiers learn to use the manager override to skip the prompt. Each override is a data point in your log, and a high override rate shows up in FDA review as evidence that the prompt is not being respected.

4. Selling vapes without realizing they are deemed tobacco products

The FDA deems e-cigarettes, vape pens, e-liquid, nicotine pouches, and hookah tobacco as "tobacco products" subject to the same age verification rules as cigarettes. Some operators have age prompts on cigarettes but not on vape SKUs. Audit every SKU in the deemed product list.