Federal T21 (Tobacco 21) law, how is it actually enforced?

The Tobacco 21 Act (signed December 20, 2019) raised the federal minimum age for all tobacco + vape sales from 18 to 21. As of 2026, enforcement comes from three directions:

• FDA Center for Tobacco Products (CTP), conducts undercover compliance check buys (think: a 19-year-old test shopper tries to buy from your store). Failure = warning letter, then civil money penalty up to $11,182 per violation (2024 rate, inflation-adjusted).
• State Attorneys General, states with stricter laws (MA, NY, CA) bring their own enforcement. State fines run $500, $50k per non-compliant sale.
• Civil class actions, minors’ parents sue if they discover the kid bought from your store. Class certifications have settled for $1M, $8M.

What “compliance” looks like in 2026:

• Real ID verification at checkout, not a click-through. Veratad / Yoti / AgeChecker.net (see separate FAQ).
• Adult Signature 21+ required at delivery, FedEx Adult Sig confirms recipient is 21+ at the door. No leaving on porch.
• Marketing audit, no flavor names, packaging, or imagery that appeals to minors (no cartoons, no fruit names that mimic candy, no school-aged models in ads).
• Order audit trail, per-order log of: ID-verification vendor + timestamp + pass-reason, carrier + tracking + adult-sig confirmation. Keep 4 years.

How we wire it in Magento: every order gets a compliance_metadata JSON column with the audit trail. Admin can pull a state AG inspection report in 1 click. We’ve passed 6 state inspector audits with this pattern.