Age Verification Policy

SnusBox sells nicotine pouches only to customers aged 18 or over. We do not sell nicotine products to anyone under 18, and we will not complete a nicotine order until age has been verified.

This policy is how we meet the age-verification duty in section 10(2)(b) of the Tobacco and Vapes Act 2026 for England and Wales, and section 4A of the Tobacco and Primary Medical Services (Scotland) Act 2010. It applies to every nicotine pouch in an order. A basket that contains nicotine alongside anything else, including caffeine pouches, is still an 18+ order.

Orders that contain only nicotine-free caffeine pouches are not nicotine sales. Those orders do not go through this check.

Before checkout can be completed, and before an order is dispatched, nicotine orders pass an automated check run by Didit. The SnusBox workflow is:

• Cryptographic ID document OCR, with an automatic decline when the date of birth is under 18.
• ISO/IEC 30107-3 Level 1 passive liveness, so the selfie is of a live person.
• A biometric face match between the selfie and the portrait on the identity document.

The check takes about 30 seconds. You photograph your ID and take a quick selfie in a secure Didit window. SnusBox staff do not view the images as part of normal checkout. Payment is blocked until Didit's server confirms the decision is Approved and the recorded age is 18 or over.

You only have to pass the check once. Approval is stored against your account and the email address you used, including a guest checkout that is later linked to an account with the same email. The next order on that account or email skips the check and shows an 18+ verified badge.

Each decision is kept as an audit record for Trading Standards: the verification status, when it happened, the method, and the Didit session reference. We do not delete that record as part of a normal account update. A failed or abandoned check does not mark the account as verified, and a callback or webhook cannot do so unless Didit's API confirms the approval.

Identity images and the document itself are processed by Didit solely to verify age and that the document matches the person completing checkout. SnusBox does not keep those images.

In line with the UK GDPR data minimisation principle, SnusBox retains only the verification status, the date of birth, whether the name on the document matched the checkout name, and the audit metadata needed to show that the check took place (including document type, issuing country, liveness and face-match results, and the session reference).

Questions about this policy: support@snusbox.co.uk. See also our Privacy Policy and Terms of Service.