The short answer

There is no single national age for buying CBD online. Federal law sets 21 as the minimum purchase age for tobacco products, and vapes count as tobacco products, so a CBD vape is a 21+ item everywhere in the country. For tinctures, gummies, capsules, and topicals, Congress never set a number. That leaves the line to state law, and states have landed in three places: 21, 18, or no minimum at all.

In practice, a shop that ships nationwide has to apply the rule of the state it ships into, not the rule of the state where it sits. Buyers should expect to prove their age before checkout, and again at the door if someone has to sign for the package.

What federal law says

The 2018 Farm Bill pulled hemp, defined as cannabis with no more than 0.3% delta-9 THC by dry weight, out of the Controlled Substances Act. That made hemp-derived CBD legal to farm and ship across state lines. It did not set an age.

The FDA has not recognized CBD as a lawful dietary supplement ingredient, and it has not established a federal minimum age for CBD sold as a supplement or cosmetic. Anyone who tells you "the FDA says 18" is making it up.

Tobacco is the exception. In December 2019, Congress raised the federal minimum age for tobacco product sales to 21, and the FDA treats e-cigarettes, vape cartridges, and their components as tobacco products. A CBD vape pen, a disposable, or a cartridge falls under that rule. FDA retailer requirements also tell sellers to check photo ID for anyone who appears to be under 27.

Where states set the line

Adult-use cannabis states run on 21. Medical programs vary: many allow patients under 18 with a caregiver, and a few set 18 as the patient age. Several states have written hemp-derived products into their cannabis rules and apply the same 21+ standard, particularly for anything with intoxicating cannabinoids such as delta-8 THC.

A smaller group of states has gone the other way and restricted or banned intoxicating hemp cannabinoids outright. And a few have no stated minimum for non-intoxicating CBD, which is why you can find topical balms on a shelf next to the vitamins in some places and behind a counter in others.

If you are shopping from a state you do not live in, check the destination state's rule. That is the one the seller is on the hook for.

How online age verification works

There are three tiers, and they are not equal.

• Self-attestation. A birthdate field or a "yes, I am 21" button. This is a gate, not verification. It stops nobody who is willing to lie.
• Database checks. The site sends your name, address, and date of birth to a verification service that matches it against public records, credit header data, or DMV data. Fast, but it fails for people with thin credit files or recent moves.
• Document and biometric checks. You upload a photo of your driver's license or passport, the service reads the barcode, and sometimes you take a selfie to match the face. This is the strongest option and the one most hemp brands use when they ship to strict states.

Then there is delivery. Many carriers offer adult signature service, which requires someone 21 or older to show ID at the door. For a 21+ product, that closes the loop between the online check and the actual handoff.

What a compliant checkout looks like

From the buyer's side, a store doing this properly looks like: an age gate before you browse, a real verification step at checkout, a clear statement of which states it ships to, an adult signature option on the shipping label, and a lab report for the product available before you pay. Records of the verification are kept, often for several years, because state regulators ask for them.

None of that is friction for its own sake. A chargeback or a sting from a state regulator is expensive, and card processors will drop a hemp merchant who cannot show an age control program. The rules exist because the seller carries the liability.

Red flags on a CBD site

• A one-click age gate with no verification at checkout, paired with claims about being "fully compliant."
• Delta-8 or THC products shipped to states that restrict them.
• No certificate of analysis, or a COA from a lab that is not ISO 17025 accredited.
• No physical address or phone number. Age rules come with record-keeping duties, and a business that hides its identity is not keeping records.

The honest version: CBD age rules are a patchwork. It is 21 for vapes everywhere, and 21 or 18 or nothing for everything else depending on where the package lands. If you are not sure, ask the seller which state rule they are applying to your order. A good one will know.