Age gates and age verification for US alcohol websites

Every alcohol website in the US needs some kind of age check. But “age check” covers four very different things. Mixing them up is the most common mistake we see.

Not legal advice. State rules differ and change. Check with a beverage alcohol attorney before you launch or change your checkout.

Four different checks

Check	Where	What it proves	Who asks for it
Click-through gate (“Are you 21?”)	Website entry	Nothing. The visitor clicks yes.	Weakest option. Fails the DISCUS code.
Date-of-birth gate	Website entry, signup forms	The visitor says they are 21+	DISCUS, Wine Institute, Beer Institute codes
Age verification	Checkout	A third party checks the buyer is 21+	Wine Institute best practice, some state laws, Shopify (“effective age verification”)
Adult signature 21+	Delivery	The person receiving the box is 21+ with ID	Carriers and many state laws

The first two are “age affirmation.” The third is “age verification.” The fourth is the last line of defense.

What the law requires

Selling or delivering alcohol to anyone under 21 is illegal in every state. Beyond that, the rules depend on where you are in the funnel.

Marketing sites. We know of no federal law that requires an age gate on a brand’s marketing website. The gate comes from industry codes and from what partners and platforms expect.

Online sales. State direct shipping laws differ. A 2021 Avalara review found only about seven states with explicit age verification rules for DTC sales. Some, like South Dakota, let shippers copy a photo ID or use an age verification service. Others, like Michigan and Indiana, put the duty on the carrier at delivery. Even where the law is silent, regulators act. In 2022, Massachusetts ran underage purchase checks on DTC license holders, and the Wine Institute warned that failures can put a winery’s federal permits at risk.

Platforms. Shopify’s alcohol page tells US merchants to use effective age verification to block purchases and deliveries to anyone under 21.

Delivery. UPS and FedEx require an adult signature from someone 21 or older for alcohol.

Text messages. Carriers require a strong 21+ age gate before anyone can opt in to an alcohol SMS program. Our Klaviyo guide covers this.

What the industry codes ask

The codes are voluntary self-regulation for members. But retailers, media sellers and partners often require them from everyone, and the codes set what “responsible” looks like if a complaint is filed.

DISCUS Code (spirits)

The Distilled Spirits Council’s Code of Responsible Practices (2025 edition keeps the 2023 wording on websites):

• Member websites should use age affirmation with month, day and year.
• Websites should show a reminder of the legal purchase age.
• If the birth date shows the visitor is under 21, deny access and show a message or send them to a responsibility site such as responsibility.org.
• Before collecting any personal data, ask the person to affirm they are of legal purchase age.
• Use opt-in before direct digital marketing, and always offer opt-out.
• Place ads only where at least 73.8% of the audience is reasonably expected to be 21+.
• Models and actors should be at least 25 years old.

Wine Institute Code (wine)

• Use an age affirmation mechanism on the homepage.
• Use a third-party age verification mechanism to verify the legal drinking age of online buyers.
• Use opt-in for direct digital marketing and offer opt-out.
• Don’t place ads where more than about 26% of the audience is under the legal drinking age. (The code page says 26.2%. A 2023 Wine Institute notice says 26.3%.)
• Models shown as wine drinkers should be at least 25.

Beer Institute Code (beer)

The code was updated on January 1, 2026:

• On brewer websites and branded social channels, restrict access to users who confirm they are of legal drinking age. That means a full birth date or other active confirmation, or registration.
• Require influencers posting branded content to use the platform’s age gating where it exists.
• Verify age before collecting any personal data, and use opt-in and opt-out.
• Place ads where at least 73.8% of the audience is of legal drinking age.
• Models and actors should be over 25.

Which check to use where

• Brand and marketing site: date-of-birth gate on first visit.
• Email and SMS signup forms: date-of-birth field, even if the site gate already ran.
• Checkout: third-party age verification. If a licensed retailer partner runs checkout, confirm in writing how they do it.
• Delivery: adult signature 21+. Say so on product pages and in the order confirmation.

How to build a good age gate

A gate should be quick for adults, clear for everyone, and hard to skip by accident.

Inputs

• Use three short fields (month, day, year) or one date field. Avoid a dropdown with 100 years.
• Use inputmode="numeric" and the autocomplete values bday-month, bday-day and bday-year so phones can fill them.
• Never pre-fill a year that makes the visitor 21.
• Show the order of fields in the label (US format: month first).

Behavior

• Remember a passed check for a reasonable time with a cookie or local storage, so adults aren’t asked on every page.
• If the visitor is under 21, show a clear message and a link to responsibility information. Don’t show the content.
• Keep the privacy policy, terms and contact pages reachable without passing the gate.

Accessibility

Follow the W3C modal dialog pattern:

• Move focus into the gate when it opens, and keep it there while it is open.
• Give every field a visible label, not just placeholder text.
• Write errors as text next to the field (“Enter a 4-digit year”), not color alone.
• Make it work with keyboard only, at 320 px wide, and at 200% zoom.
• In a normal dialog, Escape closes it. In an age gate, Escape must not count as a pass.
• No CAPTCHA. It adds friction and blocks some disabled users.

Speed

Render the page and the gate together. A gate that loads a second script after the page appears causes layout shift and slows your Largest Contentful Paint.

SEO: keep gated pages crawlable

Googlebot can’t type a birth date. If the gate blocks it, your pages can drop out of search. Google’s own guidance is clear:

• Google recommends allowing Googlebot to crawl your content without triggering the age gate. Verify that a visitor claiming to be Googlebot really is (Google suggests a reverse DNS check) before skipping the gate.
• If Google can’t fetch content behind a gate, your site may rank poorly. Non-explicit content behind a gate also has a higher chance of being classified as explicit, which hides it when SafeSearch is on.
• Mandatory gates like age checks are exempt from Google’s intrusive interstitials guidance. But Google asks you not to redirect requests to a different page for the gate. Redirecting every URL to one gate page can remove all but that page from search.

What this means in practice:

1. Serve the full page in the HTML on its own URL.
2. Show the gate as a CSS and JavaScript overlay on top.
3. Never redirect to a /age-gate URL with a cookie check.
4. Don’t add noindex to the gate.
5. Test with the URL Inspection tool in Search Console, and search Google for text that sits behind the gate.

This also helps AI assistants. Many AI crawlers don’t run JavaScript, so server-rendered HTML under an overlay lets them read and cite your pages.

Common mistakes

• A yes/no gate on a spirits site. It fails the DISCUS code.
• Treating the site gate as checkout verification.
• Signup forms that collect emails before any age check.
• A gate on a separate URL that wipes your pages from Google.
• No adult signature on the shipping label, or no mention of it to buyers.
• Gift orders that never warn the buyer the recipient must be 21+ and show ID.

How False Rules helps

We build Shopify stores and brand storefronts for spirits brands, including the Dos Hombres mezcal store and storefronts on ReserveBar’s SDK for brands like Casa Dragones. Age gates, checkout verification and crawlable pages are part of every build. To review your current setup, write to us with your site address. We reply in writing.