Age Verification

Mage2Expert Age Verification is an extension for Magento that stops a customer from completing checkout on age-restricted products until they confirm they meet a minimum age requirement. Merchants mark any product as age restricted with a single toggle switch on the product edit page, choose a global default minimum age (with an optional override for individual products that need a different limit, such as 18 for vape products versus 21 for alcohol), and pick one of two verification methods: a Date of Birth calendar picker that calculates the customer's real age, or a lightweight Checkbox confirmation for stores that only need a self-attestation. From that point on, the extension handles the entire flow without any theme or code changes — the moment a restricted product is added to the cart, an on-brand popup lets the shopper know an age check will be required; at checkout, a verification block appears directly above the Place Order button, but only when the cart actually contains a restricted item, so unaffected customers see no change at all; and if the age requirement is not met, checkout is blocked with a clear, fully editable message until the customer resolves it. Every message shown to the customer — the popup text, the checkbox label, and the failure message — is configurable from the admin panel per store view, with a {{min_age}} placeholder so the correct minimum age is always shown automatically. 

The same age gate also protects orders that never touch the storefront. A liquor store taking phone orders, or a support agent placing an order on a customer's behalf from Sales → Create New Order, sees the identical confirmation checkbox and cannot submit the order without checking it first. And because the check is enforced again on the server — for the default storefront checkout, for the REST API, and for a dedicated GraphQL mutation — a technically inclined customer cannot bypass the age gate by disabling JavaScript or calling the API directly; disabling the browser-side check only removes the convenience of instant feedback, not the underlying restriction. A vape or e-cigarette retailer might use Checkbox mode store-wide for a fast, low-friction self-attestation, while a store selling both age-restricted knives and alcohol could use Date of Birth mode with different per-product minimum ages, and a wholesaler running a headless PWA storefront can call the REST or GraphQL endpoints directly to build a fully custom verification screen while keeping the same server-side protection. Every verification attempt can also be recorded on the order — mode used, pass or fail, and timestamp — giving merchants an audit trail to point to if a restricted sale is ever questioned, with raw date-of-birth retention available as a separate, off-by-default opt-in for stores with a specific compliance need. 

Features

• Two Verification Modes — Date of Birth (calculates a real age from a calendar picker) or Checkbox (simple self-attestation), selectable store-view by store-view.
• One-Click Product Restriction — a single Age Restricted toggle switch on the product edit form, with an optional per-product Minimum Age Required that falls back to the store-wide default when left blank.
• Smart Checkout Gate — the verification block only appears when the cart actually contains a restricted item, is correctly positioned for every available payment method, and resets automatically if the customer switches payment methods.
• Configurable Add-to-Cart Notice — an attractive, centered popup informs the customer of the age requirement the moment a restricted product is added, with a fully customizable message.
• Admin Order Protection — the same age gate applies when an admin manually creates an order from Sales → Create New Order, closing the phone/MOTO order loophole.
• Server-Side Enforcement — verification is validated again at place-order time on the server (storefront, REST API, and GraphQL mutation), not just in the browser.
• Re-Verification on Cart Change — if the cart contents change after a customer has already verified, the extension can require them to confirm again before placing the order.
• Compliance Audit Trail — the verification mode, pass/fail result, and timestamp are stored on every order; raw date-of-birth retention is available as an opt-in for stores that need it, off by default to minimize PII storage.
• Fully Customizable Messaging — the checkbox label, the failure message, and the add-to-cart notice all support a {{min_age}} placeholder and are translatable per store view.
• Guest Checkout Support — applies to guest orders by default, with a configuration toggle for stores that only need to gate logged-in customers.
• REST & GraphQL Ready — dedicated endpoints and a setAgeVerificationOnCart GraphQL mutation let headless and custom-integration storefronts submit verification the same way the default checkout does.
• Zero Core Code Modifications — built entirely on Magento's plugin, layout XML, and EAV attribute architecture. No class rewrites, no core file edits, safe alongside Magento upgrades and other extensions.

How It Works

After enabling the extension under Stores → Configuration → Mage2Expert → Age Verification, choose a Verification Mode and set a Default Minimum Age. Open any product you want to restrict, switch on Age Restricted in the new product section, and optionally set a product-specific minimum age. From that point on, adding the product to a cart shows the configured notice, and the cart cannot be placed until the age requirement is confirmed — on the storefront, through the API, or from an admin-created order. 

Checkout Experience

When a customer's cart contains one or more restricted items, a verification block is injected immediately above the Place Order action for whichever payment method is currently selected. In Date of Birth mode, an attractive calendar picker calculates the customer's age instantly and shows a success or failure message before they even click Place Order. In Checkbox mode, a single confirmation checkbox with a customizable label is required instead. Either way, the same check runs again on the server when the order is actually submitted, so the storefront UI is a convenience layer, not the only line of defense. 

Add-to-Cart Notice

The moment a shopper adds a restricted product — from the product page or a category listing — a centered, on-brand popup lets them know they will need to verify their age at checkout. The notice message is fully configurable with the {{min_age}} placeholder, and can be turned off entirely for stores that prefer to only prompt at checkout. 

Admin Order Protection

Orders created manually from Sales → Create New Order are gated the same way storefront checkout is. When the order being built contains a restricted item, a confirmation checkbox showing the required minimum age appears above Submit Order, and the same server-side validation blocks the order if it is left unchecked. This closes a common gap where phone and MOTO (mail/telephone) orders bypass storefront-only age gates.

Compliance & Audit Trail

Every verification attempt can be recorded on the order — verification mode, pass/fail result, and timestamp — giving merchants a record to point to if a restricted sale is ever questioned. Raw date-of-birth retention is available as a separate opt-in for stores with a specific compliance need, and stays off by default so the extension only stores the minimum PII necessary out of the box. 

Use Cases

• Alcohol, tobacco & vape retailers — enforce a legal minimum purchase age across every sales channel, including admin-created and phone orders.
• Knives, airsoft & restricted hobby goods — apply a per-product minimum age only to the SKUs that actually require it, without touching the rest of the catalog.
• Supplements & adult-oriented products — collect a lightweight self-attestation via the Checkbox mode when a full date-of-birth check isn't required.
• Headless & PWA storefronts — call the REST endpoints or the GraphQL mutation directly to build a fully custom verification UI while keeping the same server-side enforcement.
• Multi-store retailers — run different verification modes, minimum ages, and messaging per store view from a single Magento installation.