Scanning ID for Online Alcohol Purchases: Retailers Concerned About Costs

The proposed amendments to the Trade Act, which the Ministry of Economy has sent for public consultation, introduce stricter rules for online alcohol sales and significantly change the way purchases are made via the internet.

According to the proposal, retailers will have to implement a technical solution that enables automated reading of the machine-readable zone of the identification document. If the customer refuses such verification, the sale cannot be completed. This shifts the responsibility for age verification from delivery to the moment of online purchase itself. The previous practice, where verification largely relied on a formal statement from the customer confirming they are over 18 years old, is practically abolished.

However, key questions are just beginning to emerge: how will such a system be implemented in practice, who will define the standards, and how much will implementation cost retailers.

The Croatian Employers’ Association (HUP) states that they support the proposed amendments but warn that the way the proposal is set leaves a number of ambiguities that could complicate its implementation.

– HUP – The Trade Association supports a zero-tolerance policy towards the sale of alcohol to persons under 18 years of age, and we support public health activities aimed at protecting minors and preventing excessive alcohol consumption. Until now, in most online stores and delivery platforms, age verification has been mandatory, through a statement from the customer confirming that they are over 18 years old, and by providing proof of date of birth – said HUP representatives.

However, as they emphasize, the problem is that a unified model has not yet been established at the level of the European Union, so national solutions could be temporary or inconsistent.

– At this moment, there is no unified model for age verification for online alcohol sales, and verification upon delivery is still the most common model in most EU countries. The European Commission is working on establishing a coordinated approach to age verification at the EU level, whereby the user will prove that they are over 18 years old without revealing their identity or personal data, and we believe that we should wait for the adoption of a unified model at the level of the European Union – HUP representatives state.

In addition to strategic issues, HUP particularly emphasizes operational challenges. They warn that the law does not provide enough concrete guidelines on how retailers should implement the new solutions, which could lead to different interpretations and practical problems.

– The proposed law prescribes automated reading of the machine-readable zone of a valid identification document, but there is no assessment of the impact of the regulations on retailers, it does not specify which software or platforms will be acceptable, whether there will be certified service providers, and whether the state will ensure standards – HUP representatives note.

They also warn about the issue of data protection, which could be one of the key aspects in implementing such a model.

– This model of verification raises questions of compliance with personal data protection regulations, as processing identification documents and their machine-readable records can represent significant processing of personal data, the compliance with GDPR provisions is often challenging in practice – they explain.

In such circumstances, they emphasize that without clearly defined standards, there is a risk of uneven application and legal uncertainty for retailers, along with the financial aspect.

– Additionally, the cost of implementation of such solutions, especially for small and medium online stores, but also for large ones, given the aforementioned ambiguities, is high, and we must not overlook the significant administrative burden – conclude HUP representatives.

Technological Perspective

However, the problem is not only regulatory but also technological. Robert Ilijaš, founder and CEO of Identyum, emphasizes that reliable age verification in an online environment requires addressing several different challenges. The first is the issue of accuracy. Ilijaš explains that in some countries, age estimation is done through photographs and algorithms, but such systems are not reliable enough for this purpose.

– The problem with such an approach is that it can ‘miss’ by 2-3 years, i.e., for a person who is 15 years old, it can incorrectly detect them as 18+ – said Ilijaš.

In other words, simplified solutions that rely solely on estimating the user’s appearance cannot guarantee the accuracy needed for regulatory requirements. On the other hand, the model proposed by the law, reading the MRZ zone of the ID card, addresses the issue of the accuracy of the date of birth but raises questions of authenticity. Ilijaš warns that such an approach alone is not sufficient to prevent abuse.

– Optical reading (‘OCR’) of the MRZ zone alone is not enough without being paired with the verification of the authenticity of the identification document and the verification of the authenticity of the user themselves – he explains.

In practice, this means that the system can read the data, but it cannot guarantee that the document is real or that it belongs to the person using it. The third important aspect relates to user privacy. Ilijaš emphasizes that for age verification, it is not necessary to collect more data than is necessary. In age verification, the only thing the user actually needs to prove is that they belong to the age group they should belong to, i.e., that they are over 18 years old. This means that solutions should be designed to minimize the processing of personal data, which is particularly important in the context of GDPR.

As an alternative, Ilijaš mentions a model of digital identity based on the so-called ID Wallet and selective data sharing. In such a system, the user has complete control over their identity and decides which information to share.

In practice, this means that the retailer would only receive confirmation that the user is of legal age, without access to other personal data. Such an approach potentially solves three key problems – accuracy, security, and privacy. Ilijaš adds that such technology already exists and is used, primarily in the financial sector, while for retailers, implementation is relatively straightforward. However, when it comes to costs, he emphasizes that they depend on specific systems and the scope of use, which is why they cannot be precisely defined in advance.

For retailers, key questions remain open, from technology selection to costs and regulatory compliance. At a time when the European Union is still working on a unified model, there is a real possibility that the rules will change again in the near future. Therefore, the discussion in the public consultation will be important not only for the alcohol market but also for the broader development of digital identification.