Age verification online: a court says a screenshot isn't enough

A screenshot on trial

When you buy something online that requires age verification, what counts as proof that the check happened? A Swedish court has just answered that question, and the answer is stricter than some sellers expected.

In a ruling handed down recently, Malmö District Court found that Snusbolaget, an online tobacco retailer, had failed to meet the legal requirement to verify buyers' ages ^[1]. The company had been using screenshots from BankID, Sweden's national electronic ID system, as its record that a check had taken place. The court said that wasn't good enough.

The case is a useful reminder of something that applies far beyond tobacco: a record you keep yourself, and can edit yourself, is easier to challenge than one you can't.

What the Tobacco Act requires

Sweden's Tobacco Act says that anyone selling tobacco remotely must check the buyer's ID before handing over the goods ^[2]. The law is short on technical detail. It says the seller must check, but it doesn't prescribe exactly how.

The tobacco authority, Folkhälsomyndigheten, had argued that a screenshot doesn't prove anything. You can take a screenshot, save it, edit it and present it later. There's no way to tell, just by looking at the image, whether it shows what actually happened at the time of the sale. The authority said a proper check requires a live connection to BankID at the point of purchase, so the system itself confirms the person's age in real time ^[1].

Snusbolaget disagreed. It said its method—saving a screenshot of the BankID result and attaching it to the order—was a reasonable way to document compliance. The court sided with the authority.

The ruling

The court's reasoning was straightforward. The Tobacco Act requires an ID check. A screenshot is a picture of a check that might have happened, but it doesn't prove the check took place when the sale was made. Screenshots can be altered. They don't carry a timestamp you can trust, and they don't show a live connection between the customer and the ID system ^[1].

In the court's view, that made the method inadequate. Snusbolaget was fined, and the case is now shaping how other online sellers think about age verification.

Why it's an evidence question

Think of it like a postmark. If you post a letter and need to prove when you sent it, the postmark on the envelope is decent evidence, because you didn't put it there—the post office did. A note you wrote yourself saying "posted on Tuesday" is less convincing, because you could have written it any time.

A screenshot is the note you wrote yourself. It shows something, but it doesn't prove when that something happened or that nobody has changed it since. The tobacco authority's argument was that a live check, where BankID confirms the person's age at the moment of purchase, is more like the postmark: a third party vouching for what happened, when it happened.

The problem isn't unique to tobacco. Any business that keeps records to show compliance, or to settle disputes, faces the same question: if you're the one holding the record, and you could change it, how do you prove you didn't?

The industry's response

Haypp Group, which owns Snusbolaget, has said it will adjust. From 19 October 2024, Snusbolaget's products will no longer be sold through the Snusnetto platform ^[3]. Other sellers are watching. If screenshots aren't enough for age checks under the Tobacco Act, the same logic could apply to other regulations that require you to document that you did something at a particular time.

The ruling doesn't tell sellers exactly what system to use. It just says that the method has to be robust enough that the record itself is hard to question. That's a higher bar than some had assumed.

How a digital witness would fit here

This is a case where sealing a record at the time it's created would answer the court's concern.

Here, the thing to seal is the age check result as it comes back from BankID: the person's age or date of birth, the timestamp and the order reference. You'd seal it the moment the check completes, before the sale goes through. The check itself stays with BankID; what you seal is a fingerprint of the result, not the data.

Anyone you share that record with—an inspector, an auditor or a court—can later check that it's exactly what was recorded at that time. If someone changes a single character in the record, the fingerprint won't match. The seal is made by a neutral third party, WitniumChain, so you can't quietly rewrite it.

What it shows is that the record existed at the time of the sale and hasn't changed since. What it doesn't show is that the person who logged in with BankID was the person who received the goods, or that the age in the record was correct. Those are separate questions. But it does give you a record that's harder to challenge than a screenshot, because the timestamp and the integrity come from outside your own systems.

You'd integrate it through the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free.

How it would work

1. Customer completes BankID check at checkout.
2. Your system seals a fingerprint of the result (age, timestamp, order ID) with WitniumChain and stores the witness ID.
3. If the sale is questioned, you share the original record and the witness ID. Anyone can check that they match.

What this means for you

If you sell age-restricted goods online, or anything else where you need to prove a check happened at a certain time, this ruling is worth a read. The court is saying that the method has to stand up to the question: could this record have been made or changed after the fact?

A few practical questions to ask:

• Does your verification happen live, or do you keep a screenshot or a saved file?
• If an inspector questioned the timestamp, could you prove when the check was done?
• Who controls the record, and could they edit it?

The answers don't have to involve a particular technology. They just have to satisfy the rule, which in this case is that the check must be done and must be documentable in a way that holds up.

What to watch

This is a district court ruling, not a precedent from a higher court, so it's not the final word. But it's a clear signal of how authorities and courts are starting to think about digital records and evidence.

For other regulations—GDPR's accountability principle, the AI Act's logging requirements, DORA's rules on ICT event logs—the same logic applies. If you keep the record and could change it, expect to be asked how you prove you didn't.

The next question for many businesses will be whether the same reasoning spreads beyond tobacco to other sectors where age, identity or compliance checks are required and documented digitally.