What a vaping promo that went wrong can tell us about the future of age verification

What a vaping promo that went wrong can tell us about the future of age verification

Irrespective of what you might feel about the product itself, it was clear until earlier this month that the vape brand Crystal Bar had been extremely successful with its marketing.

Practically unknown just a few years back, it had grown in both sales and recognisability at an extraordinary rate to become the second-biggest vape brand in the UK and a staple at thousands of stores. Analysis suggests the company had recently hit 100 million sales a year.

Crystal’s performance was sensational.

A key part of this growth boom was driven by its giveaway promos – a way to reach and, it seems, retain new customers. “What we try and do with the [social] media accounts is just try and build up a bit of a buzz,” was how their chief executive explained the strategy.

But it was in its latest round of these buzz-building social media-based promos that Crystal suddenly became unstuck. Very unstuck.

The firm, which has a prominent and active social media presence, ran an online giveaway on the Discord instant messaging platform which it promoted via its Instagram feed.

Discord, which began as a platform for gamers before morphing into a general messaging tool, has continued to have a high proportion of under-18 users. And the Crystal Bar promotion on Discord was noticed by a BBC journalist who suspected it indicated that the company was, whether knowingly or unwittingly marketing its product to children.

Given that this would be illegal under UK media law – and given the sensitivity more generally around children and smoking and/or vaping – that journalist soon organized a small investigation.

Multiple competition entries were made. A couple of them won.

To claim their prize the winners were simply asked ‘Are you 18 or over?’ and once they’d confirmed that they were, with a box tick, they were simply asked for an address for their prize to be sent to. Which it then was.

And the BBC had its story: “Vape Giant Crystal Bar in a giveaway with no age verification.”

The ramifications for the company were enormous. It soon closed its social media accounts – on YouTube and TikTok, where it had also been very active, as well as Discord and Instagram.

The government’s health committee reacted strongly, its chair saying: “It is extremely concerning to hear that vapes could easily fall into the hands of children because proper checks are not being made.

But the consequences didn’t stop there. The media scrutiny Crystal was suddenly attracting soon found other issues. They apparently hadn’t complied with mandatory recycling measures and had to apologize for this too – and cough up £100,000 in unpaid related fees.

The promo had caused them a world of pain.

And here’s the thing: this world of pain was completely avoidable.

They may have been careless in allowing their marketing material to reach children, but they would have got away with it. Until that is, the moment they started actually issuing those samples without checking who they were sending them to – then they were bang to rights.

Which is why it’s so mystifying that they didn’t have an age verification measure built in.

Currently, age verification is a booming field across the world. A report just this week* projected it to continue to grow exponentially into the 2030s and beyond.

As more and more commerce pivots to online then there’s more and more onus for platforms to be able to differentiate children from adults in all manner of fields. The biggest two are probably gambling and porn but there are numerous others including – as this case showed – vaping.

There’s currently in essence a spectrum of approaches to online age checks.

At the softest end, it involves merely self-certifying as over 18, as Crystal’s doomed promotion allowed. At the toughest end, there’s a requirement to submit supporting documents like screenshots of passports. But as well as being cumbersome and off-putting this approach is also not immune to abuse from fakers – as anyone familiar with the fake IDs teens widely use to flash to get served alcohol can attest.

In between the too lax/too stringent positions is the one that actually works and isn’t time-consuming: and that is using mobile phone data to verify age.

By asking for a mobile number at the point of onboarding – or on applying to get your hands on the free vape you’ve just won – the platform can go to a specialist like TMT Analysis to make these checks.

This is possible because so much data – both live and historic – is routed through these numbers. So, we can tell immediately if the user is the age they purport to be or not. It’s as reliable if not more so than a passport or driving license screenshot but can be run in a fraction of the time.

It’s extraordinary that there remain companies operating in fields with sensitivities around age – like Crystal Bar – who are continuing to operate without these capabilities.