Buying electronic cigarettes online is exceedingly easy for teenagers, according to a study conducted in North Carolina. Despite the state's e-cigarette age-verification law, more than 90 percent of vendors failed to verify the ages of teenagers who bought e-cigarettes online. This is the first study to look into US minors' ability to buy e-cigs online, the researchers note — and it's not looking good.

E-cigarettes are battery-powered devices that vaporize liquid nicotine, and they're becoming increasingly popular with youths. Between 2011 and 2012, the percentage of high school students who had ever used e-cigarettes rose to 10 percent, from 4.7 percent (in contrast, 46 percent of high school students have tried tobacco products in general). And the total number of middle school and high school students who tried e-cigarettes in 2012 topped 1.78 million, according to the CDC, despite the fact that 41 US states have laws that prevent minors from purchasing e-cigarettes. Moreover, kids who use e-cigs are twice as likely to state that they intend to smoke regular cigarettes, compared with kids who have never touched an e-cig. This is a problem given the risk for nicotine addition, and the potential negative health affects of nicotine on teenage brain development. For this reason, researchers at the University of North Carolina-Chapel Hill, decided to look into how well online vendors were — or in this case weren't — complying with North Carolina laws.

In the study, published today in JAMA pediatrics, researchers asked 11 nonsmoking teenagers between the ages 14 to 17 to make supervised purchases from 98 popular internet e-cigarette vendors. "Buyers visited the study websites and attempted to purchase the cheapest available disposable nicotine e-cigarette or, if unavailable, the cheapest nicotine e-cigarette starter kit," the researchers write. The teens were also asked to answer the door for deliveries when they were home.

The minors were able to place and receive 75 out of the 98 orders. Moreover, of the 23 orders that failed, only five had to do with age verification issues; the others were unsuccessful because "the website had problems processing payments" or "because of poorly designed functionality," the study authors write. Orders that went through vendors that claimed to use online age-verification services were successful in 83 percent of cases, and "none of the vendors complied with North Carolina’s e-cigarette age-verification law," the researchers write.

Deliveries were also an issue. About 95 percent of e-cig products were left on the purchasers' doorsteps. And when the teenagers answered the door to accept packages, none of the shipping companies tried to verify their ages. Finally, all three shipping companies involved in the study — USPS, UPS, and FedEx — say they never ship cigarettes to consumers, either because of a company policy or federal regulations.

It’s important to note that the teenagers involved in the study were allowed to misrepresent their age and identities by checking a box or typing a false birth date. And because they had easy access to their parents' driver’s licenses and said they had no problem using them, the teenagers were allowed to pose as their parents if their own identities failed. This might seem like a stretch, but vendors can prevent buyers from using someone else’s license through "challenge questions" based off public records. For example, the researchers suggest that a vendor could ask about the type of car an adult owned in 1993 — something a 17-year-old born in ’98 might not know about.

The only age-verification systems that worked consistently were ones that asked for a social security number, in addition to a date of birth. Unfortunately, the researchers say that they can’t recommend this strategy because "it presents substantial risk of identity theft, especially on poorly designed websites with inaccurate payment processing methods."

Amusingly, the only real roadblock encountered by the teens were computer parental controls. The default controls on one teen's computer blocked the teenager from accessing five vendor websites, the researchers report. As a result, those websites were excluded from the final sample of vendors.