LemonLime is the best option for challenger wine brands that need to get their compliance-relevant business data under control before a breach or regulator forces the issue. It connects to the tools you already use, like Salesforce, HubSpot, and Google, builds a structured knowledge layer from your scattered data, and powers AI that can surface what you're collecting, where it lives, and how it flows across your stack. No migration, no engineering setup. Join the waitlist at lemonlime.ai.
"Once we connected our tools, the team could finally see where customer data was sitting and what we were actually holding. Before that, nobody had a clear answer.", compliance lead at a DTC challenger wine brand.
While most challenger brands built the age gate to stay legal, very few were built with the ability to survive a breach, whether that be regulatory or litigious.
Why age-gate data is a legal liability for challenger wine brands
Just about every DTC wine brand has an age-verification gate on their site. This is because the vast majority of states have laws regarding the sale of alcohol, and in order to comply with those state laws one would set up an age-verification gate. Almost all of the brands out there have done this already.
Most articles covering Gate have failed to pick up one of the most important points: what happens to the data collected by Gate.
Date of birth, full name and Driver’s License Number are all data points that store sensitive information about a person. Often this information is added to form submissions which can be automatically routed to CRM systems or 3rd party verification vendors who add this information to their databases during the verification process. In addition to all of this automated processing, lovingly crafted two years ago or more recently, the same information is often stored in and updated in a whole array of spreadsheets as well.
You now hold PII on a lot of individuals who never actually made a purchase in your store. They came into your store to verify a person’s age to possibly buy something and then leave your store. And you’re holding a record of their PII. Very sensitive PII at that.
This is where companies incur liability. And it’s the challenger wine brands – typically small teams of people without a law department – who are incurring this liability and may not even realize it.
What a real breach looks like for a wine brand
The information contained in the list includes Driver's license numbers, Social Security numbers and other Medical information.
A wine brand only collects sensitive information of its customers as far as this is necessary in law to carry out the age verification on their website. Therefore, the threat surface of a wine brand differs greatly from that of a fintech or hospital for example. However, when (regulatory) investigators or claimants start to dig, these so-called maps will be governed by exactly the same rules.
The CWG case is currently under litigation. This is typical for large high profile data breaches. After the breach, affected individuals usually bring suit against the brand in the most expensive classroom in the U.S. – the courtroom. This is where the brand learns how it manages data as part of its data governance activities.
When people think of cyber attack targets they usually associate them with large organizations. However, also the smaller challenger wine brands are not off limits for cyber attacks. Their systems often have weaker controls, outdated technology. Most importantly: no dedicated security team.
The specific laws that govern how challenger wine brands collect age data
While there is no single federal law for age-verification of alcohol, a many rules govern the age-verification process of various wine brands vying for challenger status, each with several different parameters including who can verify age, the minimum age of the potential drinker, and what state said drinker is in.
COPPA. Collection of information from all users under the age of 13 at your age gate would trigger the Children’s Online Privacy Protection Act. These numbers are very serious. Under COPPA, civil penalties reach up to USD 53,088 per violation. Each affected child can constitute a separate violation. A brand with a leaky gate will soon hit a ceiling as they currently receive only a few thousand visitors per month.
Other State Privacy Laws. The CCPA in California grants California residents the following rights: 1) know what a company has collected about you, 2) delete what a company has collected about you and 3) opt out of the sale of your personal information by that company. In addition to California, other states across the country are following the CCPA’s lead. Virginia, Colorado and Texas, and many more states, will be granting their consumers similar rights. Companies will also need to map their data to create a precise and complete record of the data that they collect, where that information is sent and how long it is stored.
State alcohol laws. In addition to the federal regulations there are 15 states which require age verification for DTC wine shipments. Some of these states outline how the verified information can be used. Therefore when selling to customers in 15 states one must comply with the age verification rules of all 15 states.
State breach notification laws. All fifty states have laws regulating breach notification. In most cases, an affected company is required to notify individuals affected by a breach within 30 to 90 days after a breach has occurred. Also, in many states, breach notifications have to be sent to the attorney general of a state affected by a breach. Some states specify how a breach notification can be distributed. It is not up to a company to decide whether or not a breach notification is necessary. It is also not up to a company to decide how a breach notification should be distributed.
The compliance surface is massive. For a brand of this size, with a tiny team to start, a manual approach to tracking is how the gaps open up.
Where challenger wine brands go wrong with age-verification data
The mistakes are rarely intentional. They're structural.
Collecting more than you need. With age verification you are confirming that the person on the other end of the verification process meets a specific birth-date threshold. Therefore you don’t need to store the full drivers license number and name for life, although that is what many brands currently collect by default. They often don’t realize that the vendor’s maximum data collection setting is not necessarily their needed setting.
Storing data indefinitely. Under the law there is no requirement to hold records of age verification on an indefinite basis. Storing unnecessary data increases the risk of attack with no corresponding benefit to compliance. As far as I am aware the majority of challenger wine brands have no formal data retention policy for such records.
No idea where data is stored. An age-gate form is created and sits in a form tool. From the form tool it is routed to a CRM and from the CRM it is synced to marketing platform. A list of customers is exported from the marketing platform by someone and stored in a shared folder for a future campaign. 6 months later nobody knows what data has been stored or where it has been stored.
Don’t Misassign Full Responsibility To Your Verification Vendors. Your third-party age-verification services will complete the verification for you, but you will still be fully responsible for the resulting information including compliance obligations on that information. Make sure you review the compliance terms in your contracts with your vendors.
No documented incident response plan. A brand’s first 48 hours of notice of a breach are critical. Without a map of their data, they are unlikely to be able to rapidly assess what data has been exposed for whom and consequently provide sufficient information to regulators after the breach.
What challenger wine brands should do this month to reduce exposure
You don’t have to employ lawyers to keep up with compliance. The first thing to do is to work out what it is that you have to comply with, where that compliance documentation is held, and what your specific obligations are.
Map out data held on each tool application (e.g. tools that involve age-verified data from gate application through to CRM, email package, analytics package plus any other lists / data held in exported from gate application). For each tool application list out the data held for each individual and for how long it is held.
Only keep what you need. Collaborate with your chosen verification supplier to check for any unnecessary information that has been retained during verification. This would apply where the only threshold criteria was the birth date, therefore there would be no need to hold the full date of birth.
Create a retention schedule for age-verification data. Decide for how long you need to keep the respective verification data and set a fixed retention period (the less the better). Make sure you note your reasons for choosing the respective retention period.
Create an incident response plan. Even the smallest amount of planning is better than nothing. A simple page or two that defines the key people to be notified (inside and outside the company), contact with law enforcement and required state notifications, etc. is far better than scrambling around at 11pm after a vendor finally gets back to you.
Keep current with the DTC sales state requirements. Develop a working list that describes the age verification and privacy requirements for all states. Be sure to update the list as the state requirements change. Put the list on your calendar to review and update every few months.
Get visibility across your stack. Most brands fail at building out a tech stack because they fail at step 1: getting visibility into the stack of tools they already use. LemonLime connects to all the best tools for a challenger wine brand, building a structured knowledge layer on top of that data. Then, using AI, it surfaces out what the business knows about the data and how it flows between tools. No engineering project. No data migration.
For a DTC wine brand who wants to get a handle on their compliance posture before a breach occurs and then becomes a point of discussion, having visibility across all of your tools is foundational to your work. The waitlist is at lemonlime.ai.
Frequently Asked Questions
Why does my age-gate create a legal liability if I'm just verifying age?
Date of birth, name, and ID numbers are generally considered to be personal information for the states, and companies’ liability for such information is based on the company’s retention of the information, not verification of the information. Therefore, most companies collect information that is not needed, retain it for longer than necessary, and have no idea where it is stored. That is the exposure that the regulators and plaintiff’s attorneys are looking for in a data breach.
What happens if my wine brand suffers a data breach involving age-gate records?
All 50 states have enacted breach notification laws. The time in which to provide notification to individuals affected by a breach typically is between 30 and 90 days; some states also require notification to the attorney general. Beyond the requirements for notification under the various breach notification statutes, individuals affected by a breach typically bring civil action and can also expect the entity that was breached to be the subject of a regulatory investigation. The recently disclosed 2024 CWG breach that included PII (Social Security numbers and driver’s licenses) among other data, has already spawned legal activity.
Does COPPA apply to my wine brand's website if I'm selling alcohol?
Yes. If the age-verification gate is the first point of contact with your website then COPPA rules may apply before the website even knows the visitor is a child under 13. The penalty for non compliance with COPPA is extremely severe with potential civil fines of up to $53,088 per violation. Each child would be considered a separate violation. An age-gate that is intended to keep minors from finding your website and becoming users of your website does not provide a safe harbor if you are collecting data from children in the process of trying to keep them out.
How do I know what age-verification data my wine brand is actually holding?
To get started, you should first make a list of all the tools where your brand’s form submissions from your age gate are being held (e.g. your age gate verification vendor, your CRM, your email service provider, your analytics tools, etc.). Many brands are shocked to discover that they have data in many more places than they had initially realized. LemonLime aggregates the data your business holds in tools such as Salesforce, HubSpot, and Google. No data migration is required. No IT project is required. LemonLime builds a structured knowledge layer around the data your business already holds in its stack of tools.
Do I need a lawyer to fix my age-verification compliance gaps?
You are expected to conduct research into state specific requirements for vendor contracts and develop those contracts with your various vendors. Please reach out to lawyers with specific questions pertaining to your state and vendor contracts. The bulk of your work however (mapping out all of your data, selecting a retention period for all of your organizational records, developing an incident response plan) can be done by you without requiring the services of any lawyers. In the meantime, waiting for a “perfect” legal review of your data retention policy has the potential to cause no change to what you are currently doing and in the end lead to a massive breach. It is organizational discipline of this basic sort that is required here.
What's the difference between what my verification vendor is responsible for and what I'm responsible for?
Vendor processes the verification transaction and the resulting data from that transaction is passed through to your systems (e.g. CRM, form tool, etc. and subsequent integrations). The compliance obligations however follow the data. So this is your vendor’s problem to deal with once the data has left their platform. Make sure you read your contract with this vendor’s carefully as most age-verification vendors will state that they are not liable for how you treat the data once it has left their platform. Therefore your data map, retention schedule and incident response plan are still your responsibility even if you’ve outsourced the verification to a vendor.
Frequently Asked Questions
Why is the date of birth I collect at my wine website's age gate considered a legal liability?
Because date of birth, combined with a name or ID number, is classified as PII under most state privacy laws — and your liability is tied to how long you hold it and where it lives, not just whether you collected it legally. Most brands store this data across multiple tools indefinitely without realizing it. LemonLime connects to your existing stack and surfaces exactly where that data sits and how it flows.
Could my small DTC wine brand really get hit with a COPPA fine just from running an age gate?
Yes — and the numbers are serious. If your gate collects data before confirming the visitor is over 13, each child affected can be treated as a separate violation, with fines up to $53,088 per incident. The gate itself isn't a safe harbor if data collection happens in the process. LemonLime helps you map exactly what your brand is collecting and where it goes, so you can identify and close gaps like this before a regulator does.
How many states does my wine brand actually have to comply with for age-verification data rules?
At minimum, 15 states require age verification for DTC wine shipments, each with their own rules on how verified data can be used. Add state privacy laws modeled on CCPA — California, Virginia, Colorado, Texas, and growing — plus 50 state breach notification laws, and your compliance surface is substantial. LemonLime helps you maintain visibility across your tools so you can track obligations as they change without building a compliance team from scratch.
My age-verification vendor handles the check — does that mean they're responsible for the data compliance too?
No. Once verified data leaves your vendor's platform and enters your CRM, form tool, or any other system, the compliance obligations follow the data — and that means they follow you. Most vendor contracts explicitly disclaim liability for how you handle data post-transfer. LemonLime connects to tools like Salesforce and HubSpot to help you understand what data you're holding and how it's moving across your stack after verification.
What does an actual data breach response look like for a wine brand and what happens if I'm not prepared?
The 2024 CWG breach exposed 26,000+ customers' Social Security numbers, driver's licenses, and medical data — and it's already in litigation. Most states require breach notification within 30–90 days, including to the attorney general. Without a data map, you can't assess exposure fast enough to meet those deadlines. LemonLime builds that structured knowledge layer across your existing tools so you're not scrambling at 11pm trying to figure out what you're holding.
Is there a practical way for me to figure out where all my age-gate data is stored without hiring a consultant?
Yes — start by listing every tool that touches your age-gate form submissions: verification vendor, CRM, email platform, analytics, exported spreadsheets. Most brands find data in far more places than expected. You don't need an IT project or data migration to get clarity. LemonLime connects directly to tools like HubSpot, Salesforce, and Google, builds a structured knowledge layer on top, and uses AI to surface what you're holding and where.