Canada’s national Health Department sent a letter to all licensed cannabis producers in the country that normal age gates — where a visitor enters their birthday in order to view restricted content — aren’t sufficient to meet requirements, The Vancouver Courier reports.

Health Canada told producers and cultivators in the letter on March 8 that those age gates “may be easily circumvented by youth.” The standard enter-your-birthdate age gates are nearly ubiquitous on the modern internet and are considered sufficient for most industries.

Cannabis lawyer Harrison Jordan told the Vancouver Courier, however, that he spoke to an Alberta Gaming Liquor and Cannabis Board representative several months ago who indicated that the standard age gate wasn’t good enough. There has nevertheless been little change with regards to cannabis websites.

According to Jordan, the only verification services that might satisfy Health Canada’s requirements are third-party know-your-client software from companies like SecureFact, Trulio, or Jumio. Those services use things like mobile phone records or utility data to verify identity. Other services like Inverite can scan the barcode on the back of a government-issued ID to provide verification — some, however, believe these services are too intrusive as an age gate for someone who perhaps only wants to check which strains are available from a particular producer.

Canada‘s cannabis industry will need to solve this problem somehow. The maximum penalty under Canada’s cannabis laws for noncompliance is $5 million in fines and up to three years in jail. While an unlikely punishment for anyone in the near term, it’s a significant new problem facing Canada’s nascent industry.

Get daily news insights in your inbox. Subscribe