Under a 1998 legal settlement tobacco companies reached with the U.S. government, cigarette websites are supposed to include what’s known as age-verification gates. These gates require users to verify they are 21 years old by supplying their name, address, birth date, driver license number and the last four digits of their social security number.

But when researchers reviewed websites for the 19 brands sold by the 12 leading e-cigarette companies by market share, they found just one required detailed registration, according the report today in JAMA Pediatrics.

“Strong age-verification gates on e-cigarette websites would make it harder for the young teenager who has yet to vape to impulsively view e-cigarette websites,” said lead study author Samir Soneji of the Dartmouth Institute for Health Policy and Clinical Evaluation and Geisel School of Medicine.

Besides limiting exposure to e-cigarettes among curious teens who haven’t yet “vaped,” or smoked using the devices, strong gates may also limit teens’ ability to see the thousands of flavors designed to entice users to sample a wide variety of e-cigarettes, Soneji added by email.

Big tobacco companies, including Altria Group (MO), Lorillard Tobacco (LO) and Reynolds American (RAI), are all developing e-cigarettes. The battery-powered devices feature a glowing tip and a heating element that turns liquid nicotine and other flavorings into a cloud of vapor that users inhale.

About 2 million middle and high-school students tried e-cigarettes in 2014, triple the number of teen users in 2013, the U.S. Centers for Disease Control and Prevention reported last April.

Previous research has also found that teens who try electronic cigarettes may be more than twice as likely to progress to traditional cigarettes as their peers who haven’t used the devices.

For the current study, researchers found the stringency of age-verification gates varied across brands: two had no gate, five stated warnings, 10 required clicks/checks for users to indicate they were old enough to use the site, one required birth date entry, and one required a detailed registration.

Sometimes gates varied across brands.

For example, Electronic Cigarettes International Group (ECIG) had no gate on the website for its El Rey brand, but required clicks or checks for entry to websites for its Vapestick, Fin and VIP brands, the study found.

Three of four tobacco companies that sell both traditional cigarettes and e-cigarettes had less stringent gates on websites for the devices than they did for other products, even though they also had corporate responsibility policies against marketing to minors.

Altria, Imperial Tobacco and Japan Tobacco required registration and proof users were at least 21 years old for access to cigarette websites, but not e-cigarette sites.

Reynolds, however, consistently applied age-verification gates on all its cigarette and e-cigarette websites.

The study doesn’t prove viewing websites causes teens to vape or examine how adolescents may respond to different types of tobacco marketing.

As a prevention strategy, it’s also possible that it would be more effective to concentrate on blocking teen purchases than on limiting what they view online, noted Dr. Riccardo Polosa, a tobacco researcher at the University of Catania, Italy who wasn’t involved in the study.

Requiring payment with a credit card, for example, might stop young people from buying e-cigarettes because they aren’t yet old enough to quality for credit, Polosa said by email.

“There is a danger of trying too hard to hide adult society from adolescents – they may be attracted by ‘forbidden fruit,'” Polosa added. “Telling a teenager they are too young to have something may simply increase its appeal or make it look more cool.”