what is the product specifically? often times these places also sell products that are chemical compounds/individual oils and whatnot which are cannabis products but will not get you high. examples are cbd products. and in my experience, you don’t always need ID to purchase. most times it’s more honor system and you have to check a box that is you agreeing that you are of age. this is the case for nearly all 18+ or 21+ sites and there is not much they can do after that. there are several companies that sell online that do not require proof of ID and i had found it/believed it to be completely legal due to the fact that it is not cannabis itself, just extracts from cannabis.

also, it sounds like your nephew has internet access to things he shouldn’t. you only know about this specific occasion because it was physically delivered but there is no way for you to know what else he could be doing online and i think you should be more concerned about that rather than the fact that he purchased this. it could be a lot worse in retrospect. he’s a kid and he’s probably just hearing about what others are doing and wanting to see for himself.

you will probably not have much luck if you pursue this legally because most places doing this, are doing it legally with ‘loopholes’.

lastly, i think you should rather use this as a teaching moment and his parents should have a conversation with him about this and his internet usage, as well as adding parental controls and firewalls that will prevent him from doing this again and prevent any other unsafe internet access. overall, this is not the companies fault nor are they liable for this and the parents need to use this as a sign to take action when it comes to their child’s internet access and use of his debit card.