I'm not sure if it is actually a law but I just flipped over to a website and went through the checkout process - in the screen before the one that you enter your credit card info (would have to be 18 for that) into you have to check a box certifying that you are 18. This is the little "help" info:

As the leader in the adult products industry, Adam & Eve strives to maintain the highest standards of corporate responsibility. We are a corporate sponsor of the Association of Sites Advocating Child Protection (ASACP), a non-profit organization dedicated to eliminating child pornography from the Internet.

So a kid would have to at least lie about it. I seriously doubt anybody is checking though. Most porn sites use a credit card number as a way to verify age (among other things) so it seems like it would work for an online retailer as well.