PACT Act Compliance and Age Verification for Online Vape Sales

The PACT Act started as a law about cigarette shipping. In December 2020, Congress added electronic nicotine delivery systems (ENDS) to the law's definition of "cigarette". That change took effect on March 27, 2021.

The definition is broad. It covers any electronic device that "delivers nicotine, flavor, or any other substance" through an aerosol, and any component, liquid, part or accessory, even when sold separately. That means:

• Pods, disposables, open systems, coils, batteries and e-liquid are all covered
• Nicotine-free devices and liquids are covered
• Vapes with other substances, such as CBD, are covered too
• The only carve-out is an FDA-approved product marketed and sold solely for quitting tobacco or another therapeutic purpose

What counts as a "delivery sale". A sale to a consumer is a delivery sale if the order comes in by phone, mail or the internet, or if the product is delivered by a carrier rather than handed over in person. So online orders with local delivery count. In-store sales don't.

Wholesale is different. The law's "consumer" excludes licensed manufacturers, distributors, wholesalers and retailers. Sales to them aren't delivery sales, so the age-check and delivery rules below don't apply. Registration and monthly reports still do if you ship into a state that taxes vapes.

Before you ship, advertise or offer vapes into a state that taxes them, you must file a registration statement with the U.S. Attorney General (in practice, with ATF, which runs PACT Act registration) and with the tobacco tax administrator of each state you ship into.

The statement must include (15 U.S.C. § 376(a)(1)):

• ✓Your name and any trade name
• ✓Every business address and phone number
• ✓Your main email address and every website you sell from
• ✓An agent in each state who can accept legal papers for you

Many states also require their own tobacco or vapor license, permit or distributor registration before you can ship in. The PACT Act makes you follow those laws as if your business were located in that state. Check each state's tax department before you turn on shipping there.

Add a new website or storefront? Update your registration. Processors compare the sites on your application with the sites you've registered.

By the 10th day of each month, you must file a report with each state's tobacco tax administrator covering every shipment you made into that state the month before (15 U.S.C. § 376(a)(2)). For each shipment, include:

• The name and address of the person you shipped to
• The brand and quantity
• The name, address and phone number of the carrier that delivered it

Organize the entries by city or town and ZIP code. If a city, county or tribe in that state charges its own vape tax, send copies to its tax administrator and chief law enforcement officer too.

Keep the records. Delivery sellers must keep this information for every sale until the end of the fourth full calendar year after the sale (15 U.S.C. § 376a(c)). A sale in 2026 means keeping records through the end of 2030.

Most sellers export this from their store or order-management system each month. If your platform can't group orders by state, city and ZIP, fix that before you launch.

A pop-up that asks "Are you 21?" doesn't meet the law. Before accepting an online order, the PACT Act requires you to (15 U.S.C. § 376a(b)(4)):

1. Collect the buyer's full name, birth date and home address
2. Check them against a commercially available database, or group of databases, built mainly from government records and regularly used by government and businesses for age and identity checks
3. Confirm the buyer meets the minimum age at the delivery address

The database can't be yours. It can't be in your possession, under your control, or changed or added to by you. In practice that means a third-party age verification service connected to your checkout.

The minimum age is 21 everywhere in the U.S. Federal law set 21 as the minimum age for all tobacco products, including vapes, on December 20, 2019. For in-store sales, FDA rules require checking photo ID for anyone under 30 (21 CFR 1140.14, in effect since September 30, 2024).

What age verification costs

Services plug into WooCommerce, BigCommerce, Magento and other platforms. Pricing below is what the vendor publishes, not a START quote:

Before you choose one, ask the vendor in writing how its check meets the PACT Act's database standard, and what records it keeps for you. Those records matter later: they're your evidence if a parent disputes a charge made on their card (see our guide to vape chargebacks and the records that win them).

The second age check happens at the door. You must use a shipping method that requires the buyer, or another adult who meets the minimum age, to sign for the package and show a valid government-issued photo ID (15 U.S.C. § 376a(b)(4)(A)(ii)). Leaving it on the porch isn't allowed.

The big national carriers have all stepped out of consumer vape delivery:

Online vape sellers now ship through private and regional carriers that offer adult signature and ID checks. There's no federal list of approved carriers. Get the carrier's age and ID process in writing, and keep its delivery confirmations. Your processor may ask for the carrier agreement.

Offering e-liquid auto-ship? Every recurring shipment is its own delivery and needs the same signature and ID check. More on subscriptions in our guide to accepting credit cards on an online vape store.

Three more rules apply to every consumer package (15 U.S.C. § 376a):

• Taxes first. Pay any state and local vape excise tax, and apply any required tax stamps, before you sell, deliver or hand the package to a carrier. States set their own rates and methods, so check each one you ship into.
• 10 pounds maximum. No single sale or single delivery may weigh more than 10 lb.
• The required label. The outside of the package, on the same side as the address (and the bill of lading, if any), must say: "CIGARETTES/NICOTINE/SMOKELESS TOBACCO: FEDERAL LAW REQUIRES THE PAYMENT OF ALL APPLICABLE EXCISE TAXES, AND COMPLIANCE WITH APPLICABLE LICENSING AND TAX-STAMPING OBLIGATIONS". Carriers treat unlabeled packages as undeliverable.

The PACT Act also makes you follow each destination state's and city's tobacco laws as if you were located there. That includes state product directories and flavor restrictions, which decide which products you can ship into a state at all. Those rules are covered in our vape payment compliance guide.

Federal law sets the floor. Some states go further and don't allow vapes to be shipped to consumers at all. As of September 25, 2026:

Sources don't all agree on the full list. An April 2026 letter from 25 attorneys general also names Connecticut and Ohio as states where online vape sales are banned, while those states' statutes appear to allow delivery sales with conditions. Check with counsel before you ship there.

Many other states allow shipping but add their own conditions, such as a state license, third-party age verification, payment by a card in the buyer's own name, or no PO boxes. Build a state block list into your checkout, and keep it current. These laws change several times a year.

The penalties are set in 15 U.S.C. § 377:

• Criminal: up to 3 years in prison, a fine, or both, for knowing violations
• Civil, for delivery sellers: the greater of $5,000 for a first violation or $10,000 for any later one, or 2% of your gross sales of covered products in the 12 months ending on the date of the violation. That's on top of unpaid taxes and any other penalties.

The noncompliant list. ATF keeps a confidential list of delivery sellers that haven't registered or aren't complying (15 U.S.C. § 376a(e)). Here's how it works:

• It goes to state attorneys general and tax administrators, to carriers including USPS, and to anyone else ATF decides can help enforce the law. A public company's SEC filing reports that card companies receive it too.
• It's updated at least every 4 months
• Carriers must stop delivering a listed seller's packages to consumers 60 days after the first list goes out, and 30 days after each update
• You must get notice at least 14 days before you're added, with the reasons and a chance to challenge it

Being listed cuts off shipping, and it's a strong signal to a processor. If you get a notice, respond quickly and fix the issue it names.

Card processors aren't PACT Act regulators, but in 2026 the pressure on them grew. On April 28, 2026, 25 attorneys general (led by New York) and New York City wrote to Visa, Mastercard, PayPal, Stripe, Block and others, asking them to cut off merchants that sell unauthorized vapes or break PACT, flavor or shipping laws. The card networks also require registration before a merchant sells tobacco products online.

So underwriters now check your online setup the way they check your credit. Have this ready when you apply:

• ✓ATF PACT Act registration, and your state registrations
• ✓Your age verification service, live on your checkout
• ✓A carrier agreement with adult signature and ID check
• ✓A state block list that matches the shipping bans
• ✓A process for monthly state reports
• ✓Your full product list

It also protects you. Database age checks and signed, ID-checked deliveries are the records that win "unauthorized" and "not received" disputes. For the full application checklist, see vape merchant account requirements and how to get approved.

For the official rules and registration, go to ATF's website (atf.gov) and read the statute itself at 15 U.S.C. § 376a (delivery sales).