Running an online tobacco or vape business today means dealing with considerably more than inventory and shipping.
Regulations around age-restricted products have tightened, especially online. Age verification, tax reporting, registration, shipping restrictions, recordkeeping – what used to be a relatively simple e-commerce operation now comes with a long list of obligations to manage every day.
For US-based sellers, the Prevent All Cigarette Trafficking (PACT) Act sits at the center of most of it. It’s been around for a while, but the scope has grown, and enforcement has gotten stricter.
Compliance gets a bad reputation that it doesn’t always deserve. The rules are detailed, and the penalties are real, but most businesses find that once they actually sit down with the requirements, it’s more manageable than it looked. Know what’s required, understand where things typically go wrong, and build processes that work – for the regulator and for your customers.
Who this is for – and what it’s not. For founders and operations leads at online tobacco and vape businesses – specifically those selling age-restricted products across state lines and trying to figure out what PACT Act compliance actually requires day to day.
Not a legal breakdown of the PACT Act’s statutory text or a state-by-state tax guide. For the age verification piece specifically, see Age Verification; this article is the operational overview – what to build, what trips people up, and why.
What is the PACT Act?
The PACT Act, or Prevent All Cigarette Trafficking Act, is a US federal law that regulates the sale and shipment of tobacco products, including certain online and remote sales. It requires sellers to follow transparent registration, reporting, tax, and shipping requirements. Additionally, sellers and e-commerce sites offering vape or tobacco products are expected to follow age verification practices, restricting mailing tobacco products to minors.
Automate your KYC process
iDenfy verifies customers from 200+ countries in seconds. AI-powered, compliant, and trusted by 1,000+ companies.
Explore KYC SolutionWhy Does the PACT Act Matter?
The PACT Act was originally introduced to crack down on illegal cigarette trafficking and make sure tobacco taxes were actually being collected. Over time, the scope expanded. Most significantly, amendments brought Electronic Nicotine Delivery Systems (ENDS) under its requirements. That change impacted online vape sellers.
Products that once operated under a relatively different regulatory environment suddenly became subject to many of the same requirements as traditional tobacco products.
The result was a major shift for e-commerce businesses selling:
- E-cigarettes
- Vape devices
- E-liquids
- Nicotine cartridges
- Disposable vapes
- Certain related components and accessories
Today, online sellers must think beyond sales and marketing, as regulatory compliance has become a core business function that you can’t avoid. This includes PACT Act registration and tobacco reporting, age verification or tax requirements, and restrictions on shipping tobacco products.
Understanding the Main PACT Act Requirements
The PACT Act feels complicated partly because it doesn’t focus on one thing – it bundles several obligations together and expects you to manage all of them. Businesses generally need to address multiple areas simultaneously.
These include:
- Registration with federal authorities
- Registration with state tax administrators where required
- Collection and payment of applicable taxes
- Age verification procedures
- Delivery restrictions
- Report obligations
- Record retention requirements
Missing one piece can create compliance problems even if everything else is running fine. That’s why most sellers who get this right treat PACT Act compliance as an ongoing operational process rather than something you set up once and forget about.
PACT Act Vape Rules
Vape businesses that had been running as ordinary e-commerce operations inherited the full tobacco compliance stack, with mandatory measures like:
- Federal registration, plus registration in every state they ship into
- Monthly shipment reports to state tobacco tax administrators
- Age verification against a commercial database, not a checkbox
- Adult signature at delivery
- State and local excise tax collection and remittance
- Four years of transaction records
- A near-total loss of access to mainstream shipping
ATF works with USPS and the FDA’s Tobacco 21 enforcement teams to prevent sales and shipments of vapes and e-cigarettes to minors, so a vape seller’s compliance record is visible to more than one agency at a time.
What Counts as Tobacco Under the PACT Act
The PACT Act applies to:
- Cigarettes
- Roll-your-own tobacco
- Smokeless tobacco products (snuff and chewing tobacco)
- Electronic nicotine delivery systems
Cigars sit outside the original scope.
So a store selling zero-nicotine e-liquid, replacement coils, or hemp-derived vape hardware is a PACT Act tobacco seller in the eyes of the law, whether or not the word “tobacco” appears anywhere on the website.
Common Compliance Mistakes Online Sellers Make
Most compliance problems aren’t the result of deliberate misconduct. They happen because businesses underestimate how complex their obligations actually are.
Some common mistakes include:
- Treating age gates as sufficient verification
- Failing to update compliance procedures as regulations evolve
- Assuming shipping carriers handle all compliance responsibilities
- Neglecting state-specific requirements
- Maintaining incomplete records
- Waiting until after growth occurs to address compliance infrastructure
Most of these problems are preventable. The businesses that avoid them tend to treat compliance as something to get ahead of rather than react to.
How to Register With the ATF
Before selling cigarettes, smokeless tobacco products, or covered ENDS products across state lines, businesses subject to the PACT Act must register with the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). This requirement applies to many online sellers and is one of the first compliance steps businesses must take before accepting orders.
ATF defines an ENDS product as any electronic device that delivers nicotine, flavor, or any other substance to the user through an aerosolized solution. That covers e-cigarettes, vape pens, e-hookahs, refillable personal vaporizers, electronic pipes, and any component, liquid, part or accessory of such a device, regardless of whether it is sold separately from the device itself. All of these sellers need to ensure compliance.
Registration is not simply a formality. It provides federal authorities with information about the business and helps support enforcement of tobacco tax and reporting requirements. Depending on where products are sold, businesses may also need to register with state tobacco tax administrators and comply with additional state-level obligations.
One mistake some sellers make is focusing heavily on age verification and shipping procedures while overlooking registration requirements. However, compliance starts long before the first package is shipped. Ensuring registrations are completed properly can help avoid regulatory issues and create a stronger foundation for the rest of a company’s compliance program.
Steps to Complete the PACT Act Registration
This is a common workflow for registration:
- Register federally. File ATF Form 5070.1 with the ATF.
- Register by state. That means register with the tobacco tax authority in every state where you sell or advertise covered products.
- Submit monthly reports. Report shipments to each relevant state by the 10th of every month.
- Keep sales data. Maintain customer details, product quantities, delivery information, and invoices needed for reporting.
- Repeat while selling. Registration and monthly reporting continue for as long as your business remains subject to the PACT Act.
Physical vs Online Age Verification for PACT Act Compliance
Physical retail has one advantage online businesses don’t: staff can check ID in person. Remote age verification is harder, and regulators know it, but that doesn’t lower the bar.
A checkbox asking customers to confirm they’re over 21 won’t cut it. Regulators expect real steps to verify age before a sale goes through. The exact method can vary, but the standard is clear: you need to be able to show that you’re actively preventing underage purchases, not just asking people to self-certify.
This is where technology has become increasingly important. Many online sellers now rely on an ID verification service that combines document validation, database checks, and identity verification to help confirm customer age before transactions are approved.
The goal is not only compliance. It is also reducing the risk of accidental sales to minors, which can lead to serious legal and reputational consequences.
How to Ship Items and Still Comply With the PACT Act
Selling age-restricted products online does not end when the order is placed. Shipping also introduces another layer of obligations. The PACT Act sets specific requirements around delivery, particularly adult signature verification. Depending on the circumstances, packages may only be delivered to a verified adult, creating logistical challenges that most e-commerce businesses never have to consider.
Leaving a package on a doorstep is fine for most consumer goods. For regulated products, it’s not that simple. Businesses need to understand what carriers will and won’t do, which delivery options are available, and how those options line up with their compliance obligations.
Getting delivery verification wrong can undermine an otherwise solid compliance program – even if everything else is in order.
How Tobacco and Vape Sellers Deal With Tax Compliance
This is the process of calculating, collecting, reporting, and paying the required federal, state, and local taxes on tobacco and vape products. In practice, sellers that offer these age-restricted items also need to register with tax authorities and apply the correct tax rates. On top of that, for auditing purposes, transaction records should be logged and kept properly as proof of sale. For that, special vendors, such as iDenfy, can offer both age verification automation and transaction monitoring software.
When sellers first hear about the PACT Act, age verification usually gets the most attention. Different jurisdictions may impose different tax requirements. Reporting obligations can vary. The challenge is not necessarily understanding the rules. The challenge is keeping up with them consistently because tax requirements change. Regulatory guidance evolves, and businesses expand into new markets. That’s why a compliance strategy that worked two years ago may require adjustments today.
Why Recordkeeping is Important
Good compliance is not only about following the rules but also about demonstrating that you followed them. If regulators request information, businesses should be able to show how age verification was performed, how taxes were handled, and how transactions were processed. That means maintaining organized records.
Most businesses don’t think too hard about recordkeeping until they’re facing an audit. Good records make compliance easier to demonstrate and take a lot of the stress out of it when documentation gets requested. Strong recordkeeping also makes internal reviews much easier, particularly as businesses scale.
Reports are due by the 10th day of each calendar month to the tobacco tax administrator of every state you shipped into during the previous month. Each report has to include customer names and addresses, the brand names and quantities of everything sold, the names, addresses and telephone numbers of whoever delivered each shipment, and invoice data organized by customer name, city, town and ZIP code.
How Sellers End Up Non-Compliant With the PACT Act
PACT Act violations mean that, as a seller, you failed to meet federal requirements. This can also automatically result in huge fines and, in some cases, criminal penalties. Most compliance failures come down to missed registrations or monthly reports, making accurate sales and customer records a vital part of your compliance program.
Common issues that lead to non-compliance include scenarios like:
- The seller fails to register federally or in a required state.
- The seller fails to submit required monthly shipment reports.
- A government authority or legal proceeding determines that the seller has violated applicable requirements.
After being fined, the next steps could be that you get banned from shipping and legally carrying your tobacco products because you get on the list of blocked sellers. However, there is no public database or register where you can look up your business name, so this might come as a surprise when a shipping provider suddenly refuses to provide you with their services.
Related: How to Do a Business Registration Lookup [Guide]
How to Smoothly Add the Compliance Element into the Customer Journey
Many sellers worry that tighter compliance will hurt conversion rates. It’s a fair concern – every extra step in the checkout process is another chance for a customer to drop off.
But modern verification tools have improved considerably, and customers have gotten more used to identity checks for regulated products. What makes the difference is whether the process feels clear and legitimate rather than like an obstacle.
Some best practices include:
- Explaining why verification is required
- Keeping instructions simple
- Using mobile-friendly verification workflows
- Minimizing unnecessary manual reviews
- Ensuring verification happens at logical points in the customer journey
Customers are generally more willing to complete verification when they understand the reason behind it. Transparency helps reduce friction.
How to Make Compliance a Competitive Advantage as an Age-Restricted Item Seller
Historically, some businesses viewed compliance primarily as a cost center. That mindset is changing.
Strong compliance programs reduce legal exposure and build credibility. Customers, payment providers, business partners, regulators – all of them place more trust in businesses that can demonstrate they operate responsibly.
In a regulated industry, that trust has real value. Businesses that invest in compliance infrastructure tend to be better positioned for long-term growth – not because they predicted every regulatory change, but because they’re not constantly reacting to them. The systems are already there.
How to Prepare for Future Changes
One thing the tobacco and vape industry has learned, more than once, is that regulations don’t stay still.
Rules evolve. Enforcement priorities shift. New technologies emerge.
Businesses that build flexible compliance programs adapt better than those that patch problems as they arise. Regular procedure reviews, tracking regulatory changes, reassessing risk as the business evolves – none of it is dramatic, but it’s what keeps things from breaking.
Compliance doesn’t have a finish line. It moves with the industry.
“There is a regulation not to be able to sell alcohol and tobacco to underage customers. So if there is a doubt from the retailer that the person who is trying to buy something is [underage], he should be able to spot verify the age by scanning one of the IDs that are presented to the retailer and make sure that it’s a valid ID and indeed that person is of age, of the right age to be able to buy it. And then store the data for any future compliance or regulatory.” – K-Hub (Commerce Hub)
Conclusion
PACT Act compliance feels complicated because it touches several parts of the business at once – age verification, shipping controls, tax obligations, reporting, recordkeeping. Taken together, it’s a lot. Broken down into individual components, it’s much more manageable.
The online tobacco and vape sellers that handle this best aren’t always the ones with the biggest compliance teams. They’re usually the ones that built compliance into how they operate from the start rather than treating it as something to retrofit later.
Good age verification service, solid recordkeeping, a clear understanding of shipping obligations, and staying on top of regulatory changes – none of it is particularly complicated on its own. Put together, it reduces risk and keeps the business on solid ground.
In an industry this heavily regulated, compliance isn’t background noise anymore. It’s part of how a sustainable business gets built.
