What Is the PACT Act? A Guide for Online Vape Sellers

The PACT Act that matters to a vape business is the Prevent All Cigarette Trafficking Act of 2009, the federal law that was widened to cover vaping products in December 2020. If you are here for the veterans’ law, that is a different statute with the same nickname, the Honoring our PACT Act of 2022, and it covers toxic-exposure benefits rather than tobacco. The tobacco version makes online sellers register with ATF, report their sales to state tax offices every month, check every buyer’s age, and keep their parcels out of the US Mail. The rest of this page is about that law.

Key takeaways

• The tobacco PACT Act became law as Public Law 111-154 on March 31, 2010. A second law, the Preventing Online Sales of E-Cigarettes to Children Act, was enacted on December 27, 2020. It pulled vaping products in 90 days later, on March 27, 2021.
• Sellers must register with ATF and with the tax administrator of every state they ship into, then file a report by the 10th day of each month.
• Every online order needs a database age check, an adult signature with photo ID at the door, a federal statement on the package, and state excise tax paid before the parcel moves.
• The Postal Service has treated vaping products as nonmailable since its final rule took effect on October 21, 2021 (86 FR 58398).
• Penalties reach fines, up to three years in prison, and a place on ATF’s non-compliant list.

Which PACT Act is this?

Search “PACT Act” and most of the results describe a veterans’ law. That one is the Honoring our PACT Act of 2022, Public Law 117-168, signed on August 10, 2022. Its full name is the Sergeant First Class Heath Robinson Honoring our Promise to Address Comprehensive Toxics Act. It widened VA health care and benefits for service members exposed to burn pits and other toxic substances, and nothing below will help you with it.

The law on this page is older and narrower. The Prevent All Cigarette Trafficking Act of 2009 took effect in 2010, and it was built to stop untaxed cigarettes from moving through the mail and across state lines. For a decade it had nothing to do with vaping. That changed on December 27, 2020. The Preventing Online Sales of E-Cigarettes to Children Act rewrote the word “cigarette” in the statute to include an electronic nicotine delivery system, the legal term for a vape device. Those changes took effect 90 days later, on March 27, 2021.

That wording is wide on purpose. It covers any electronic device that delivers nicotine, flavor, or any other substance through a mist, plus the liquids, parts, and components that go with it. One product type sits outside it, which is an item the FDA has approved as a quit-smoking aid or for another therapeutic purpose, and sold only for that purpose. Almost nothing else in a normal vape catalog gets that pass.

What does the PACT Act require of an online vape seller?

Two duties come first, and both are paperwork filed before you ship anything.

Register. Anyone who sells, transfers, or ships vaping products for profit across state lines has to file a statement with ATF. The same statement goes to the tobacco tax office of each state they ship into. ATF takes it on Form 5070.1. It names the business, its addresses, its websites, and its agents.

Report every month. By the 10th day of each month, you file a memo or a copy of each invoice with the tax office of every state you shipped into last month. The report lists customer names and addresses, the brands and amounts sold, and the name and phone number of whoever delivered each shipment. It is sorted by city, town, and ZIP code. Where a town or a tribe runs its own tobacco tax, copies go to its tax administrator and its chief law enforcement officer too.

That second duty is the one sellers miss. It is not a yearly filing, and it hands your customer list to every state you touch, every month, starting the month you start shipping.

What counts as a delivery sale, and what has to happen on every order?

A delivery sale is any sale to a consumer where you are not standing in front of the buyer. An order placed by phone, by mail, or over the internet counts, and so does any order shipped by a carrier. That is nearly every order an online vape store takes.

Federal law attaches the same duties to each one:

• An age check before the sale. You collect the buyer’s full name, birth date, and home address. You then check them against a database you can buy, built mainly from government records. The database cannot be one you own or can edit.
• A second age check at the door. The shipping method has to require an adult signature and a valid photo ID from whoever takes the parcel. The legal age is the one that applies where the package lands.
• A federal statement on the package. Both the bill of lading and the outside of the box must carry the wording the statute spells out, which reads “CIGARETTES/NICOTINE/SMOKELESS TOBACCO: FEDERAL LAW REQUIRES THE PAYMENT OF ALL APPLICABLE EXCISE TAXES, AND COMPLIANCE WITH APPLICABLE LICENSING AND TAX-STAMPING OBLIGATIONS”.
• Taxes paid up front. State and local excise taxes, the per-unit taxes a state charges on tobacco and vape products, have to be paid before the sale or delivery, not after. Any required tax stamps go on first too.
• A 10-pound cap. No single delivery sale may move more than 10 pounds of product.
• Records kept for years. Delivery sale records stay on file until the end of the fourth full calendar year that begins after the sale. ATF, state tax offices, and law enforcement can ask to see them.

The statute also says each delivery sale has to follow the licensing, tax, and youth-access laws of the place it lands, as if the sale happened entirely there. State rules differ and they change often. Some states limit or ban remote sales outright. We are not going to publish a state list here, because any list would be wrong within months. Ask a lawyer who tracks the states you ship to.

Why can’t you mail vape products?

Because a separate federal rule made them nonmailable. The 2020 law told the Postal Service to write the rules, and it published its final rule on October 21, 2021 at 86 FR 58398, effective the same day. Since then a vape device cannot go in the mail, and neither can any liquid, part, component, or accessory, whether or not it ships with the device.

A few narrow exceptions survive:

• Mailings entirely within Alaska or entirely within Hawaii.
• Shipments between licensed businesses, or between a licensed business and a government agency, for business or regulatory reasons. These need approval from the Postal Service first. The mailer must use a service that checks age and identity at delivery, such as Priority Mail with Adult Signature. The parcel has to be handed over in person at a post office or a business mail acceptance point.
• Small personal mailings by an individual, capped at 10 ounces per package and 10 mailings in any 30 days.

None of that is a way to ship orders to customers. The mail is closed to you.

That leaves private carriers. The federal ban applies to the Postal Service, so private carriers set their own tobacco and nicotine rules, and a policy can change without notice. Get in writing what your carrier will accept before you build a shipping plan on it. Keep a second option ready.

What are the penalties?

Breaking the law knowingly is a federal crime, punishable by a fine, up to three years in prison, or both. Delivery sellers also face civil penalties of up to the greater of $5,000 for a first violation or $10,000 for any other violation, or 2% of gross sales of the covered products over the prior one-year period.

Then there is the list. ATF keeps a register of delivery sellers it has found to be non-compliant. It sends the list to state officials and to carriers, and updates it at least every four months. A carrier that has the list cannot deliver for a seller named on it. Losing shipping is bad on its own, but the worse part is that the finding is public and anyone reviewing your business can find it.

How compliance shows up in payment underwriting

Here the statute stops being a legal topic and turns into a payments one. An underwriter, the person who decides whether a processor will open your account, is not grading your ethics. They are working out whether your orders will arrive and whether your customers will dispute them.

PACT Act duties feed straight into that call. Registration and monthly reports show the business is visible to regulators rather than hiding from them. A database age check and an adult signature at the door cut down the “I never ordered this” disputes that a loose checkout invites. A written carrier plan answers the question the mail ban raises, which is how the product actually reaches the buyer. Product mix matters too, because disposables, e-liquid, hardware, and anything with an open FDA question each carry a different level of risk.

The risk an underwriter is really pricing is delivery failure. Parcels that stall turn into refunds, and refunds that come too late turn into chargebacks, which are forced reversals the buyer’s bank pushes through. Fighting those is costly and uneven. Accertify’s 2023 to 2024 client data puts median win rates near 57% for non-fraud disputes and near 37% for fraud-coded ones. So part of every dispute batch is money you will not get back, however good your records are. Steady dispute volume is what pushes an account past the ratio card networks watch, and that is where reserves and closure notices come from.

This is also why so many mainstream platforms refuse the category or hold it behind extra review. You can read what several of them publish in our prohibited business lookup. A pooled platform that signs you up on a form has reviewed none of the above, which is why it can freeze the balance the moment someone reads the file properly. If that has already happened, what to do after a shutdown covers the next steps.

What to do with this

Treat the PACT Act as an operating job rather than a legal footnote. Register with ATF and with the states you ship into. Put the monthly report on a calendar with an owner’s name on it. Buy a real age check instead of a checkbox. Get your carrier’s current written policy and line up a backup. Keep your delivery records for the full four-year window.

Then bring that same file to your processor. A vape merchant account is underwritten on the compliance picture. Licenses, age checks, product mix, and shipping get reviewed before the account goes live rather than found later. A seller who can show the paperwork is answering the underwriter’s real question, and the rate, any reserve, and the settlement timing are set out in writing before you sign. For the legal questions, including anything about your state or your product line, talk to an attorney who works in this category.