How to Sell Vapes Online: Licenses, PACT Act and Card Payments
The launch sequence for an online vape store in the United States, built around what a card acquirer verifies: products, registrations, age checks at checkout and at the door, and where you ship.
- By the OpenGate underwriting desk
- Updated
- 12 min read
How to sell vapes online comes down to six things a card acquirer will verify before your first order: a catalog you may lawfully sell, PACT Act registration with ATF and each destination state, state licenses and tax accounts, third-party age verification at checkout, a carrier that checks ID for an adult signature, and a shipping map that leaves out banned markets. This guide puts them in order for a US launch.
In this guide
Can you sell vapes online legally?
Yes, in the United States, when three conditions hold at once: the product may be lawfully marketed, the destination allows the sale, and the delivery follows the PACT Act. Any one of them can stop an order.
- The product. Vaping products need FDA authorization to be marketed. As of October 2026 the FDA’s list of authorized e-cigarettes shows 48 products, and a May 2026 FDA policy covers certain products with pending applications. How acquirers treat each group is explained in the vape payment processing guide.
- The destination. States set their own rules. New York ended the shipment of online vapor product orders to individual consumers in 2020, California bans most flavored tobacco products, and states such as Pennsylvania allow only products listed on a state directory.
- The delivery. Federal law treats an online order as a delivery sale, with the duties described below.
The second condition binds you from a distance. Under the PACT Act a delivery sale must comply with the law of the destination state as if the whole sale took place there, so a seller in one state answers to the licensing, tax and product rules of every state on its shipping map. The checks at checkout and at the door are set out in online age verification law by sector.
Outside the United States the answer changes country by country, and some countries ban online sales altogether. Never plan a market where the sale itself is unlawful. This guide describes what acquirers expect. Confirm your own obligations with counsel.
How to sell vapes online, step by step
Work through eight steps, in this order.
- Fix the catalog. List every SKU with its FDA status and the states where it may be sold. Remove what you cannot document.
- Draw the shipping map. Decide which states and countries you serve, and block every other address at checkout.
- Register under the PACT Act, with ATF and with each state you will ship into.
- Obtain the state licenses and tax accounts your map requires. Excise tax on vaping products is a state matter and is due as each destination defines it.
- Contract age verification for the checkout, with a provider that checks each buyer against an independent database.
- Contract a carrier that accepts vaping products and delivers against an ID-checked adult signature.
- Build the store on a platform and a payment setup whose terms allow the products.
- Apply for card acceptance with the file complete.
Steps 3 to 6 depend on other organizations and take the longest. Start them while the store is being built, and keep every confirmation: each one becomes a page of your payment file.
The PACT Act file: registration, reports and records
The PACT Act turns an online vape seller into a registered, reporting business. ATF enforces it, and ATF’s PACT Act page says that those who sell or advertise electronic nicotine delivery systems in interstate commerce must register with ATF and with the tax administrators of the states they ship into. Each duty is set out one by one in PACT Act vape rules.
| Obligation | What the law requires | What the acquirer asks to see |
|---|---|---|
| Registration | With ATF, on Form 5070.1, and with the tobacco tax administrator of each state or locality you ship into | A copy of each registration |
| Monthly reports | By the 10th of each month, a report to each state on the previous month’s shipments: customers, brands, quantities and who delivered | The latest report filed for each state |
| Package statement | A federal notice on the outside of every package, beginning with the words CIGARETTES/NICOTINE/SMOKELESS TOBACCO | A photo of a labeled parcel |
| Weight limit | No single sale or delivery above 10 pounds | The order rule in your store |
| Taxes | State and local excise taxes paid as the destination requires | Tax account numbers for each state |
| Records | Every delivery sale, organized by state, city and zip code, kept until the end of the fourth full calendar year after the sale | Where the records live and who can export them |
The report contents, the notice wording and the record rule are set out in ATF’s summary of reporting, shipping and tax requirements. The same page lists the penalties: civil penalties of up to 5,000 dollars for a first violation and 10,000 dollars for each further one, or 2% of a year’s gross sales if that is greater, and prison terms of up to three years. The statute also has the Justice Department compile and circulate a list of unregistered or noncompliant delivery sellers, so expect an underwriter to ask whether you are on it.
A catalog that adds cigars, pouches or other tobacco products widens the licensing and tax picture, and the tobacco and nicotine page lists what acquirers expect for those lines.
Age verification: one check at checkout, one at the door
The PACT Act requires two age checks, and the acquirer expects evidence of both.
At checkout, you may not accept an order until you have the buyer’s full name, birth date and residential address and have verified them through a commercially available database of the kind government and businesses use for identity checks. The statute adds a limit that surprises new sellers: the database may not be in your possession or under your control. Your own customer list does not qualify, and a pop-up asking for a birth date verifies nothing.
At the door, the shipping method must require the buyer, or another adult of legal age, to sign for the parcel at the delivery address and to show government-issued photo identification. The minimum age is the one in force at the place of delivery, and the federal minimum for tobacco sales is 21.
Decide three things before launch and write them down:
- What happens when the database cannot match a buyer: manual document review, or cancellation.
- What happens when delivery fails: one more attempt, or return and refund.
- How long you keep verification results, and where.
OpenGate does not perform age verification. The procedure is required at onboarding, the underwriter checks that it runs on the live site, and the stored results later serve as evidence when a buyer disputes an order. The requirements for the vertical are listed on the e-liquids and vapes page.
Shipping: carriers, blocked destinations and delivery cost
You need a delivery service that takes vaping products and verifies age at the door, because the three best-known carriers do not carry consumer vape orders. Under Postal Service rules in force since October 2021, vaping products are generally nonmailable, with narrow exceptions. UPS prohibits vaping products throughout its US network, including import and export, regardless of nicotine content and destination state. FedEx prohibits the shipping of tobacco products and names e-cigarettes and vaporizers among them. Online sellers work with regional and specialized services that offer adult-signature delivery, state by state. Each carrier can change its policy, so read its page again before you sign.
Enforce the shipping map in the checkout, at the address step. A sentence in the shipping policy does not stop an order, and an order delivered into a state that bans the sale is a violation whoever placed it.
Delivery cost changes the economics of small orders. An example with illustrative figures, which are assumptions and not quotes: age verification costs 1 dollar per order, adult-signature delivery 9 dollars, and card processing 5%.
| Cost per order, in dollars | 60 dollar order | 25 dollar order |
|---|---|---|
| Age verification | 1.00 | 1.00 |
| Adult-signature delivery | 9.00 | 9.00 |
| Card processing at 5% | 3.00 | 1.25 |
| Total | 13.00 | 11.25 |
| Share of the order | 22% | 45% |
That is before excise tax, and before the second delivery attempt on a failed signature. A minimum order value, or a shipping charge shown separately, is the usual answer.
Where the store lives and how payments connect
Choose a platform whose terms allow vaping products before any design work starts. Shopify is off the list: a merchant notice reported by Reuters in July 2026 ended its support for the sale of vaping products, and the guide to whether you can sell vapes on Shopify sets out what is confirmed. Read the acceptable use policy of any hosted platform you consider, and the terms of the hosting company if you run the store yourself.
Payments are a separate layer from the storefront, and mainstream processors and wallets restrict the category in their published policies. Whatever platform you pick, confirm before you build that it lets you plug in an outside gateway, by redirecting buyers to a hosted payment page or by calling an API, and that it does not tie the store to its own payment product.
What the acquirer verifies, and in what order
The acquirer reads the file in the order that ends it fastest: catalog, shipping map, registrations and licenses, age checks, carrier, then the company and its numbers. Mastercard’s rules hold the acquirer responsible for confirming that an online tobacco seller operates lawfully before registering it, and again at least once a year.
A new store has no processing history, so the file carries projections in its place: expected monthly volume, average order value, share of subscription orders and the delivery failure rate you plan for. A new business with a sound file commonly starts under a monthly volume cap and a larger reserve, and both come up for review once the first statements are clean. The stages are described in our process, and what an underwriter looks at in any vertical is in how high-risk underwriting works.
Mistakes that end a new vape account
Most early closures come from a change the acquirer was not told about. Five are common, and one launch plan has no compliant version at all.
- Adding products after approval, especially disposables or new flavors, without sending the updated catalog.
- Opening a state at checkout before registering there.
- Moving to a cheaper delivery service with no ID check.
- Taking the first orders through a personal or mainstream payment account while the real application is pending. The closure that follows becomes part of your history.
- Marketing with cartoon characters, or products designed to look like toys or phones. The FDA names features that appeal to minors as a reason for enforcement, and acquirers read the site the same way.
The plan that cannot be fixed is the one built on shipping flavored disposables into states that ban them. No document makes that file placeable.
What to have ready when you apply
Prepare nine items: company registration and owner identification, the catalog with status per SKU, the shipping map, PACT Act registrations, state licenses and tax accounts, the age verification contract with screenshots of the flow, the carrier agreement, the site with its terms, refund and shipping policies, and six months of projections. Where a registration is still in progress, proof that it has been filed lets the review start. Activation usually waits for the document itself.
When the nine are assembled, send your launch file. An underwriter goes through it and answers within 1 business day. You receive terms in writing, a list of the items still missing, or a clear no with its reason. There is no charge for applying, and nothing binds you until you accept the written offer.