Abstract
Background
The online tobacco market currently accounts for 15% of tobacco products with most online e-cigarette stores depending on Software as a Service (SaaS) solutions like Shopify for site functionality. While the Prevent All Cigarette Trafficking (PACT) Act restricts online sales by requiring age verification upon delivery and prohibiting shipping with select couriers, concerns remain about youth access to e-cigarettes. This study examines online e-cigarette stores' apparent compliance with regulations designed to prevent youth sales in the US and the SaaS used by online e-cigarette stores.
Methods
Search engines and lists were used to identify eligible online e-cigarette stores (N = 58). Two trained coders coded stores for three PACT Act violations: (a) failure to verify buyer age; (b) failure to require a signature upon delivery; and (c) shipping via a restricted carrier. Separately, using a semi-automated browser in Python, we visited each store and tracked all web requests made to SaaS while visiting the site (N = 48). Lastly, SaaS used by four or more stores (N = 18) had terms of use coded for relevant legal language.
Results
Of the 58 stores coded in the study, 51 (88%) violated at least one of the three regulations tested. The most common violation was using a restricted shipping company (N = 45, 78%). All 18 SaaS used by four or more stores had at least 60% of their client stores in the study appearing to violate a regulation. The most used SaaS provider was Shopify, used by 29 (50%) of stores, of which 26 (90%) had at least one violation. A review of policies of the SaaS providers revealed 16 (89%) explicitly required clients to comply with local and federal regulations. The third-most-used SaaS explicitly stated that the service could not be used for tobacco.
Discussion
Despite SaaS policies requiring stores to comply with laws, most online e-cigarette stores failed to adhere to PACT Act restrictions aimed at preventing youth access to e-cigarettes. Stricter enforcement of the PACT Act and SaaS providers’ policies are needed to prevent youth from accessing e-cigarettes.
Keywords: Tobacco control, E-cigarettes, E-commerce, Commercial determinants of health
Introduction
Online sales of tobacco products are steadily increasing in the United States (US), with approximately 15% of all domestic tobacco product sales occurring online [1]. Furthermore, the US online e-cigarette market is projected to experience a compound annual growth rate of 35% through 2030 [2]. This increase in online tobacco sales has created concerns that the reduced regulation and increased anonymity online may lead online retailers to use tactics that facilitate underage sales [3].
Preventing youth access to tobacco products is a central tenet of comprehensive tobacco control programs [4], and a key component of the regulatory framework of the United States Food and Drug Administration (FDA)’s Center for Tobacco Products (CTP) [5]. The online tobacco market in the US is subject to specific regulations to prevent sales to youth. The 2020 Preventing Online Sales of E-Cigarettes to Children Act expanded upon the 2009 Preventing All Cigarette Trafficking (PACT) Act to include products, such as e-cigarettes, that were not regulated by the FDA when the Act was originally passed into law [6]. The expanded PACT Act requires that online tobacco stores verify the age of buyers, ensure that all packages must be signed upon delivery by an adult over the age of 21, and ship e-cigarettes via a private courier and not use the United States Postal Service (collectively “PACT Act restrictions”) (USPS) [6, 7]. Furthermore, in 2021, major shipping carriers UPS, FedEx, and DHL voluntarily joined USPS, prohibiting the shipping of e-cigarettes through their services [8].
However, enforcement of these PACT Act restrictions is limited. A 2024 study of 59 online e-cigarette shops that offered shipping found that 10 sites [16.9%] did not require any age verification to access the site [9] with most online e-cigarette stores relying solely on self-certification, such as a button indicating that the user was 21 years of age or older [9]. Additionally, 33 sites [56%] did not state that an ID was required upon delivery, and 39 sites [66.1%] used USPS, UPS, or FedEx for shipping [9]. In summation, the majority of stores examined contained at least one area where existing regulations were violated without enforcement.
Creating an efficient and functional online store requires significant infrastructure and complex code, usually beyond the means of small teams. Consequently, many online stores rely on software and code generated by third-party companies to offer a significant proportion of functionality on their site. These third-party services generally fall into two categories: On-premise solutions, where the e-cigarette store installs and hosts relevant code locally; and Software as a Service (SaaS) operations, that use a subscription model and where code is hosted and managed by the software company [10]. While both options exist, we focus on SaaS services here, for two reasons. First, SaaS operations often require less up-front cost and significantly less technical expertise [10]. Second, these services rely on the site having continuing access to SaaS providers’ servers, creating an ongoing relationship between the e-cigarette store and the SaaS provider.
SaaS providers can offer a wide range of functionality, from managing inventory to processing payments [11, 12]. Code is designed to operate seamlessly with the e-cigarette store’s website, so that from a customer perspective, even though they are visiting the e-cigarette store’s site, much of the data is stored and/or processed on the SaaS company’s servers. For example, Shopify, one of the most prominent e-commerce SaaS providers, offers a large suite of features [13]. Users can use a drag-and-drop user interface to create their entire store from scratch without any code, with all the shop’s data running on Shopify servers [13]. Other Shopify services include managing online product inventory, store theming, checkout experiences, and shipping assistance [13]. While Shopify is a prominent e-commerce SaaS provider, others exist, such as AgeChecker.net, Klaviyo, and Smile Inc.
The restrictions SaaS providers impose on businesses that utilize their services are an important consideration. Shopify has been copied on numerous warning letters issued to online stores by the FDA (e.g., X2 Cigs, E-Cigarette Empire LCC, and Smoke and Vape) [14–16]. Shopify states that stores must comply with the laws and regulations specific to their business [17]. However, enforcement of these self-imposed policies is at the discretion of the SaaS provider. Therefore, weak enforcement of these internal policies may allow businesses, such as online e-cigarette stores, to continue operating while disregarding legal requirements aimed at protecting youth.
This study investigates the use of SaaS by online e-cigarette stores to: (a) identify SaaS services used by online e-cigarette stores; (b) determine to what extent, if any, that online e-cigarette stores appear to be violating the PACT Act restrictions; and (c) identify SaaS providers used by online e-cigarette stores that appeared to violate PACT Act restrictions.
Methods
Identifying e-cigarette e-commerce sites
To compile a list of online e-cigarette stores, we followed established methods [9, 18, 19] particularly the search protocol described by Bertrand et al. (2024) [9]. In February 2025, we established an internet search protocol and, using Google, conducted four online searches from our offices in Washington, DC. We used the keywords “best internet vape store" "best online vape store,” “best internet vape shop," and "best online vape shops.” To reflect real‑world consumer search behavior, we included the term “best” in our systematic search strategy, as individuals frequently use evaluative keywords when seeking online e-cigarette retailers.
This approach resulted in 22 unique lists created by individuals or entities promoting the e-cigarette industry, identifying 65 unique online e-cigarette stores. Of these, 58 remained active and were accessible for this project.
Coding stores for appearance of regulatory violations
Two coders independently visited each site and were instructed to go through the primary steps for purchasing an e-cigarette product. They visited a product page, added an e-cigarette containing nicotine to their “basket,” and then continued through the purchasing process up until the point where the site asked for a delivery address and/or payment information. Subsequently, they were also instructed to view informative pages on the site that may contain relevant further information, such as the About Us or Shipping sections. The two coders independently double-coded the complete sample and subsequently met with a third coder to address any discrepancies.
ID required
Coders recorded if site visitors needed to present an ID at any point during the purchasing process up until when an address or payment information was requested. Presenting an ID could involve registering with a third-party site, uploading an image of your ID, or registering directly on the online e-cigarette store itself.
Signature required
Coders assessed if the online e-cigarette store stated anywhere on the site (during purchasing or on relevant pages) that an adult signature would be required to receive packages.
Carrier used
Coders recorded whether the site specified specifically used a restricted carrier (restricted carriers includes USPS – which are barred from shipping tobacco products by federal law – as well as DHL, Fedex and UPS that voluntarily prohibit shipping of tobacco products). If no carrier information was found, it was assumed that the site did not use a restricted carrier.
Cataloguing e-commerce services used
A Python script utilizing the Playwright package was written which monitored all Hypertext Transfer Protocol (HTTP) requests generated while the browser was in use. When a user visits a site, the site will generate HTTP requests to get relevant information or functions (for instance, when viewing a product, a request may be sent to a server to get the current price). Using a semi-automated browser, a researcher visited each site, adding an e-cigarette product containing nicotine to the basket, and then proceeded to the checkout. During this simulation, all HTTP requests made were tracked, and all successful HTTP requests (those with a status code between 200 and 299, [20] were kept. Across sampled sites (N = 58), a total of 29,572 HTTP requests were made (x̄ = 509.86 per site, SD = 317.77).
Subsequently, we examined the URLs of all HTTP requests, reducing them to their domain name (e.g., https://cdn.shopify.com/shopifycloud/checkout-web/assets/c1.en/polyfills.aaTJ3aJS.js down to shopify.com), identifying a total of 475 domains accessed via HTTP requests.
We then investigated each domain name, tying it back to the service it was associated with (e.g., shopify.com to Shopify). HTTP requests of services that would likely be used by all sites and not just e-commerce sites (e.g., numerous requests were made to domains to load external fonts) were dropped, leaving 48 unique e-commerce SaaS providers. SaaS providers used by four or more sites (N = 18) were then analyzed further.
Coding of relevant policies
Using the SaaS companies’ websites, we located terms of service and related legal agreements applicable to client sites using the platform (in this case the e-commerce stores). These policies were then reviewed. Agreement forms were reviewed for language stating that online e-cigarette stores were required to abide by all applicable laws of the jurisdiction/s in which the sites were located or to where the product/s were delivered. We also identified if the terms of service were limited by age, if the company would share personal information of users to comply with law enforcement, if users’ accounts would be terminated for not complying with applicable law, and if tobacco or e-cigarette related products were mentioned.
Results
Of the 58 online e-cigarette stores coded, a total of 51 stores appeared to violate at least one of the PACT Act restrictions. Twenty (34.5%) did not appear to require a signature upon delivery; 42 (72.4%) did not require ID to be displayed before reaching the purchasing page; and 45 (77.6%) specifically listed using a restricted shipping company. Only seven (12.1%) did not appear to violate any of the PACT Act restrictions assessed.
The 51 stores with at least one appearance of a PACT Act violation used an average of 4.43 (SD = 2.96) different e-commerce SaaS services. However this average is a lower-bound estimate, as it only includes the 48 e-commerce SaaS services studied here.
Every SaaS provider used by four or more sites (N = 18) was utilized by at least three sites failing to adequately check ID before purchase and at least one site appearing to violate the other two PACT Act restrictions tested. At least 60% of the sites using any given SaaS provider appeared to violate at least one PACT Act restriction. The full list of SaaS providers used by four or more sites, as well as the number of sites using the service with apparent violations of PACT Act restrictions, can be seen in Table 1. As an example, the most used service was Shopify, used by 29 (50%) of the stores. Nine (31%) of the stores using Shopify appeared not to require a signature upon delivery, 24 (82.8%) didn’t ask for ID before the purchasing page, and 24 (82.8%) shipped via a restricted carrier. SaaS providers covered a range of services from all-in-one solutions to customer retention, payment processors and marketing. A description of each SaaS provider can be seen in Table 2.
Table 1.
All SaaS providers used by four or more sites complete with number of sites breaking regulations
| Service | Any regulation1,2 | Signature2 | ID2 | Shipping2 | Total3 |
|---|---|---|---|---|---|
| Shopify Inc | 26 (89.7%) | 9 (31.0%) | 24 (82.8%) | 24 (82.8%) | 29 (50.0%) |
| AgeChecker.net | 21 (84.0%) | 3 (12.0%) | 19 (76.0%) | 18 (72.0%) | 25 (43.1%) |
| Klaviyo | 20 (95.2%) | 8 (38.1%) | 19 (90.5%) | 19 (90.5%) | 21 (36.2%) |
| Smile Inc | 13 (100.0%) | 5 (38.5%) | 10 (76.9%) | 12 (92.3%) | 13 (22.4%) |
| Share Sale | 11 (84.6%) | 4 (30.8%) | 11 (84.6%) | 9 (69.2%) | 13 (22.4%) |
| Authorize.net | 10 (90.9%) | 5 (45.5%) | 9 (81.8%) | 8 (72.7%) | 11 (19.0%) |
| yotpo | 10 (90.9%) | 3 (27.3%) | 8 (72.7%) | 9 (81.8%) | 11 (19.0%) |
| Sezzle | 8 (80.0%) | 4 (40.0%) | 8 (80.0%) | 7 (70.0%) | 10 (17.2%) |
| Stamped | 9 (90.0%) | 4 (40.0%) | 9 (90.0%) | 8 (80.0%) | 10 (17.2%) |
| PushOwl | 7 (87.5%) | 2 (25.0%) | 7 (87.5%) | 6 (75.0%) | 8 (13.8%) |
| BigCommerce | 6 (85.7%) | 3 (42.9%) | 3 (42.9%) | 6 (85.7%) | 7 (12.1%) |
| Noibu | 5 (100.0%) | 2 (40.0%) | 4 (80.0%) | 5 (100.0%) | 5 (8.6%) |
| Omnisend | 3 (60.0%) | 1 (20.0%) | 3 (60.0%) | 3 (60.0%) | 5 (8.6%) |
| Signifyd | 4 (100.0%) | 2 (50.0%) | 4 (100.0%) | 4 (100.0%) | 4 (6.9%) |
| Hextom | 4 (100.0%) | 1 (25.0%) | 4 (100.0%) | 4 (100.0%) | 4 (6.9%) |
| Route | 4 (100.0%) | 1 (25.0%) | 4 (100.0%) | 4 (100.0%) | 4 (6.9%) |
| VerifyPass | 4 (100.0%) | 1 (25.0%) | 4 (100.0%) | 3 (75.0%) | 4 (6.9%) |
| Stripe | 3 (75.0%) | 1 (25.0%) | 3 (75.0%) | 1 (25.0%) | 4 (6.9%) |
1Indicates the number of online e-cigarette stores flouting at least one of the tested regulations
2Percentage is based on the total number of stores using the service in the sample (as shown in the Total column)
3Percentage is based on number of stores in the full sample (N = 58)
Table 2.
Table of all SaaS providers used by four or more sites with description of their functionality and specific policies coded
| Functionality1 | Date last modified | Require sites to comply with applicable laws | Comply with law enforcement | References tobacco/e-cigarettes | |
|---|---|---|---|---|---|
| Shopify Inc | All-in-one e-commerce platform covering range of functionality | 03/01/2023 | X | ||
| AgeChecker.net | Age verification services | 10/26/2016 | X | ||
| Klaviyo | Customer relation management service, covering marketing, service and analytics | 03/24/2025 | X | X | ... certain message categories, such as those related to hate speech, adult content, and promoting illegal activities, are strictly prohibited across short code and toll-free numbers in the U.S. and Canada. This includes any SMS or MMS message content related to:... Sex, hate, alcohol, firearms, and tobacco (SHAFT) |
| Smile.io | Loyalty program that integrates with Shopify, BigCommerce and Klaviyo | 02/27/2024 | X | X | |
| ShareASale | Affiliate marketing program | 07/16/2025* | X | ||
| Authorize.net | Payment platform and gateway allowing online payments | 05/25/2025 | X | ||
| yotpo | Marketing platform covering loyalty programs and product reviews | 04/13/2024 | X | X | |
| Sezzle | Alternative payment platform, offering interest-free installment plans | 06/12/2025 | X | X | |
| Stamped | Reviews and loyalty programs | 12/07/2022 | X | X | |
| Pushbowl | Allows shopped to subscribe to email, SMS or web push notifications. Integrates with Shopify | 09/07/2022 | X | ||
| BigCommerce, Inc | All-in-one e-commerce platform covering range of functionality | 01/01/2025 | X | ||
| Noibu | Analytics and tools for detecting site technical issues | 05/13/2024 | X | ||
| Omnisend | Marketing automation | 06/30/2025 | X | ||
| Signifyd | Fraud protection and prevention | 12/17/2024 | X | ||
| Hextom | Products covering marketing, sales and management, acting as add-ons for Shopify and BigCommerce | 07/15/2025 | X | X | |
| Route | Shipping services such as protection and tracking | 10/31/2024 | X | X | The Route Policy does not cover the following without a specific written amendment from Route (collectively the “Policy Exclusions”):... Cigarettes and other tobacco products |
| VerifyPass | Verification service for access to special programs (e.g. military discounts) | 7/14/2025* | X | X | |
| Stripe | Online payment processing solutions | 12/16/2025 | X | X |
Financial products and services : Tobacco products including e-cigarettes, cigars, and e-liquid, herbal cigarettes, production equipment specifically marketed for the production of tobacco products |
*Indicates the date the policy was accessed since a last modified date was unavailable
1Created based on paraphrasing SaaS providers descriptions from their websites as a broad indicator of the service. However, individual store’s use of any SaaS provider may utilize only some or lesser-known functionality
A summary of the third-party SaaS provider’s policies coded can be seen in Table 2. All but two (Authorize.net LLC and BigCommerce, Inc) of the SaaS providers examined explicitly stated in their policies that sites using the services must comply with applicable laws. Only three companies mentioned tobacco products in their terms of service or other agreement forms provided online. Klaviyo’s acceptable use policy stated that they prohibit messages related to “Sex, hate, alcohol, firearms, and tobacco” and “illegal substances... including... vaping/e-cigarettes.” Route’s terms and conditions of use stated that “the Route [insurance] policy does not cover [“Cigarettes and Other Tobacco Products”] without a specific written amendment from Route)”. tobacco products were not defined, and e-cigarettes were not mentioned. Stripe had the only policy that had restrictions on the sales of tobacco products, and their tobacco product definition included, “e-cigarettes, cigars, and e-liquid.” Under its Privacy Policy, Stripe states that businesses that fall within the prohibited and restricted business designation are required to provide information such as proof of license and business model details and those who cannot provide all required information will not be approved for use. None of the terms of service (or similar terms of use) documents provided a legal definition of tobacco products. Eleven of the third-party e-commerce services stated in their terms that they would assist law enforcement with investigations against clients (in this case, stores).
Discussion
In this study, we provide the first evidence documenting the use of Software as a Service (SaaS) by online e-cigarette stores appearing to violate PACT Act restrictions designed to prevent youth access to tobacco products. Similar to previous research [9], the majority of online stores examined appeared to violate at least one of the PACT Act restrictions, by not appearing to ensure packages were signed for upon delivery; not requiring ID to reach the purchasing page for the product; or shipping via a restricted carrier. The most common likely PACT Act restriction violated was not requiring the ID of the buyer. The majority of sites relied solely on age self-certification, often requiring users to simply type in their date of birth or click a button indicating they were over 21 years of age, These results are consistent with prior research across various tobacco products, showing that most online tobacco retailers, including e-cigarette shops, allow access based solely on self‑reported age, and that only a small proportion require ID or age verification at the time of purchase [9, 21–23]. These systems are easily bypassed by underage consumers attempting to purchase tobacco products, thus failing to provide sufficient protection to prevent youth access to these products. SaaS offerings that require strict age verification are available. In fact, one such service, AgeChecker.net, was used by 25 of the stores in our study; however, many of those used a free version of the service that only provided a simple pop-up, relying on self-verification.
While the majority (65%) of stores required a signature upon delivery, this is based on the stated policies of the sites. Prior research has shown that the actual rate of stores requiring a signature upon delivery is much lower [21, 24]. Therefore, while our results here show that some stores using SaaS services openly state violations of this PACT Act’s requirement, the actual number of stores violating this policy may be higher.
Every SaaS used by four or more e-cigarette stores was used by at least one site that appeared to be violating PACT Act restrictions. This suggests that e-cigarette stores violating regulations are able to easily use SaaS products, and that the policies of SaaS providers requiring sites to comply with PACT Act restrictions are not being sufficiently enforced.
The SaaS providers used covered a range of functions, including inventory management, affiliate marketing facilitation, promotion creation, and sales processing. Most e-cigarette stores utilized multiple different SaaS providers, adding a suite of functionality to their sites. Furthermore, we focused exclusively on SaaS, excluding on-premises solutions that involved downloading code to be used entirely on the store’s own infrastructure. As such, all these services involve a continued relationship between the SaaS provider and the e-commerce store; should the provider refuse the store as a customer, the functionality would be lost. Regulators may wish to pay close attention to the role of SaaS providers in creating and monetizing software solutions that facilitate illicit online e-cigarette stores.
Furthermore, some SaaS providers specialize in acting as add-ons for larger umbrella services. For instance, PushOwl [25], a service offering systems to push notifications to customers, operates entirely as an extension to Shopify. Consequently, if Shopify were to remove its functionality from sites, PushOwl’s functionality would likely also be lost. Indeed, all eight of the stores in this study using PushOwl also utilize Shopify. In fact, for eight of the SaaS providers studied, all stores using the service also utilized either Shopify or BigCommerce – the two umbrella services identified here – suggesting they operate as add-ons to these larger e-commerce services. Consequently, exerting pressure on certain SaaS providers to enforce policies may have large knock-on effects on limiting the number of and functionality of online e-cigarette sellers violating regulations.
Our review of the SaaS providers’ terms of service found all of them include an indemnification clause, which states that the company is not liable for individual users’ violations of the terms or violations of applicable laws. For example, Authorize.net’s indemnification clause reads, “You agree to indemnify, defend and hold harmless Company, its parents, […] from any claim or demand, including reasonable attorneys' fees and court costs, made by any third party due to, arising from or out of […] your violation or alleged violation of any federal, state, international or local law and any and all regulations” [26].
Despite the policies of SaaS providers requiring sites to adhere to federal and local regulations, we find many e-cigarette e-commerce stores using SaaS services routinely appear to violate PACT Act restrictions. Consequently, it would seem that SaaS services fail to strictly enforce their own policies. Such results speak to wider discussions concerning the pitfalls of self-regulation in tech [27–29]. Specifically regarding tobacco control, SaaS services can be considered alongside social media [30], and smartphones [31], as a big tech industry utilized by those profiting off tobacco sales.
Limitations
The original searches to find e-cigarette e-commerce stores were made to approximately resemble likely real-world searches. However, this system is not exhaustive, and consequently we cannot make claims that the sample of stores is representative or comprehensive. Additionally, given searches were not made using an incognito/private browser, previous online behavior may have influenced the results of our search.
Unfortunately, due to cost and logistical constraints, we did not purchase any products through the online e-cigarette stores. Consequently, we cannot confirm that stores did not require a signature for delivery, that shipping would use a restricted carrier, or that ID would not be checked immediately before or after purchase. Particularly results regarding requiring signature upon delivery and use of restricted carriers are based on stated policies and not recorded behavior, so actual compliance may vary. However, every effort was made to be as certain as possible without purchasing products, including going through the as much of the purchasing process as possible and reading the wider policies on the site.
We only examined SaaS providers and did not study systems maintained onsite by the online e-cigarette store that may also be used widely by online e-cigarette stores. For instance, other e-commerce services may work by downloading code without an ongoing subscription or other relationship. Such services would not appear during our investigation. However, such tools would be more complex to regulate as there is no ongoing relationship between the e-cigarette store and a third-party e-commerce service. Additionally, we only checked that the SaaS service was requested by the e-commerce store, and that the request call was successful. While this strongly implies they use the SaaS, we cannot be certain of a relationship.
Under the review of legal language, we examined terms of agreement and other legal disclaimers provided on the companies’ websites. It is possible that there are disclaimers modified for use of particular products that merchants and consumers alike see that were not presented on their website and were not included in the results. Online terms and conditions are often complex and obtuse, which can hinder clear interpretations of legal responsibility.
Conclusions
Online e-cigarette stores rely on SaaS providers to add functionality to their site and create an efficient purchasing experience for themselves and consumers. Without these services many of the stores violating regulations would either have to reduce or cease operations. State and Federal regulatory agencies should consider comprehensive strategies ranging from capacity-building to enforcement to support platform-level compliance that would hold third-party services and their partnering e-cigarette stores accountable for their actions. Providing education and enforcing federal and state delivery laws will help curb the illegal sales of e-cigarettes online and reduce youth exposure and access to tobacco.
Abbreviations
- PACT
Prevent All Cigarette Trafficking Act
- SaaS
Software as a Service
- FDA
United States Food and Drug Administration
- CTP
Center for Tobacco Products
Authors’ contributions
GDHP and JK conceptualized this study. GDHP and AB designed the methodology. AB, GP, and PDD conducted the data analysis. GDHP & AB drafted the manuscript. JK and BAS provided guidance and supervision. All authors provided critical revisions to the manuscript.
Funding
This study was funded by Truth Initiative.
Data availability
A data-sharing agreement is required for the use of all data. Truth Initiative does not share data with tobacco industry representatives or affiliated researchers. Investigators seeking access to data used in the study should make a written request to Truth Initiative authors and submit a detailed research plan including the purpose of the proposed research, required variables, duration of the analysis phase, IRB approval with FWA information, and documentation of investigator training in human subjects. Approved investigators may access datasets via an analytic portal owned and administered by Truth Initiative.
Declarations
Ethics approval and consent to participate
Not applicable.
Consent for publication
Not applicable.
Competing interests
The authors declare no competing interests.
Footnotes
Publisher’s Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
References
- 1.Grand View Research. U.S. Tobacco market size & share report, 2022–2030. 2025. Available from: https://www.grandviewresearch.com/industry-analysis/us-tobacco-market. Cited 2025 Jul 2.
- 2.Grandview Research. E-cigarette and vape market share & growth report. 2030. Available from: https://www.grandviewresearch.com/industry-analysis/e-cigarette-vaping-market. Cited 2025 Dec 1.
- 3.Leas EC. Need for improved regulation of tobacco e-commerce. Tob Control. 2025;34(2):276–7. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 4.US Food and Drug Administration. Center for Tobacco Products. Section 3 of the Tobacco Control Act - Purpose. FDA; 2022. Available from: https://www.fda.gov/tobacco-products/rules-regulations-and-guidance/section-3-tobacco-control-act-purpose. Cited 2023 May 10.
- 5.Center for Tobacco Products. FDA’s Youth Tobacco Prevention Plan. FDA; 2025. Available from: https://www.fda.gov/tobacco-products/youth-and-tobacco/fdas-youth-tobacco-prevention-plan. Cited 2025 Jul 2.
- 6.US Congress. S.1253 - 116th Congress (2019–2020): Preventing Online Sales of E-Cigarettes to Children Act. 2020. Available from: https://www.congress.gov/bill/116th-congress/senate-bill/1253. Cited 2025 Jul 3.
- 7.US Congress. Text - S.1147 - 111th Congress (2009–2010): PACT Act. 2010. Available from: https://www.congress.gov/bill/111th-congress/senate-bill/1147/text. Cited 2025 Sep 10.
- 8.Freight Right. UPS, DHL, and FEdEx join USPS in vape mail ban. 2021. Available from: https://www.freightright.com/news/vape-mail-ban. Cited 2023 Apr 28.
- 9.Bertrand A, Diaz MC, Hair EC, Schillo BA. Easy access: identification verification and shipping methods used by online vape shops. Tobacco Control. 2024. Available from: https://tobaccocontrol.bmj.com/content/early/2024/01/08/tc-2023-058303. Cited 2024 Apr 26. [DOI] [PubMed]
- 10.Icreon. Icreon. 2023. Advantages of SaaS Ecommerce over On-Premise. Available from: https://www.icreon.com/insights/saas-ecommerce-advantages-over-on-premise-solutions. Cited 2025 Sep 29.
- 11.Forbes. Forbes Advisor. 2022. What is a third-party payment processor? Available from: https://www.forbes.com/advisor/business/third-party-payment-processor/. Cited 2025 Sep 10.
- 12.Forbes. Forbes Advisor. How to start an online store in 9 steps (2025 Guide). 2022. Available from: https://www.forbes.com/advisor/business/how-to-start-an-online-store/. Cited 2025 Sep 10.
- 13.Shopify. Shopify. Shopify: The All-in-One Commerce Platform for Businesses. Available from: https://www.shopify.com/. Cited 2025 Jul 3.
- 14.US Food and Drug Administration. Center for Tobacco Products. Warning Letter - X2 Cigs - 08/30/2018. FDA; 2025. Available from: https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/x2-cigs-08302018. Cited 2025 Sep 10.
- 15.US Food and Drug Administration. Center for Tobacco Products. Center for Tobacco Products. FDA; 2025. Warning Letter - E Cigarette Empire LLC - 608450 - 07/20/2020. Available from: https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/e-cigarette-empire-llc-608450-07202020. Cited 2025 Sep 10.
- 16.US Food and Drug Administration. Center for Tobacco Products. Warning Letter - Smoke and Vape - 09/12/2018. FDA; 2025. Available from: https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/smoke-and-vape-09122018. Cited 2025 Sep 10.
- 17.Shopify. Electronic Nicotine Delivery Systems (ENDS) products. 2021. Available from: https://help.shopify.com/en/manual/compliance/legal/ends. Cited 2024 Jul 5.
- 18.Ma S, Jiang S, Ling M, Chen J, Shang C. Price promotions of e-liquid products sold in online stores. Int J Environ Res Public Health. 2022;19(14):8870. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 19.Silver NA, Bertrand A, Kucherlapaty P, Schillo BA. Examining influencer compliance with advertising regulations in branded vaping content on Instagram. Frontiers in Public Health. 2023;10. Available from: https://www.frontiersin.org/articles/10.3389/fpubh.2022.1001115. Cited 2023 May 15. [DOI] [PMC free article] [PubMed]
- 20.Mozilla Corporation. MDN Web Docs. HTTP response status codes. 2025. Available from: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status. Cited 2025 Sep 11.
- 21.Williams RS, Derrick J, Ribisl KM. Electronic cigarette sales to minors via the internet. JAMA Pediatr. 2015;169(3):e1563. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 22.Williams RS, Phillips-Weiner KJ, Vincus AA. Age verification and online sales of little cigars and cigarillos to minors. Tob Regul Sci. 2020;6(2):152–63. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 23.Williams RS, Derrick J, Phillips KJ. Cigarette sales to minors via the internet: how the story has changed in the wake of federal regulation. Tob Control. 2017;26(4):415–20. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 24.Harati RM, Ellis SE, Satybaldiyeva N, Mejorado T, Benitez G, Henriksen L, et al. Online retailer nonadherence to age verification, shipping, and flavor restrictions on e-cigarettes. JAMA. 2024;332(24):2113–4. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 25.PushOwl. Email Marketing, SMS Marketing, & Push Notifications for Shopify. 2025. Available from: https://www.pushowl.com/. Cited 2025 Sep 11.
- 26.Authorize.net. Payment Gateway Merchant Services Agreement. 2025. Available from: https://account.authorize.net/interfaces/Legal/Merchant/Agreements/GW/1.0/agreement-authnet.htm. Cited 2025 Sep 11.
- 27.Gannon J. Enhanced regulation of the tech industry. Eur J Public Health. 2025;35(Suppl 4):ckaf161.777. [Google Scholar]
- 28.Lindman J, Makinen J, Kasanen E. Big Tech’s power, political corporate social responsibility and regulation. J Inf Technol. 2023;38(2):144–59. [Google Scholar]
- 29.Griffin L. Tech Policy Press. How to Avoid Repeating the Self-Regulatory Fallacy with AI | TechPolicy.Press. 2023. Available from: https://techpolicy.press/how-to-avoid-repeating-the-self-regulatory-fallacy-with-ai. Cited 2025 Oct 29.
- 30.Donaldson SI, Dormanesh A, Perez C, Majmundar A, Allem JP. Association between exposure to tobacco content on social media and tobacco use: a systematic review and meta-analysis. JAMA Pediatr. 2022;176(9):878–85. [DOI] [PMC free article] [PubMed] [Google Scholar]
- 31.BinDhim NF, Freeman B, Trevena L. Pro-smoking apps for smartphones: the latest vehicle for the tobacco industry? Tob Control. 2014;23(1):e4–e4. [DOI] [PubMed] [Google Scholar]
Associated Data
This section collects any data citations, data availability statements, or supplementary materials included in this article.
Data Availability Statement
A data-sharing agreement is required for the use of all data. Truth Initiative does not share data with tobacco industry representatives or affiliated researchers. Investigators seeking access to data used in the study should make a written request to Truth Initiative authors and submit a detailed research plan including the purpose of the proposed research, required variables, duration of the analysis phase, IRB approval with FWA information, and documentation of investigator training in human subjects. Approved investigators may access datasets via an analytic portal owned and administered by Truth Initiative.