Magento for Vape + E-Cigs: 12 questions answered.

The Tobacco 21 Act (December 2019) made it federal law to sell vape only to 21+. A “click yes I’m 21” modal is not enough, the FDA + state AGs have been fining brands $500, $50k per non-compliant transaction. You need real ID verification.

The three vendors I’ve shipped:

• Veratad (TransUnion), most thorough. Customer enters DOB + last 4 of SSN; backend cross-references AAMVA (state DMV database) + LexisNexis + court records. ~$0.45 per verification. Best for stores doing >1,000 orders/mo. Magento integration is REST API, ~12h of dev work.
• Yoti, UK-rooted, strong on biometric verification (selfie + ID photo). Customer uploads driver’s license photo + takes a selfie; ML compares. ~$0.25 per verification. Better UX (customers complete faster) but slightly weaker backend trust.
• AgeChecker.net, vape-industry specific, cheapest. ~$0.15 per verification. Database-only (no selfie), so weaker on identity-theft cases. OK for low-volume stores or when budget is tight.

Integration pattern in Magento:

• Customer adds vape to cart → checkout → before payment authorization, JS triggers age-gate vendor SDK.
• Vendor returns pass / fail / manual-review via webhook.
• Pass: order proceeds to payment. Fail: order blocked, customer told why.
• Manual-review (~5-8% of cases): order pending, admin reviews ID photo, approves or denies.

Failed-verification customers get a one-time email asking them to retry with a different document. Avoid blanket bans.

Realistic ranges for a vape brand at $500k, $5M GMV:

• Compliance + processor audit: $499. 5 business days. ~20h @ $25/hr. Fixed-fee. Output: written processor recommendation, PMTA SKU exposure map, state flavor-ban exposure map, USPS / PACT Act audit, age-gate vendor recommendation, Magento fit recommendation.
• Compliance-ready vape Magento build: $4,999. 6 weeks. ~200h @ $25/hr. Fixed-fee. Includes high-risk processor wiring (NMI default), 21+ age-gate integration (AgeChecker.net default), FDA PMTA product attribute + visibility filter, state flavor-ban routing at cart, USPS-banned carrier-select rebuild, wholesale Net-30 + tier-pricing layer, basic Hyvä storefront. Excludes: PIM integration, ERP wiring, multi-warehouse MSI setup.
• Custom multi-state DTC + wholesale enterprise: Quoted in 24h. Multi-week engagement. Includes everything above plus PACT Act monthly reporting automation, multi-warehouse / multi-region MSI, ATF + state-tax registration support, PIM integration, ongoing compliance retainer ($1.5k, $5k/mo).
• Hosting: $400, $1,500/mo on Cloudways / dedicated. Some hosts (SiteGround, Bluehost) refuse vape; we wire to vape-friendly providers (Cloudways managed AWS, dedicated VPS).

My credentials:

• Adobe Certified Expert (Magento 2 Architect).
• 7+ years building Magento for high-risk DTC verticals (vape, CBD, kratom, nootropics).
• 12+ high-risk DTC stores shipped to live (NDAs prevent naming them publicly; references on request).
• Featured on Upwork as Top Rated Plus for Magento + Hyvä.
• Active in the Hyvä Themes Slack and Magento community.

Honest stance: vape is the most operationally complex US e-commerce vertical. Budget for ongoing compliance maintenance, not just the initial build. State laws shift quarterly.

Two ends of the spectrum need different builds.

Edge case 1: Single-state brick-and-mortar with a small online add-on

• Volume: under $200k/yr online. 50-200 SKUs.
• Compliance reality: only ship in-state, where you already have a tobacco retailer license. Federal PACT Act registration still required, but state ban + multi-state ship complexity goes away.
• Magento stance: Magento is probably overkill. WooCommerce + WordPress with a vape-friendly host might serve better at this scale. Or a custom vape-specialty platform (CCBill, CommercePilot).
• If you do go Magento: minimal scope. Magento Open Source + Hyvä + NMI gateway + AgeChecker.net + FedEx Adult Sig. Skip PMTA filtering (your in-state distributor has done it). Skip B2B layer.
• Budget: $4k, $8k for a tight build. 3-4 weeks.

Edge case 2: Multi-state DTC + wholesale + international expansion

• Volume: $5M+/yr. 500+ SKUs across devices, e-juice, pods, disposables, coils, accessories.
• Compliance reality: full PMTA audit per SKU, full state-ban routing across all 50 states, PACT Act monthly reporting per state, ATF + state-tax registration in every state you ship to, wholesale to hundreds of smoke shops with Net-30 invoicing, optional EU TPD compliance for international expansion.
• Magento stance: Magento is the only viable platform. Adobe Commerce B2B + MSI + Hyvä storefront. Custom PMTA-status workflow, custom PACT Act reporting module, PIM integration (Akeneo).
• Budget: $50k, $150k initial build over 4-6 months. $3k, $8k/mo ongoing retainer for compliance maintenance.

Most brands sit in the middle, the $4,999 fixed-fee build is sized for the typical $500k, $5M GMV brand. If you’re on either edge, book the audit ($499) and we’ll scope the right build shape for your situation. No upsell, just an honest read.

The FDA Premarket Tobacco Application (PMTA) is the regulatory requirement that every vape product sold in the US must have a submitted or granted PMTA. The submission deadline was September 9, 2020 (Trump administration). Since then:

• Only ~23 products have full grant orders, mostly NJOY, Vuse, Logic, and a few Juul SKUs. Tobacco and menthol flavors only.
• Millions of submitted PMTAs are in “pending review”, technically legal to sell while under review, but the FDA has been denying ~95% of decisions issued.
• Selling a non-PMTA product is a federal offense, FDA warning letters, seizures, civil penalties.
• Most independent vape brands operate in a gray zone, selling submitted-but-not-yet-decided products, hoping the FDA doesn’t prioritize them.

How we wire it in Magento:

• pmta_status product attribute, values: granted, submitted, denied, unsubmitted.
• Catalog visibility filter, only granted + submitted products visible to US customers. denied + unsubmitted auto-hide.
• Cart-stage block, if a denied SKU somehow ends up in cart (deep-link, admin error), block at cart with a compliance message.
• Quarterly PMTA audit, pull the FDA’s public MRTP list, cross-reference your catalog, update pmta_status for any newly-denied products.
• PMTA proof document upload, admin-side, attach the PMTA submission receipt PDF per product. Useful for ATF / state inspector requests.

Realistic stance: most vape brands ship under the “submitted” flag knowing the FDA is enforcement-throttled. We build the infrastructure so when a denial hits, the product disappears in minutes, not days.

The Tobacco 21 Act (signed December 20, 2019) raised the federal minimum age for all tobacco + vape sales from 18 to 21. As of 2026, enforcement comes from three directions:

• FDA Center for Tobacco Products (CTP), conducts undercover compliance check buys (think: a 19-year-old test shopper tries to buy from your store). Failure = warning letter, then civil money penalty up to $11,182 per violation (2024 rate, inflation-adjusted).
• State Attorneys General, states with stricter laws (MA, NY, CA) bring their own enforcement. State fines run $500, $50k per non-compliant sale.
• Civil class actions, minors’ parents sue if they discover the kid bought from your store. Class certifications have settled for $1M, $8M.

What “compliance” looks like in 2026:

• Real ID verification at checkout, not a click-through. Veratad / Yoti / AgeChecker.net (see separate FAQ).
• Adult Signature 21+ required at delivery, FedEx Adult Sig confirms recipient is 21+ at the door. No leaving on porch.
• Marketing audit, no flavor names, packaging, or imagery that appeals to minors (no cartoons, no fruit names that mimic candy, no school-aged models in ads).
• Order audit trail, per-order log of: ID-verification vendor + timestamp + pass-reason, carrier + tracking + adult-sig confirmation. Keep 4 years.

How we wire it in Magento: every order gets a compliance_metadata JSON column with the audit trail. Admin can pull a state AG inspection report in 1 click. We’ve passed 6 state inspector audits with this pattern.

Short answer: not easily. Each region has its own regulatory regime that’s as strict or stricter than the FDA.

EU, TPD (Tobacco Products Directive):

• Maximum 2ml tank capacity (no MTL pod systems above 2ml).
• Maximum 20mg/ml nicotine strength (no 30mg+ salt nic).
• Maximum 10ml refill bottle.
• EU TPD notification required per SKU (~€150 per country per product). 27 EU countries = potentially €4k+ per SKU.
• Child-resistant + tamper-evident packaging.
• Health warnings on 30% of pack surface.

UK, MHRA:

• Similar to EU TPD but post-Brexit slightly diverged.
• UK MHRA notification required (separate from EU).
• Disposable vape ban came into effect June 1, 2025, you cannot legally sell single-use disposables to UK customers in 2026.

Australia, TGA:

• Nicotine vape products are prescription-only since October 2021.
• You can only ship to AU customers who have a doctor’s prescription on file (uploaded + verified).
• Pharmacy-licensed channel only, no DTC outside that.

How we wire it in Magento: separate store views per region with different catalogs (US store sees full product range; EU store sees TPD-compliant SKUs only; UK store excludes disposables; AU store requires prescription upload). Geo-routing redirects customers to the correct store view at landing.

Realistic stance: most US vape brands stay US-only because the per-country regulatory cost outweighs the revenue. International expansion happens at $10M+ GMV when you have the compliance budget.

Marketplaces are nearly all closed to vape. Verified in 2026:

• Amazon, bans all vape products (devices, e-juice, disposables, accessories). Bans “tobacco substitutes” broadly. Listing one = immediate account suspension + ASIN delete.
• eBay, bans all vape products including empty hardware (mods + tanks). Single-use disposables and pre-filled pods explicitly prohibited.
• Etsy, bans vape, tobacco, and CBD products outright.
• Shopify retail, tolerates vape but Shopify Payments doesn’t process it. Forces you to a third-party gateway. Shopify also reserves the right to terminate (and frequently does at scale).
• Facebook Marketplace + Instagram Shop, ban vape. Organic posts about vape are limited but allowed; paid ads are banned.
• Google Shopping + Google Ads, ban vape advertising globally.
• TikTok Shop, bans vape (US + EU).
• Walmart Marketplace, bans vape.

What works in 2026:

• Your own Magento store, the only durable channel.
• Vape-specialty marketplaces, Element Vape Marketplace, VaporFi Wholesale, Misthub. Smaller audiences but vape-friendly.
• Influencer + affiliate channels, vape Twitch streamers, YouTube reviewers (the channel allows reviews, not promo), Reddit r/electronic_cigarette communities.
• Email + SMS, SMS legal but TCPA-compliant. Klaviyo, Postscript work for vape.
• Paid search on vape-specific networks, small budget but no scale.

Your owned channel (Magento store + email/SMS list) is everything. Build the email list aggressively.

Stripe, PayPal, Square, Authorize.net, and Shopify Payments all explicitly prohibit vape in their merchant agreements. It’s not a glitch; it’s policy. They classify vape as “regulated tobacco product” alongside cigars and chewing tobacco. The reality:

• Stripe / PayPal / Square will close your account 30-90 days after first detection of vape transactions. They scan via MCC code (5993 = vape), product names, and chargeback patterns.
• They’ll freeze your reserve for 180 days, you lose access to anywhere from $5k to $500k+ depending on volume.
• Chargebacks fight to ~$50k typical, plus your domain reputation gets flagged.

What we wire instead:

• NMI gateway, most common, supports vape + CBD + nutra. ~2.9% + $0.30 per transaction, $25/mo gateway fee. Magento extension exists; we typically build a custom payment method module for cleaner UX.
• EVO Payments, European parent, US presence, vape-friendly MID underwriting.
• Easy Pay Direct (EPD), high-risk specialist, multiple backup MIDs (load balancing helps with chargeback ratios).
• eMerchantBroker, vape + adult specialist, fastest underwriting (3-5 days).
• ACH via Plaid, 0.75% per transaction, no chargeback risk. Add for repeat customers to cut effective rate.
• Crypto fallback (BitPay, Coinbase Commerce), ~3% of vape buyers prefer this; chargeback-resistant.

Typical effective rate after blend: ~3.8% (vs Stripe’s nominal 2.9% that doesn’t actually exist for vape). Budget accordingly.

As of 2026, the landscape is unstable but the headlines:

• Massachusetts, full flavored vape ban (only tobacco flavor legal). Most aggressive enforcement in the US.
• Rhode Island, flavored vape ban + flavored cigar ban.
• New York, flavored vape ban (tobacco + menthol only).
• Utah, flavored vape ban + nicotine cap.
• California, flavored vape ban (statewide referendum 2022, upheld 2023).
• New Jersey, flavored disposable ban (devices specifically; bottled e-juice allowed).
• Vermont, Maine, Maryland, restrict by flavor category (kid-appealing names banned, “tobacco”-style names OK).

Plus county-level bans in Chicago, San Francisco, Boulder, NYC (stricter than state).

How we wire it in Magento:

• banned_states JSON product attribute, array of state codes per SKU (e.g., ["MA","RI","NY","UT","CA","NJ"] for a flavored disposable).
• Cart-stage ship-state validator, customer enters ZIP, JS resolves to state, validates each cart item’s banned_states against ship state.
• Auto-block or auto-swap, either reject the line item (“Cannot ship strawberry pod to NY; remove or swap to tobacco flavor”) or auto-substitute the tobacco-flavored equivalent SKU.
• Quarterly compliance audit, subscribe to state AG vape-law alerts; the JSON attribute gets updated when new bans pass.

Get this wrong and a state AG complaint follows the shipment. Fines run $5k, $50k per shipment.

Yes, but with constraints. Subscriptions are high-margin for vape (pod refills, e-juice, coil replacements every 30 days) so it’s worth doing right.

Constraints:

• High-risk processors don’t love recurring, NMI / EVO / EPD all support recurring billing but underwrite stricter on subscription volume (chargeback risk is higher on recurring). Expect a higher reserve (15-25% vs 5-10% for one-time).
• Age-gate must re-verify periodically, not every cycle, but every 6 months. Customer’s ID might expire; T21 status might change (if a 20-year-old subscribed lying, their next cycle as a 21-year-old should re-verify legitimately).
• State ban re-validation, if customer moves from KY to NY and their flavored disposable is now state-banned, the subscription needs to either auto-pause or auto-swap. Cart validator runs per cycle.
• PMTA status drift, if a product’s PMTA gets denied mid-subscription, the cycle should fail and notify the customer to switch to a still-approved SKU.

How we wire it in Magento:

• Mageworx Subscriptions + Recurring Payments or Aheadworks Subscriptions for the recurring engine. Both support high-risk gateways.
• Custom subscription health checker, cron job runs nightly, re-validates each active subscription against age-gate (every 180 days), ship-state ban list, and PMTA status. Pauses / notifies failures.
• Customer self-service portal, pause, skip, swap SKU, update payment method, update shipping address. Cuts cancellation rate ~30%.
• Smart retry on declines, high-risk gateways decline more often. Auto-retry with 24h delay + alternative payment method fallback before pausing.

Typical pod-subscription LTV is 3-4x first-order value over 12 months. Worth the build complexity.

The 2021 PACT Act amendment (signed December 2020, effective April 2021) banned USPS from shipping vape products. Within weeks:

• USPS, banned vape, full stop. No exceptions.
• FedEx Ground, banned consumer vape March 2021.
• UPS Ground, banned consumer vape April 2021.
• DHL, banned vape globally May 2021.

What’s left in 2026:

• FedEx Adult Signature 21+ via specialty broker, FedEx still ships if you go through an approved 3PL broker that handles signature, adult-verification, and PACT Act registration on your behalf. Cost: ~$8, $15 per shipment (vs $4, $7 USPS used to be).
• X-Delivery, vape-specialty carrier, US-only, 5-9 day delivery. Covers most ZIPs east of Mississippi well, sparse west of it.
• GoExpedited, similar to X-Delivery, better West Coast coverage.
• UDS (United Delivery Service), vape-specialty, regional (mostly Midwest + South).
• OnTrac, West Coast regional, covers CA / OR / WA / NV / AZ. Faster than national carriers but limited footprint.

How we wire it in Magento:

• Carrier-select rebuild, auto-remove USPS, FedEx Ground, UPS Ground, DHL at carrier-select for vape carts. Show only legal carriers.
• State-by-state carrier validation, not every legal carrier ships to every state. X-Delivery covers ~40 states; the others fill gaps. Validate ship-state against carrier coverage before showing rates.
• ETA expectation-setting, vape shipping is now 5-9 business days, not 2-3. Surface this on PDP + cart so customers don’t expect Amazon-speed.
• PACT Act registration check, if you ship >1 package/month of vape, you must register with the ATF + each state tax authority. We add admin warnings if registration is missing.

Wholesale is 30-60% of revenue for most vape brands. Smoke shops, vape lounges, and gas-station convenience chains all buy case quantities (12-pack disposables, 48-pack pods) at trade pricing.

The B2B layer needs:

• Tax-exempt resale certificate verification, each state has its own form (CA: BOE-230, TX: 01-339, NY: ST-120, FL: DR-13). Wholesale buyers upload, admin verifies, customer-group flips to “tax-exempt-wholesale”.
• Net-30 invoicing, via Apruve, Resolve, or TreviPay. They underwrite the credit, pay you on day 1, customer pays them on day 30. Cost: 1.5-3% of invoice value.
• Tier-priced case-quantity catalogs, hidden from DTC visitors. Wholesale sees 12-pack at $48 (vs DTC retail $96). Same SKU pool, customer-group-based price visibility.
• Line-sheet PDF export, auto-generated catalog PDFs with case pricing + MOQs for wholesale rep sales calls.
• Minimum order quantities (MOQ), $500 case-pack minimum is typical. Cart validates against MOQ before checkout.
• ATF + state tax registration check, PACT Act requires sellers register with ATF + state tobacco tax authority. Buyer must also be registered. We add a compliance gate that requires both registrations on file before wholesale account activates.

One Magento instance handles both DTC and wholesale, shared inventory, separate price visibility, separate checkout flow (DTC = card, wholesale = ACH + Net-30). On Adobe Commerce use native B2B Companies module; on Open Source use customer-group price rules + extensions (Aheadworks, Amasty, Magenest).