FDA issued final guidance on May 8, 2026, clarifying how it will prioritize enforcement against unauthorized ENDS products. The guidance does not legalize products without marketing authorization. It creates a three-tier framework for inventory risk. It changes what every online vape retailer should stock. It also changes what they should verify and document.

North Carolina’s PMTA product registry went live May 1, 2026. Virginia and Wisconsin join the list on July 1. Online vape retailers that sell into these states must check their product list against each state directory. If they do not, authorities may seize their products. They may also face daily fines for each SKU.

The PACT Act (15 U.S.C. § 376a) requires online vape retailers to file monthly delivery reports. They must file reports with each state where they ship vapor products. For May 2026 sales, those reports are due June 10. Filing late, filing incomplete, or missing a state triggers per-day penalties, per state.

The UK has moved from voluntary age checks to a legislated, 2-step verification standard for every online knife sale. The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Retailers must now verify a buyer’s identity at the point of purchase and again at delivery.

Nicotine pouches and other oral nicotine products are growing fast, and the regulatory category is growing with them. The practical question for retailers, distributors, and marketplaces goes beyond whether regulators control these products. The question is which rules apply and how they differ from ENDS, combustible tobacco, and other nicotine categories.

A product may be federally unauthorized or ineligible for a state directory. It may be under review, subject to a stay, listed, delisted, or in litigation. Even then, a retailer may still need a fast answer on stocking or selling it.

The PACT Act (15 U.S.C. § 376a) sets strict federal rules for all online retailers shipping vapor products to U.S. customers. It covers ATF registration, monthly delivery reporting to state tax authorities, age verification at checkout, adult signature on delivery, and certified carrier agreements.

Two separate federal legal frameworks and one New York state law now require age and identity verification at the point of each transaction. Not at account creation. Not at first login. Every order.

The FDA just issued its first-ever PMTA authorization for non-tobacco, non-menthol flavored ENDS products. This is a real regulatory first. The access controls behind these authorizations are an important signal for the industry.

Running a compliant tobacco retail operation in 2026 is not a single checklist you print and laminate. It is a branching set of obligations that changes based on what you sell, where you sell it, and who walks through your door.