Friday, October 30, 2026
News For Internet Marketers
New Jersey's N.J.S.A. 2C:35-10f and Alabama's HB445 already bar online hemp sales, with Alabama reaching CBD and treating repeat direct shipments as a felony. Minnesota's agency shipping ban for hemp edibles was ordered dropped by an administrative judge on February 12, 2026.
Since July 1, 2026, California's SB 378 has required online hemp marketplaces, including single-brand stores offering intoxicating hemp, to run a public report mechanism with 36-hour confirmations, 14-day updates, 30-day decisions, and $10,000 per-violation penalties enforceable by any person.
USA Today's October 21 guide sends GLP-1 patients to state pharmacy license lookups, PCAB or CCE accreditation checks, and FDA's compounding actions list. An analysis of what telehealth sellers can disclose about the dispensing pharmacy to build trust and limit disputes.
The Mississippi Board of Pharmacy's October 2026 newsletter says a certificate of analysis alone does not satisfy the state's joint peptide statement, that human-use disclaimers do not prevent enforcement, and that out-of-state telehealth prescribers need a Mississippi license.
The Iowa Department of Revenue postponed publication and enforcement of its vapor products directory on October 15 without new dates. Once the list appears, unlisted products are banned at once and penalties start 21 business days later.
Judge John L. Sinatra Jr. ruled in Heeter v. James that New York's body armor purchase and sale ban violates the Second Amendment, but a 14-day stay keeps the eligible-profession and in-person rules in force for now.
New York's S.7236 took effect October 21, 2026, requiring ammunition background checks to be denied for buyers barred from owning rifles or shotguns or under extreme risk protection orders. Online orders still pass through in-state dealers.
The New Jersey Senate passed S.4635 on October 22, moving the state's hemp beverage cutoff for liquor and cannabis licensees to a federal compliance date no earlier than December 11. The online sales ban is unchanged, and S.4287 would make unlicensed marijuana and vapor sales a third-degree crime.
Sansec documented a Magecart skimmer that loads from real Google Tag Manager containers and stores Magento checkout data as fake Stripe customers. Why a CSP allowlist misses it, what PCI DSS 6.4.3 and 11.6.1 expect, and what to check.
Jotform's July Authorize.net announcement offered two sign-up paths. For supplement and hemp sellers, Gateway Only is the one to understand, from supported processors and eCheck underwriting to switching acquirers without new API keys.
