Sunday, September 27, 2026
News For Internet Marketers
Federal hemp deadlines do not erase stricter state milligram caps. Virginia's 2 mg per-package rule and Minnesota's 5 mg per-serving LPHE limits show why zip-to-SKU cart matrices need versioning.
USPS generally bars consumer mailing of cigarettes, smokeless tobacco, and ENDS except narrow exceptions, while private carriers add tobacco agreements, adult signature, and vape bans. Nicotine pouch classification still turns on product facts.
Processors and card networks draw different lines between serialized firearms, ammunition, regulated parts, and non-firearm tactical accessories. Mapping SKUs to the right MCC and MID is the operational fix.
PCI SSC FAQ 1588 clarifies how e-commerce merchants using provider-hosted iframes confirm they are not susceptible to script attacks for SAQ A eligibility under PCI DSS v4.0.1.
Square told merchants to purge CBD and hemp catalog items by October 15, 2026, ahead of federal hemp dates that later shifted under P.L. 119-103. Processor calendars, not statutes, set settlement risk.
Square directed sellers to remove CBD, hemp, and hemp-derived items by October 15, 2026. Processor deadlines can arrive before federal hemp dates shift.
Shopify adds SubscriptionContractCalculation on GraphQL Admin API 2026-10 as the successor to SubscriptionDraft. Autoship apps should retest tax, payment methods, and commit handling before the stable cutover.
October 1 freezes script-tag writes, blocks updates for extensions on API 2025-07 or earlier, and makes API 2026-10 stable. Vendors must migrate before BFCM.
Meta joined Shopify Agentic Storefronts with Catalog sharing and direct checkout on by default. Restricted catalogs need an intentional toggle review.
Unauthenticated file upload CVE-2026-27540 in WooCommerce Wholesale Lead Capture is under active exploitation. Update to 2.0.3.2 and inspect uploads.
