Wednesday, October 21, 2026
News For Internet Marketers
Analysis. Stripe's Prohibited and Restricted Businesses page, updated September 22, 2026, says U.S. merchants selling electronic tobacco may only sell FDA-authorized products. Shopify Payments prohibits tobacco outright, and PayPal's 2022 policy puts e-cigarettes in pre-approval.
UPS's hemp shipping page says raw hemp shipments must contain a Certificate of Analysis showing total THC, including THCA, of no more than 0.3% on a dry weight basis from December 11, 2026, the same day most of the new federal hemp definition takes effect.
Shopify opened Shop MCP on October 13 so AI agents can search Shopify Catalog and check out with Shop Pay. Sellers of age-restricted and regulated products have reason to review how their listings, age checks, and order controls work when an agent does the buying.
Enforcement of Pennsylvania's Act 57 began October 19, 2026. Nicotine vapes not on the Attorney General's ENDS directory can be seized, first violations cost $500 per unit, and nicotine-free products sold under a nicotine brand name must be listed too.
Authorize.Net full-card exports need an owner-approved, fee-based request that can take three weeks, NMI imports only through affiliate-initiated PGP files and charges at least $500 to export, and neither gateway imports subscription schedules.
Firearm and other regulated merchants that authorize at checkout and capture after FFL transfer or backorder release need Authorize.Net's 30-day unsettled ceiling, NMI's processor-dependent auth windows, and tested reauth plus customer notices before holiday volume.
BigCommerce lists native NMI and Authorize.Net connections for specialty MIDs when platform rails drop regulated catalogs. The Payments API table shows Authorize.net vaulting support and NMI raw-card-only limits, while Commerce's AUP puts highly regulated product compliance on the merchant.
When an acquirer moves a firearm or nicotine account to MCC 5723, 5993, or a new location record, Visa's April 2026 data rules and October 2026 dispute guide make the statement descriptor part of the change, with VAMP's 1.5% merchant line leaving little room for unrecognized charges.
NMI's Classic API Migration Playbook moves server-side payments from /api/transact.php to JSON endpoints such as POST /api/v5/payments/sale, with the private key alone in the Authorization header and errors returned as HTTP status codes. Keys and Collect.js tokens carry over, and the classic API stays supported.
WooCommerce 11.2 adds a date field type to the Additional Checkout Fields API, letting Checkout block stores collect a birth date and reject underage birthdays with relative limits such as -P21Y. The field is self-reported, so vape sellers still need PACT Act database verification.
