Wednesday, October 14, 2026
News For Internet Marketers
Public Law 119-103 delays most of the federal hemp redefinition to December 11, 2026, but Missouri HB 2641 and Illinois Public Act 104-463 still take effect November 12, forcing earlier cart blocks and licensed-channel rules for intoxicating hemp SKUs.
Visa Compelling Evidence 3.0 under Dispute Condition 10.4 expands on October 24, 2026 to prior purchases on the same card or associated tokens, including across merchants an acquirer processed, when qualifying data elements match.
ATF's October 9, 2026 Open Letter ends enforcement of NFA approval and registration for suppressors, short-barreled rifles and shotguns, and any other weapons, but special occupational taxes, Gun Control Act duties, and state laws still govern online FFL sales.
WooCommerce 11.2.0, released October 7, 2026, fixes CVE-2026-106608, which let shop managers take over multi-role accounts including some administrators, and adds four other security changes. 11.2.1 followed on October 9 with checkout fixes.
Gambit Security's September 22 interim report says an operator using open-source AI agents built a target list of custom-coded online stores, took more than 600,000 card records from two companies, and hid skimmer loaders in library files, Google tag blocks, and, at a U.S. firearms marketplace, product description fields.
Acquirers in California, Colorado, and New York must assign MCC 5723 to qualifying gun retailers, while Texas, Florida, Kentucky, Arkansas, and other states ban or restrict the code. The House passed H.R. 1181 on July 14, 2026 to preempt both sides, but the Senate has not acted.
DEA's final rule creating a special registration for telemedicine has been under OMB review since August 25, 2026, with a November target and no public text, while the temporary flexibilities that let practitioners prescribe Schedule II through V drugs to never-seen patients expire at the end of December 31.
DEA filed a notice on October 9 that would schedule 7-OH and mitragynine pseudoindoxyl above 1 milligram per gram or a set ratio to mitragynine, replacing its July 0.050 percent proposal, while MGM-15 and MGM-16 stay in Schedule I and Tennessee, Massachusetts, Rhode Island, and Pennsylvania draw different state lines for kratom sellers.
Stripe, Checkout.com, and Worldpay documentation puts Mastercard's requirement that recurring and other merchant-initiated charges carry the original Transaction Link Identifier on October 23, 2026. The December 1, 2026 and January 31, 2027 dates now circulating match Worldpay's schedule for lifecycle linking, and Authorize.Net and NMI have not published TLID guidance.
Shopify opened market-driven shipping to existing merchants on October 1, 2026, with every store moved by July 1, 2027. The upgrade replaces shipping profiles, which some hemp, nicotine, knife, and tactical sellers use to keep restricted products out of certain states, and changes several defaults those blocks depended on.
