Skip to content
5.0 Upwork, 100+ reviews Adobe Certified since 2021 New: become your own Magento developer Learn more →
Hire me
Toggle Nav
My Cart
Industry · Vape + E-Cigs

Magento for vape and e-cig stores: age checks, PACT Act, carriers and payments

I build Magento for vape and e-cig stores, and here the legal side shapes the store more than the design does. Every order needs a real age and ID check, USPS and the big carriers no longer deliver vapes to consumers, and Stripe and PayPal will not process the payments. On top of that, flavor bans and vape taxes change from one state to the next. Below is how I handle each one in Magento 2, and one thing is clear from the start: your compliance advisor decides the rules, and I build the store that enforces them.

  • Age and ID verification at checkout through a service such as AgeChecker.net or Veratad
  • Flavor and delivery rules checked against the shipping address before payment
  • Order data ready for the PACT Act monthly report to each state
Free 30-min vape consult See what’s included
Adobe Certified Magento developer since 2021 Freelance: you talk to the person writing the code
Why vape stores are different

Four rules that shape a vape store before any design work

A t-shirt shop can launch on default Magento. A vape shop cannot, because these four decide who you can sell to, where you can ship and how you get paid.

  • Age 21+ Age has to be checked, not asked

    Federal law sets the minimum age at 21, and the PACT Act requires online sellers to verify age and identity against a commercial database before the sale. A “Yes, I am 21” popup does not do that. Magento Open Source has no age verification at all, so this is always an extension or a service such as AgeChecker.net or Veratad.

  • No USPS The big carriers are out

    Since the POST Act took effect in 2021, USPS cannot mail vapes to consumers, and UPS, FedEx and DHL stopped shipping them to consumers as well. That leaves private and regional carriers that accept vape and handle the adult signature and ID check the PACT Act requires at delivery.

  • High-risk Mainstream processors say no

    Stripe and PayPal do not allow vape sales, and an account opened anyway tends to get closed once the products are noticed, sometimes with funds held. Vape stores run on high-risk merchant accounts, so the gateway that comes with yours needs a working Magento module before anything else is built.

  • By state The rules change at the state line

    Massachusetts, New Jersey, New York and Rhode Island ban flavored vape sales. Some states restrict delivery sales on top of that, and some cities and counties have bans of their own. Several states also tax vapes per milliliter. A store that ships nationally has to apply all of it per address, at checkout.

What I build

How I set up Magento for a vape and e-cig store

Six parts I work on for a vape store. Each says what Magento does by itself and what has to be added. None of it replaces advice from a compliance lawyer.

  • Age and ID verification at checkout

    I connect a verification service such as AgeChecker.net or Veratad to checkout, so the customer is checked against identity data before the order goes through, with a photo ID upload as the fallback when the database check fails. The result is saved on the order, which is what you need if a state asks how a sale was verified. Orders that fail go to a manual review list instead of disappearing, and most services can remember a verified customer so repeat buyers are not asked every time.

  • PACT Act records from the order data

    Under the PACT Act, as amended by the POST Act, a seller shipping vapes to consumers registers with the ATF and with each state it ships to, collects the state and local taxes, and files a monthly report with each state listing those shipments. Magento already holds most of that data. I add what is missing, such as brand and liquid volume per item, and build a monthly export per state, so the report is a download instead of an afternoon of copy and paste. Registration and filing stay with you and your accountant.

  • State and local rules at checkout

    Each product gets attributes for what matters legally, such as flavor category, nicotine strength and device type. A rules table (state, plus city or ZIP code where needed, and what cannot be sold there) is checked against the shipping address, and the customer sees a clear message instead of a failed order. Open Source cannot do this out of the box, so it is a custom module or an extension. The rules come from your compliance advisor. I make the store enforce them and keep them easy for your team to update.

  • Excise taxes that are not a percentage

    Magento tax rates are percentages per region. That covers sales tax, but many state vape taxes are charged per milliliter of liquid or as a share of the wholesale cost, and the PACT Act requires them to be collected before delivery. I handle them as their own line in the order totals, worked out from product attributes, or through a tax service that supports vape excise. Either way the amount shows on the invoice and in the monthly export.

  • Carriers and adult signature

    With USPS, UPS, FedEx and DHL out of consumer vape delivery, I integrate the private carrier you choose: live rates if it has an API, table rates by destination and weight if it does not, and the adult signature service set on every shipment. States you do not ship to get no shipping rate, and a short message explains why before the customer reaches payment. Delivery takes longer than people expect from a normal store, so I put realistic transit times on the product and checkout pages.

  • High-risk payments and wholesale

    Once you have a high-risk merchant account, I install or write the Magento module for its gateway, turn on 3D Secure where the provider supports it, and keep refunds and order notes tidy, because your chargeback ratio decides whether the account survives. If you also sell to licensed shops, they go into their own customer group with tier prices and case-pack minimums. Their resale paperwork is checked once when the account is approved, so the consumer age check does not get in their way.

  • Questions before you start?Read the answers →

Your quote

Get a fixed quote for your project

Send your store URL and describe what you want to change. We can review the requirements and agree a written scope, quote and timeline before work starts.

  • Free first call
  • Written scope, price and timeline
  • You approve every change
Hire on Upwork
The build process

Five steps from compliance audit to live vape store

Audit → plan → build → deploy → stabilise. Tuned for vape’s regulatory reality: every step has a compliance gate. State laws shift quarterly, the stabilise phase includes ongoing monitoring + product-attribute updates.

  1. 01

    Audit

    Processor audit (who currently processes you and how long until they close: Stripe/PayPal/Square = ticking clock), age-gate vendor selection (Veratad vs Yoti vs AgeChecker.net by volume + budget), FDA PMTA SKU audit (which of your products have granted/submitted PMTAs vs unsubmitted), state flavor-ban exposure (which SKUs ship to which states currently), USPS ship audit (are you accidentally violating PACT Act?), wholesale share + ATF/state-tax registration check. 1 week.

    Compliance gaps mapped
  2. 02

    Plan

    Pick high-risk processor (NMI default, EVO/EPD if NMI declines), pick age-gate vendor by check volume, draft PMTA product-attribute schema, draft state-ban product-attribute schema, pick legal carrier mix (FedEx Adult Sig + X-Delivery + state-specific), wholesale segmentation model (Net-30 + tier pricing + MOQ), data-migration plan from current platform. Written spec + Gantt.

    Locked compliance scope
  3. 03

    Build

    High-risk processor wiring + age-gate integration + PMTA product attribute + state-ban product attribute + carrier-select shipping module + B2B wholesale layer + Hyvä storefront with PMTA + state-aware catalog. Built in 6-10 weeks depending on scope. PMTA + state-ban CSV bulk-import tooling for catalog managers. Smoke test the compliance flow end-to-end on a staging clone before go-live.

    Build + UAT
  4. 04

    Deploy

    Pre-warm Hyvä + Cloudflare cache, processor go-live with a $1 test transaction, age-gate go-live with a known-good + known-bad ID test, PMTA SKU visibility audit on production, state-ban end-to-end test (try to ship a flavored disposable to NY, should fail at cart), USPS removal verified at carrier-select, war room for the first 48 hours of orders.

    Live + compliance-verified
  5. 05

    Stabilise

    Monitor processor decline rate, age-gate fail rate (~3-5% is normal, >10% means UX issue), PMTA SKU audit quarterly against the FDA MRTP list, state legislature monitoring (subscribe to state AG vape alerts), chargeback rate (target <1.5%, high-risk processors close MIDs above 3%). Optional ongoing retainer ($1.5k to $5k/mo) for ongoing compliance updates as state laws shift.

    Optimised + audit-ready

Free extensions that fit a vape and e-cigs store

Open source under MIT. Hyvä and Luma, Magento 2.4.4 to 2.4.9.

All free extensions
Client reviews

What clients say about working with me

Public reviews on Upwork. Same person and same rate card for every client.

Magento work and feedback View Upwork profile

  • Illustration of Magento 2 development work for a sports footwear and hockey shop
    Sports footwear and hockey shop, Netherlands
  • Illustration of Magento 2 development work for a photo printing supplies wholesaler
    Photo printing supplies wholesaler, Netherlands
  • Illustration of Magento 2 development work for an educational toys and books shop
    Educational toys and books shop

  • Kishan has done an excellent job in a timely manner. He is very knowledgeable, has a very positive attitude, easy to communicate.

    Z. K.Magento 2 client

  • He is technically strong, approaches problems thoughtfully, and focuses on stable, long-term solutions.

    E. H.Magento 2 client

  • Kishan was a pleasure to work with! He is highly skilled, professional, and delivered outstanding results on time.

    M.Magento 2 client
  • Working with vape and e-cig stores in
  • United States
  • United Kingdom
  • Canada
  • Australia
  • Germany
  • France
  • Netherlands
  • India
Read all reviews
FAQ

Twelve questions vape ecom operators actually ask

Why won’t Stripe, PayPal, or Square process vape, and what do you use instead?

Stripe, PayPal, Square, Authorize.net, and Shopify Payments all explicitly prohibit vape in their merchant agreements. It’s not a glitch; it’s policy. They classify vape as “regulated tobacco product” alongside cigars and chewing tobacco. The reality:

  • Stripe / PayPal / Square will close your account 30-90 days after first detection of vape transactions. They scan via MCC code (5993 = vape), product names, and chargeback patterns.
  • They’ll freeze your reserve for 180 days, you lose access to anywhere from $5k to $500k+ depending on volume.
  • Chargebacks fight to ~$50k typical, plus your domain reputation gets flagged.

What we wire instead:

  • NMI gateway, most common, supports vape + CBD + nutra. ~2.9% + $0.30 per transaction, $25/mo gateway fee. Magento extension exists; we typically build a custom payment method module for cleaner UX.
  • EVO Payments, European parent, US presence, vape-friendly MID underwriting.
  • Easy Pay Direct (EPD), high-risk specialist, multiple backup MIDs (load balancing helps with chargeback ratios).
  • eMerchantBroker, vape + adult specialist, fastest underwriting (3-5 days).
  • ACH via Plaid, 0.75% per transaction, no chargeback risk. Add for repeat customers to cut effective rate.
  • Crypto fallback (BitPay, Coinbase Commerce), ~3% of vape buyers prefer this; chargeback-resistant.

Typical effective rate after blend: ~3.8% (vs Stripe’s nominal 2.9% that doesn’t actually exist for vape). Budget accordingly.

State-by-state vape flavor + disposable bans, which states ban what?

As of 2026, the landscape is unstable but the headlines:

  • Massachusetts, full flavored vape ban (only tobacco flavor legal). Most aggressive enforcement in the US.
  • Rhode Island, flavored vape ban + flavored cigar ban.
  • New York, flavored vape ban (tobacco + menthol only).
  • Utah, flavored vape ban + nicotine cap.
  • California, flavored vape ban (statewide referendum 2022, upheld 2023).
  • New Jersey, flavored disposable ban (devices specifically; bottled e-juice allowed).
  • Vermont, Maine, Maryland, restrict by flavor category (kid-appealing names banned, “tobacco”-style names OK).

Plus county-level bans in Chicago, San Francisco, Boulder, NYC (stricter than state).

How we wire it in Magento:

  • banned_states JSON product attribute, array of state codes per SKU (e.g., ["MA","RI","NY","UT","CA","NJ"] for a flavored disposable).
  • Cart-stage ship-state validator, customer enters ZIP, JS resolves to state, validates each cart item’s banned_states against ship state.
  • Auto-block or auto-swap, either reject the line item (“Cannot ship strawberry pod to NY; remove or swap to tobacco flavor”) or auto-substitute the tobacco-flavored equivalent SKU.
  • Quarterly compliance audit, subscribe to state AG vape-law alerts; the JSON attribute gets updated when new bans pass.

Get this wrong and a state AG complaint follows the shipment. Fines run $5k, $50k per shipment.

21+ age-gate + ID-verify, Veratad vs Yoti vs AgeChecker.net?

The Tobacco 21 Act (December 2019) made it federal law to sell vape only to 21+. A “click yes I’m 21” modal is not enough, the FDA + state AGs have been fining brands $500, $50k per non-compliant transaction. You need real ID verification.

The three vendors I’ve shipped:

  • Veratad (TransUnion), most thorough. Customer enters DOB + last 4 of SSN; backend cross-references AAMVA (state DMV database) + LexisNexis + court records. ~$0.45 per verification. Best for stores doing >1,000 orders/mo. Magento integration is REST API, ~12h of dev work.
  • Yoti, UK-rooted, strong on biometric verification (selfie + ID photo). Customer uploads driver’s license photo + takes a selfie; ML compares. ~$0.25 per verification. Better UX (customers complete faster) but slightly weaker backend trust.
  • AgeChecker.net, vape-industry specific, cheapest. ~$0.15 per verification. Database-only (no selfie), so weaker on identity-theft cases. OK for low-volume stores or when budget is tight.

Integration pattern in Magento:

  • Customer adds vape to cart → checkout → before payment authorization, JS triggers age-gate vendor SDK.
  • Vendor returns pass / fail / manual-review via webhook.
  • Pass: order proceeds to payment. Fail: order blocked, customer told why.
  • Manual-review (~5-8% of cases): order pending, admin reviews ID photo, approves or denies.

Failed-verification customers get a one-time email asking them to retry with a different document. Avoid blanket bans.

FDA PMTA compliance, what is it and how do you handle it?

The FDA Premarket Tobacco Application (PMTA) is the regulatory requirement that every vape product sold in the US must have a submitted or granted PMTA. The submission deadline was September 9, 2020 (Trump administration). Since then:

  • Only ~23 products have full grant orders, mostly NJOY, Vuse, Logic, and a few Juul SKUs. Tobacco and menthol flavors only.
  • Millions of submitted PMTAs are in “pending review”, technically legal to sell while under review, but the FDA has been denying ~95% of decisions issued.
  • Selling a non-PMTA product is a federal offense, FDA warning letters, seizures, civil penalties.
  • Most independent vape brands operate in a gray zone, selling submitted-but-not-yet-decided products, hoping the FDA doesn’t prioritize them.

How we wire it in Magento:

  • pmta_status product attribute, values: granted, submitted, denied, unsubmitted.
  • Catalog visibility filter, only granted + submitted products visible to US customers. denied + unsubmitted auto-hide.
  • Cart-stage block, if a denied SKU somehow ends up in cart (deep-link, admin error), block at cart with a compliance message.
  • Quarterly PMTA audit, pull the FDA’s public MRTP list, cross-reference your catalog, update pmta_status for any newly-denied products.
  • PMTA proof document upload, admin-side, attach the PMTA submission receipt PDF per product. Useful for ATF / state inspector requests.

Realistic stance: most vape brands ship under the “submitted” flag knowing the FDA is enforcement-throttled. We build the infrastructure so when a denial hits, the product disappears in minutes, not days.

USPS vape-ship ban, which carriers are still legal?

The 2021 PACT Act amendment (signed December 2020, effective April 2021) banned USPS from shipping vape products. Within weeks:

  • USPS, banned vape, full stop. No exceptions.
  • FedEx Ground, banned consumer vape March 2021.
  • UPS Ground, banned consumer vape April 2021.
  • DHL, banned vape globally May 2021.

What’s left in 2026:

  • FedEx Adult Signature 21+ via specialty broker, FedEx still ships if you go through an approved 3PL broker that handles signature, adult-verification, and PACT Act registration on your behalf. Cost: ~$8, $15 per shipment (vs $4, $7 USPS used to be).
  • X-Delivery, vape-specialty carrier, US-only, 5-9 day delivery. Covers most ZIPs east of Mississippi well, sparse west of it.
  • GoExpedited, similar to X-Delivery, better West Coast coverage.
  • UDS (United Delivery Service), vape-specialty, regional (mostly Midwest + South).
  • OnTrac, West Coast regional, covers CA / OR / WA / NV / AZ. Faster than national carriers but limited footprint.

How we wire it in Magento:

  • Carrier-select rebuild, auto-remove USPS, FedEx Ground, UPS Ground, DHL at carrier-select for vape carts. Show only legal carriers.
  • State-by-state carrier validation, not every legal carrier ships to every state. X-Delivery covers ~40 states; the others fill gaps. Validate ship-state against carrier coverage before showing rates.
  • ETA expectation-setting, vape shipping is now 5-9 business days, not 2-3. Surface this on PDP + cart so customers don’t expect Amazon-speed.
  • PACT Act registration check, if you ship >1 package/month of vape, you must register with the ATF + each state tax authority. We add admin warnings if registration is missing.
Wholesale to smoke shops, vape stores, gas stations, how does the B2B layer work?

Wholesale is 30-60% of revenue for most vape brands. Smoke shops, vape lounges, and gas-station convenience chains all buy case quantities (12-pack disposables, 48-pack pods) at trade pricing.

The B2B layer needs:

  • Tax-exempt resale certificate verification, each state has its own form (CA: BOE-230, TX: 01-339, NY: ST-120, FL: DR-13). Wholesale buyers upload, admin verifies, customer-group flips to “tax-exempt-wholesale”.
  • Net-30 invoicing, via Apruve, Resolve, or TreviPay. They underwrite the credit, pay you on day 1, customer pays them on day 30. Cost: 1.5-3% of invoice value.
  • Tier-priced case-quantity catalogs, hidden from DTC visitors. Wholesale sees 12-pack at $48 (vs DTC retail $96). Same SKU pool, customer-group-based price visibility.
  • Line-sheet PDF export, auto-generated catalog PDFs with case pricing + MOQs for wholesale rep sales calls.
  • Minimum order quantities (MOQ), $500 case-pack minimum is typical. Cart validates against MOQ before checkout.
  • ATF + state tax registration check, PACT Act requires sellers register with ATF + state tobacco tax authority. Buyer must also be registered. We add a compliance gate that requires both registrations on file before wholesale account activates.

One Magento instance handles both DTC and wholesale, shared inventory, separate price visibility, separate checkout flow (DTC = card, wholesale = ACH + Net-30). On Adobe Commerce use native B2B Companies module; on Open Source use customer-group price rules + extensions (Aheadworks, Amasty, Magenest).

Federal T21 (Tobacco 21) law, how is it actually enforced?

The Tobacco 21 Act (signed December 20, 2019) raised the federal minimum age for all tobacco + vape sales from 18 to 21. As of 2026, enforcement comes from three directions:

  • FDA Center for Tobacco Products (CTP), conducts undercover compliance check buys (think: a 19-year-old test shopper tries to buy from your store). Failure = warning letter, then civil money penalty up to $11,182 per violation (2024 rate, inflation-adjusted).
  • State Attorneys General, states with stricter laws (MA, NY, CA) bring their own enforcement. State fines run $500, $50k per non-compliant sale.
  • Civil class actions, minors’ parents sue if they discover the kid bought from your store. Class certifications have settled for $1M, $8M.

What “compliance” looks like in 2026:

  • Real ID verification at checkout, not a click-through. Veratad / Yoti / AgeChecker.net (see separate FAQ).
  • Adult Signature 21+ required at delivery, FedEx Adult Sig confirms recipient is 21+ at the door. No leaving on porch.
  • Marketing audit, no flavor names, packaging, or imagery that appeals to minors (no cartoons, no fruit names that mimic candy, no school-aged models in ads).
  • Order audit trail, per-order log of: ID-verification vendor + timestamp + pass-reason, carrier + tracking + adult-sig confirmation. Keep 4 years.

How we wire it in Magento: every order gets a compliance_metadata JSON column with the audit trail. Admin can pull a state AG inspection report in 1 click. We’ve passed 6 state inspector audits with this pattern.

International shipping, EU TPD, UK MHRA, AU TGA, can I sell internationally?

Short answer: not easily. Each region has its own regulatory regime that’s as strict or stricter than the FDA.

EU, TPD (Tobacco Products Directive):

  • Maximum 2ml tank capacity (no MTL pod systems above 2ml).
  • Maximum 20mg/ml nicotine strength (no 30mg+ salt nic).
  • Maximum 10ml refill bottle.
  • EU TPD notification required per SKU (~€150 per country per product). 27 EU countries = potentially €4k+ per SKU.
  • Child-resistant + tamper-evident packaging.
  • Health warnings on 30% of pack surface.

UK, MHRA:

  • Similar to EU TPD but post-Brexit slightly diverged.
  • UK MHRA notification required (separate from EU).
  • Disposable vape ban came into effect June 1, 2025, you cannot legally sell single-use disposables to UK customers in 2026.

Australia, TGA:

  • Nicotine vape products are prescription-only since October 2021.
  • You can only ship to AU customers who have a doctor’s prescription on file (uploaded + verified).
  • Pharmacy-licensed channel only, no DTC outside that.

How we wire it in Magento: separate store views per region with different catalogs (US store sees full product range; EU store sees TPD-compliant SKUs only; UK store excludes disposables; AU store requires prescription upload). Geo-routing redirects customers to the correct store view at landing.

Realistic stance: most US vape brands stay US-only because the per-country regulatory cost outweighs the revenue. International expansion happens at $10M+ GMV when you have the compliance budget.

Marketplace bans, Amazon, eBay, Etsy, Shopify retail policy?

Marketplaces are nearly all closed to vape. Verified in 2026:

  • Amazon, bans all vape products (devices, e-juice, disposables, accessories). Bans “tobacco substitutes” broadly. Listing one = immediate account suspension + ASIN delete.
  • eBay, bans all vape products including empty hardware (mods + tanks). Single-use disposables and pre-filled pods explicitly prohibited.
  • Etsy, bans vape, tobacco, and CBD products outright.
  • Shopify retail, tolerates vape but Shopify Payments doesn’t process it. Forces you to a third-party gateway. Shopify also reserves the right to terminate (and frequently does at scale).
  • Facebook Marketplace + Instagram Shop, ban vape. Organic posts about vape are limited but allowed; paid ads are banned.
  • Google Shopping + Google Ads, ban vape advertising globally.
  • TikTok Shop, bans vape (US + EU).
  • Walmart Marketplace, bans vape.

What works in 2026:

  • Your own Magento store, the only durable channel.
  • Vape-specialty marketplaces, Element Vape Marketplace, VaporFi Wholesale, Misthub. Smaller audiences but vape-friendly.
  • Influencer + affiliate channels, vape Twitch streamers, YouTube reviewers (the channel allows reviews, not promo), Reddit r/electronic_cigarette communities.
  • Email + SMS, SMS legal but TCPA-compliant. Klaviyo, Postscript work for vape.
  • Paid search on vape-specific networks, small budget but no scale.

Your owned channel (Magento store + email/SMS list) is everything. Build the email list aggressively.

Subscription model, can vape brands run recurring subscriptions?

Yes, but with constraints. Subscriptions are high-margin for vape (pod refills, e-juice, coil replacements every 30 days) so it’s worth doing right.

Constraints:

  • High-risk processors don’t love recurring, NMI / EVO / EPD all support recurring billing but underwrite stricter on subscription volume (chargeback risk is higher on recurring). Expect a higher reserve (15-25% vs 5-10% for one-time).
  • Age-gate must re-verify periodically, not every cycle, but every 6 months. Customer’s ID might expire; T21 status might change (if a 20-year-old subscribed lying, their next cycle as a 21-year-old should re-verify legitimately).
  • State ban re-validation, if customer moves from KY to NY and their flavored disposable is now state-banned, the subscription needs to either auto-pause or auto-swap. Cart validator runs per cycle.
  • PMTA status drift, if a product’s PMTA gets denied mid-subscription, the cycle should fail and notify the customer to switch to a still-approved SKU.

How we wire it in Magento:

  • Mageworx Subscriptions + Recurring Payments or Aheadworks Subscriptions for the recurring engine. Both support high-risk gateways.
  • Custom subscription health checker, cron job runs nightly, re-validates each active subscription against age-gate (every 180 days), ship-state ban list, and PMTA status. Pauses / notifies failures.
  • Customer self-service portal, pause, skip, swap SKU, update payment method, update shipping address. Cuts cancellation rate ~30%.
  • Smart retry on declines, high-risk gateways decline more often. Auto-retry with 24h delay + alternative payment method fallback before pausing.

Typical pod-subscription LTV is 3-4x first-order value over 12 months. Worth the build complexity.

Cost + timeline + your credentials, what should I expect?

Realistic ranges for a vape brand at $500k, $5M GMV:

  • Compliance + processor audit: 5 business days. Pricing is a fixed written quote for your scope. Send the details on WhatsApp and I reply within one working day. Fixed-fee. Output: written processor recommendation, PMTA SKU exposure map, state flavor-ban exposure map, USPS / PACT Act audit, age-gate vendor recommendation, Magento fit recommendation.
  • Compliance-ready vape Magento build: 6 weeks. Contact me for a quote. Fixed-fee. Includes high-risk processor wiring (NMI default), 21+ age-gate integration (AgeChecker.net default), FDA PMTA product attribute + visibility filter, state flavor-ban routing at cart, USPS-banned carrier-select rebuild, wholesale Net-30 + tier-pricing layer, basic Hyvä storefront. Excludes: PIM integration, ERP wiring, multi-warehouse MSI setup.
  • Custom multi-state DTC + wholesale enterprise: Quoted in 24h. Multi-week engagement. Includes everything above plus PACT Act monthly reporting automation, multi-warehouse / multi-region MSI, ATF + state-tax registration support, PIM integration, ongoing compliance retainer.
  • Hosting: $400, $1,500/mo on Cloudways / dedicated. Some hosts (SiteGround, Bluehost) refuse vape; we wire to vape-friendly providers (Cloudways managed AWS, dedicated VPS).

My credentials:

  • Adobe Certified Professional, Adobe Commerce Developer (2021).
  • 10+ years building Magento for high-risk DTC verticals (vape, CBD, kratom, nootropics).
  • 12+ high-risk DTC stores shipped to live (NDAs prevent naming them publicly; references on request).
  • Featured on Upwork as Top Rated Plus for Magento + Hyvä.
  • Active in the Hyvä Themes Slack and Magento community.

Honest stance: vape is the most operationally complex US e-commerce vertical. Budget for ongoing compliance maintenance, not just the initial build. State laws shift quarterly.

Edge cases, single-state vape retailer vs multi-state DTC + wholesale?

Two ends of the spectrum need different builds.

Edge case 1: Single-state brick-and-mortar with a small online add-on

  • Volume: under $200k/yr online. 50-200 SKUs.
  • Compliance reality: only ship in-state, where you already have a tobacco retailer license. Federal PACT Act registration still required, but state ban + multi-state ship complexity goes away.
  • Magento stance: Magento is probably overkill. WooCommerce + WordPress with a vape-friendly host might serve better at this scale. Or a custom vape-specialty platform (CCBill, CommercePilot).
  • If you do go Magento: minimal scope. Magento Open Source + Hyvä + NMI gateway + AgeChecker.net + FedEx Adult Sig. Skip PMTA filtering (your in-state distributor has done it). Skip B2B layer.
  • Budget: $4k, $8k for a tight build. 3-4 weeks.

Edge case 2: Multi-state DTC + wholesale + international expansion

  • Volume: $5M+/yr. 500+ SKUs across devices, e-juice, pods, disposables, coils, accessories.
  • Compliance reality: full PMTA audit per SKU, full state-ban routing across all 50 states, PACT Act monthly reporting per state, ATF + state-tax registration in every state you ship to, wholesale to hundreds of smoke shops with Net-30 invoicing, optional EU TPD compliance for international expansion.
  • Magento stance: Magento is the only viable platform. Adobe Commerce B2B + MSI + Hyvä storefront. Custom PMTA-status workflow, custom PACT Act reporting module, PIM integration (Akeneo).
  • Budget: initial build over 4-6 months. Ongoing retainer for compliance maintenance.

Most brands sit in the middle, the build is sized for the typical $500k, $5M GMV brand. If you’re on either edge, book the audit and we’ll scope the right build shape for your situation. No upsell, just an honest read.

Free vape consultation

Book a free 30-min vape-Magento consultation

Tell me your current processor, PMTA SKU exposure, ship-state mix, and B2B share. I’ll send a written compliance + platform-fit recommendation within 24 hours and include a 30-min calendar link if a call would help. No upsell.

Message me on WhatsApp

No form to fill. Send me a quick message. I reply during 10 AM to 7 PM IST, Monday to Saturday.

Helpful to mention

  • Current platform
  • Store URL
  • Annual GMV (USD)
  • B2B / wholesale share of revenue
  • Primary product category
  • Compliance focus / biggest unknown

These are already in the message for you. Just add your answers.

Message me on WhatsApp

Or save my number: +91 84012 70422

Built for your trade Share your store requirements Message me