Can I run any paid ads at all — age-gated, nicotine-free, or for authorized products?

On the major platforms, no. Google prohibits products designed to simulate smoking regardless of nicotine content; Meta's prohibition explicitly includes nicotine-free vapes; TikTok bans both the ad content and the landing page. FDA marketing authorization does not unlock any of these platforms — their policies are categorical, not compliance-conditional. Meta's cessation carve-out covers only FDA/WHO-approved cessation products, which no consumer vape is. Attempting to slip through review risks permanent account loss, which is far more expensive than never running the ads.

Is direct-to-consumer vape shipping still legal in 2026?

Legal, but operationally narrow. USPS declared ENDS nonmailable in October 2021, with limited exceptions (notably business-to-business shipments between verified entities, which require applying to USPS, and intrastate Alaska/Hawaii). UPS prohibits vaping products across its US network regardless of nicotine content, and FedEx does not accept e-cigarettes. DTC fulfillment therefore runs through regional and specialty carriers that offer adult-signature service — at higher per-parcel cost — while the PACT Act layers on registration, package labeling, excise tax collection, and monthly state reports. Many operators structure wholesale B2B (where the USPS exception can apply) separately from DTC for this reason.

What does PACT Act compliance actually require of my website, as opposed to my back office?

More than most carts can do out of the box. Before an order is accepted, the buyer's age must be verified against a commercially available database — that is a checkout integration, not a popup. The destination address must drive excise tax calculation and, practically, catalog availability for flavor-ban and registry states. Package labeling requirements and adult-signature shipping methods must be selected automatically. And because sellers must keep four years of records organized by state and file monthly reports with state tax administrators, the order pipeline should be designed to emit that reporting data as a byproduct rather than reconstructed manually.

Do my products need to be on FDA's authorized list to sell online?

Federal law permits marketing only for products with an FDA order — currently 45 e-cigarette products across five manufacturers (Vuse, JUUL, NJOY, Logic, Glas). The wider market has operated for years under staggered enforcement, but the exposure is real and growing: FDA has issued marketing denial orders on the overwhelming majority of applications, and more than a dozen states have passed registry laws that make directory listing a hard condition of sale, with state-level enforcement against retailers. Whatever you stock, your copy must reflect reality — never describe an unauthorized product as FDA approved, and expect processors and carriers to ask about authorization status during underwriting.

Verticals / Vape & Nicotine

Vape & Nicotine

Every ad platform is closed to you. The mail is closed to you. The demand is not.

Vape and nicotine is the most locked-out vertical in US e-commerce. The three ad platforms that drive most consumer demand — Google, Meta, and TikTok — prohibit vape advertising outright. The US Postal Service declared vaping products nonmailable in 2021, and UPS and FedEx followed with their own prohibitions, so direct-to-consumer fulfillment runs on a patchwork of specialty carriers. Mainstream payment processors treat the category as restricted or prohibited. And underneath all of that sits a regulatory stack — FDA premarket authorization, federal Tobacco 21, the PACT Act, state flavor bans, and a fast-growing set of state product registries — that most web agencies have never read.

That combination changes what a website is for. In a normal vertical, the site is a landing surface for paid traffic. In this one, the site is the entire acquisition engine and a large part of the compliance apparatus: it has to win organic search because nothing else scales, and it has to execute age verification, state-by-state catalog logic, tax collection, and federally mandated warning statements because the law treats a delivery seller's storefront as the point of sale.

zsty builds sites for verticals where paid channels do not exist. This page lays out the current platform, shipping, payment, and compliance landscape for vape and nicotine operators as of mid-2026, with primary sources for every claim. It is operational analysis, not legal advice — verify specifics with counsel before acting.

Where the ad platforms stand

Google AdsBanned

Google's Tobacco policy prohibits ads for tobacco products, for components and accessories that facilitate tobacco consumption, and for products designed to simulate smoking — explicitly listing electronic cigarettes and e-cigarettes. There is no carve-out for nicotine-free liquid, age-gated targeting, or authorized products; the prohibition applies across Search, Shopping, and Display. Google issues a warning at least seven days before account suspension, but repeated violations end the account.

policy source →

Meta (Facebook/Instagram)Banned

Meta's ad standards state that ads must not promote the sale or use of tobacco or nicotine products and related paraphernalia — covering e-cigarettes and vapes including nicotine-free versions. The only adjacent exception is for smoking-cessation products approved by the FDA or WHO, targeted 18+, which does not cover any vape product sold as a consumer good.

policy source →

TikTok AdsBanned

TikTok's Dangerous Products or Services policy prohibits ad content and landing pages that show, promote, or sell tobacco or nicotine products, explicitly including e-cigarettes, vape pens, vape oils and cartridges, and smoking paraphernalia such as vaporizers. The prohibition extends to the landing page itself, so even indirect creative pointing at a vape storefront fails review.

policy source →

What closed paid channels do to the economics

With Google, Meta, and TikTok closed, the paid-acquisition arithmetic that most DTC brands live on simply does not exist here. There is no CAC-to-LTV dial to turn — customer acquisition is a function of organic search position, direct traffic, referral, and retention. That cuts both ways: acquisition is slower to start, but a page-one organic position in this vertical faces no auction pressure from competitors' ad budgets, and it cannot be repriced by a platform. Meanwhile the cost stack under each order is heavier than in normal e-commerce: high-risk processing rates and reserves, PACT Act registration and monthly state reporting overhead, state excise tax collection, and adult-signature delivery through specialty carriers instead of commodity ground rates.

The practical consequence is that vape economics reward operators who treat the website and the repeat-purchase base as capital assets. First orders often carry thin or negative margin once verification, processing, and signature-delivery costs land; the business works on reorder frequency through owned channels — email, loyalty, subscription — that no platform can revoke. A storefront that keeps its processor, keeps its carrier relationship, and compounds organic rankings is a moat precisely because so many competitors lose one of the three.

Compliance is site architecture

Age verification is transactional, not decorative
Federal law sets the minimum age of sale for all tobacco products, including e-cigarettes, at 21 (Tobacco 21, effective December 2019). For delivery sales, the PACT Act (15 U.S.C. § 376a) goes further: the seller must verify the purchaser's age against a commercially available database before accepting the order, and the carrier must obtain an adult signature with government-issued photo ID at the door. A click-through 'Are you 21?' overlay satisfies neither requirement — the checkout needs an integrated verification step wired to a third-party data provider.
The nicotine warning statement is a design constraint
Under 21 CFR 1143.3, advertisements with a visual component — explicitly including internet web pages and email — must carry 'WARNING: This product contains nicotine. Nicotine is an addictive chemical.' in the upper portion of the ad, occupying at least 20% of its area, in specified bold sans-serif type with black/white contrast. Site headers, email templates, and social creative all have to be architected around that block, not have it bolted on.
Catalog availability must resolve per destination state
California, Massachusetts, New Jersey, New York, Rhode Island, Utah, and other states restrict flavored product sales statewide (Massachusetts includes menthol), and more than a dozen states have enacted PMTA registry or directory laws that limit sales to state-listed products. A compliant store determines what a given customer can buy from their shipping address at checkout — geo-resolved catalog logic, not a footer disclaimer.
Marketing-status honesty in every line of copy
FDA lists 45 authorized e-cigarette products across five manufacturers and states those are the only e-cigarettes that may be lawfully sold in the US. Copy must never claim or imply FDA approval for anything else, and must never make cessation or health claims — 'helps you quit' language positions the product as an unapproved drug or device. Product pages should state objective attributes only.
Checkout has to produce PACT Act artifacts as a byproduct
Delivery sellers must register with ATF and state tobacco tax administrators, label package exteriors with the required federal statement, collect applicable state and local excise taxes before delivery, and keep records organized by state for four years to support monthly state reporting. The order pipeline should generate that data automatically — retrofitting reporting onto a generic cart is where operators get hurt.

Payment infrastructure

Stripe — restricted, pre-approval required
Stripe places 'tobacco products, including e-cigarettes, cigars, and e-liquid sold in accordance with applicable law' in its restricted-businesses list under regulated industries. That means supportability review and explicit approval, not default onboarding — and approval extended today can be withdrawn as risk posture changes.
PayPal — cigarettes prohibited; vape requires pre-approval
PayPal's Acceptable Use Policy prohibits transactions relating to cigarettes outright, and lists 'non-cigarette tobacco products, e-cigarettes, cigars' among activities requiring pre-approval. Running vape volume through an unapproved PayPal account is a User Agreement violation that typically ends in held funds and account closure.
Square — online tobacco sales prohibited
Square's payment terms prohibit 'internet/mail order/telephone order of age restricted products (e.g., tobacco).' In-person acceptance at a brick-and-mortar shop is a different analysis, but card-not-present vape e-commerce is outside Square's box entirely.
High-risk acquiring is the realistic path
Dedicated high-risk merchant accounts price in the category's dispute exposure: higher discount rates, rolling reserves, and volume caps are normal. Keeping the account alive is an operational discipline — clear billing descriptors, adult-signature delivery confirmation to cut 'item not received' disputes, responsive support, and dispute ratios kept well under card-network monitoring thresholds.
Underwriting scrutiny is tightening, not loosening
State attorneys general have formally pressed the major card networks and payment apps to cut off sales of unauthorized vaping products. Expect processors to ask for FDA authorization status, state registry listings, and PACT Act registration during underwriting — a storefront that documents its compliance posture on-site materially improves its odds of getting and keeping an account.

The zsty approach

zsty's method was built in the one vertical with an even harder wall: our founder operates Big Moose Hemp, a DTC hemp brand that grows under a total ad prohibition, and zsty.us itself ranks organically without a dollar of paid traffic. Everything we do for regulated operators comes from running that playbook on our own properties — not from a slide deck about 'SEO for restricted industries.' When every paid channel is closed, the craft is in making one owned asset do the work of five rented ones.

For a vape or nicotine operator, that translates into three build layers. First, compliance-native architecture: integrated database age verification at checkout, destination-state catalog resolution for flavor and registry states, warning-statement-compatible page and email templates, and an order pipeline that emits PACT reporting data by default. Second, search assets that win the queries buyers actually type — informational, comparison, and locality queries where no competitor can outbid you because there is no auction. Third, retention infrastructure — email, loyalty, subscription — because in this cost structure the reorder is where the margin lives.

One thing we will not do: promise workarounds to platform bans. Cloaked landing pages, borrowed ad accounts, and miscategorized campaigns end in permanent platform bans and lost processor relationships, and they poison the underwriting file you need to keep payments running. The durable position is the boring one — a technically clean site that ranks, converts, verifies, and reports. Not legal advice; verify your specific obligations with counsel.

Questions operators ask

Can I run any paid ads at all — age-gated, nicotine-free, or for authorized products?: On the major platforms, no. Google prohibits products designed to simulate smoking regardless of nicotine content; Meta's prohibition explicitly includes nicotine-free vapes; TikTok bans both the ad content and the landing page. FDA marketing authorization does not unlock any of these platforms — their policies are categorical, not compliance-conditional. Meta's cessation carve-out covers only FDA/WHO-approved cessation products, which no consumer vape is. Attempting to slip through review risks permanent account loss, which is far more expensive than never running the ads.
Is direct-to-consumer vape shipping still legal in 2026?: Legal, but operationally narrow. USPS declared ENDS nonmailable in October 2021, with limited exceptions (notably business-to-business shipments between verified entities, which require applying to USPS, and intrastate Alaska/Hawaii). UPS prohibits vaping products across its US network regardless of nicotine content, and FedEx does not accept e-cigarettes. DTC fulfillment therefore runs through regional and specialty carriers that offer adult-signature service — at higher per-parcel cost — while the PACT Act layers on registration, package labeling, excise tax collection, and monthly state reports. Many operators structure wholesale B2B (where the USPS exception can apply) separately from DTC for this reason.
What does PACT Act compliance actually require of my website, as opposed to my back office?: More than most carts can do out of the box. Before an order is accepted, the buyer's age must be verified against a commercially available database — that is a checkout integration, not a popup. The destination address must drive excise tax calculation and, practically, catalog availability for flavor-ban and registry states. Package labeling requirements and adult-signature shipping methods must be selected automatically. And because sellers must keep four years of records organized by state and file monthly reports with state tax administrators, the order pipeline should be designed to emit that reporting data as a byproduct rather than reconstructed manually.
Do my products need to be on FDA's authorized list to sell online?: Federal law permits marketing only for products with an FDA order — currently 45 e-cigarette products across five manufacturers (Vuse, JUUL, NJOY, Logic, Glas). The wider market has operated for years under staggered enforcement, but the exposure is real and growing: FDA has issued marketing denial orders on the overwhelming majority of applications, and more than a dozen states have passed registry laws that make directory listing a hard condition of sale, with state-level enforcement against retailers. Whatever you stock, your copy must reflect reality — never describe an unauthorized product as FDA approved, and expect processors and carriers to ask about authorization status during underwriting.

zsty buys no ads. It ranks organically — and did so for itself first.

If paid acquisition is closed in your vertical, the owned layer is the whole game. That's the layer we build.

Start a conversation See the live SEO demo

Sources

Tobacco — Google Ads Advertising Policies Help — Google
Tobacco and Related Products — Ad Standards — Meta Transparency Center
Dangerous Products or Services — TikTok Advertising Policies — TikTok for Business
Treatment of E-Cigarettes in the Mail (Final Rule, Oct. 21, 2021) — Federal Register / USPS
15 U.S.C. § 376a — Delivery sales (PACT Act) — Legal Information Institute, Cornell Law School
Shipping Tobacco — Prohibited Items — UPS
Guidelines for Tobacco Shipping — FedEx
E-Cigarettes, 'Vapes' and Other ENDS Authorized by the FDA — U.S. Food and Drug Administration
Tobacco 21 — U.S. Food and Drug Administration
21 CFR § 1143.3 — Required warning statement regarding addictiveness of nicotine — eCFR
States and Localities That Have Restricted the Sale of Flavored Tobacco Products — Public Health Law Center
State E-Cigarette Registry Bill Map — Public Health Law Center
Prohibited and Restricted Businesses — Stripe
Acceptable Use Policy — PayPal
Square Payment Terms — Prohibited Goods and Services — Square
AG-led bipartisan effort calling on credit card companies and payment apps to curb sales of illegal vaping products — Pennsylvania Office of Attorney General

Regulatory and platform policies change frequently. This page is operational analysis, not legal advice — verify current rules with counsel before acting.