ECOM CPA | Published April 2026
For more than 60 years, a single sentence in a 1959 federal statute—Public Law 86‑272—has quietly protected tens of thousands of interstate sellers from state income tax in states where they had no physical presence. For most of that time, ecommerce sellers leaned on it as a silent insurance policy: you could ship into Oregon, Illinois, and Massachusetts without ever thinking about their corporate income tax. In 2026, that insurance policy is cracking, and a lot of DTC and Amazon sellers are going to find out the hard way that they now owe income tax in 10, 15, even 20 states.
This article walks through what actually changed, which digital activities now blow the protection, and what ecommerce sellers should do before year end to avoid retroactive assessments.
A 30‑second primer on PL 86‑272
PL 86‑272 was enacted in 1959 to protect sellers of tangible personal property who only solicited orders in a state. The rule: if your in‑state activity is limited to soliciting orders that are approved and fulfilled outside the state, that state cannot impose its net income tax on you. The protection has always been narrow—it only covers income tax (not sales tax, not gross receipts tax, not franchise tax), and it only applies to sellers of tangible goods.
Here is the critical thing ecommerce founders miss: PL 86‑272 has never been about whether you have ‘economic nexus.’ You may well have economic nexus in a state—meaning you are subject to its taxing jurisdiction—but still be immune from its income tax because your activities fall inside the PL 86‑272 safe harbor. The shield is the safe harbor, not the lack of nexus.
What changed: MTC 2021 and the state cascade
In August 2021, the Multistate Tax Commission (MTC) updated its interpretation of PL 86‑272 to address internet activity. That guidance said that a long list of things ecommerce sellers routinely do on their websites are not ‘solicitation of orders’ and therefore are not protected. States that adopted the MTC’s interpretation argued that running a modern ecommerce website necessarily creates activities outside the safe harbor.
For a few years, the MTC position was mostly theoretical. That is no longer the case. Here is the state of play as of Q2 2026:
- California adopted the MTC interpretation through administrative guidance in 2022. A procedural challenge voided the underlying rule in 2023, but the Franchise Tax Board has continued to audit on the substance of the MTC position.
- New York issued comparable regulations in 2023. These remain in litigation but the Department of Taxation and Finance is actively assessing based on them.
- New Jersey finalized MTC‑aligned rules in 2025. Enforcement began in 2026.
- Massachusetts issued a 2025 regulation that explicitly lists internet activities—cookies, customer chat, post‑sale support, data used for product development—as outside PL 86‑272. Out‑of‑state sellers over $500K of Massachusetts receipts now face corporate excise tax exposure.
- A wider tier—including Illinois, Minnesota, and Oregon —has signaled that they will follow the MTC position through either administrative guidance or audit positions in 2026.
The ‘unprotected’ activities list—and why it matters
Under the MTC’s 2021 interpretation, the following online activities exceed the ‘solicitation’ safe harbor and therefore break PL 86‑272 protection. Any one of these by itself is enough:
- Placing cookies on in‑state users’ devices that gather information used for product development, inventory management, or pricing.
- Providing post‑sale assistance to customers via chat or email (returns help, order tracking, troubleshooting).
- Soliciting job applications from in‑state residents for non‑sales positions through your website.
- Offering extended warranties on your website.
- Contracting with in‑state marketplace facilitators that perform non‑solicitation activities on your behalf.
- Providing upload functionality for customers to submit photos, reviews, or custom designs that you use in the business.
- Offering branded credit cards, buy now pay later, or other in‑state financing.
Look at that list the way an ecommerce founder should: this is every Shopify store, every Amazon storefront, every DTC brand that answers support tickets. Almost no ecommerce seller can credibly claim they stay inside the protection anymore. And that is the point—the MTC’s position is, in effect, that PL 86‑272 no longer protects a business that runs on the modern web.
Why this hits ecommerce harder than other industries
Three characteristics of the ecommerce model make PL 86‑272 erosion particularly dangerous:
1. Multistate customer base as a feature, not a bug
A typical $10M DTC brand ships to all 50 states. Once PL 86‑272 protection breaks, the brand is potentially subject to income tax in every state where it has economic nexus—which in 2026 is most of them.
2. Retroactive exposure
Income tax statutes of limitations generally run 3‑4 years, but they do not start if no return was ever filed. States that now take the MTC position can reach back to 2022 or earlier for sellers who never filed. Penalties and interest compound quickly.
3. Apportionment that favors destination
Most states use single‑sales‑factor apportionment, which allocates income based on sales into the state. For a pure‑play ecommerce seller, that often means a meaningful percentage of taxable income lands in high‑tax states like California, New York, and New Jersey.
A rough sizing of the exposure
Consider a $15M Shopify+Amazon seller headquartered in Texas, profitable at 9% EBITDA. Under PL 86‑272 protection, the seller files Texas franchise tax and nothing else. If the protection breaks across 10 large states in 2026, here is a rough estimate of the new exposure:
| State | Approx. sales factor | Est. state income tax (if filed) |
| California | ~12% | ~$14,500 |
| New York | ~8% | ~$8,900 |
| New Jersey | ~3% | ~$3,650 |
| Massachusetts | ~3% | ~$3,250 |
| Illinois | ~4% | ~$3,400 |
| Minnesota, Oregon, others | ~10% combined | ~$8,500 |
| Total new annual exposure | ~$42,000+ |
For a seller that never filed in any of these states before, the 2022–2025 back‑year exposure can easily exceed $150,000 once interest and penalties are added—and it will keep growing until the seller either files returns or enters a voluntary disclosure agreement (VDA).
What ecommerce sellers should do in the next 90 days
1. Audit your website against the MTC ‘unprotected’ list
If you have any of the following, assume PL 86‑272 protection is broken: live chat or chatbot support, a cookie banner that references analytics or advertising, customer reviews, post‑sale email flows, a careers page that accepts applications, or a branded BNPL/financing program.
2. Pull a 3‑year receipts‑by‑state report
Identify every state where you have had more than roughly $500K of sales in any of the last three years. These are your priority states—either because they already have adopted the MTC position or because economic nexus thresholds are low enough that you probably triggered them.
3. Decide the filing strategy per state
Three realistic paths: (a) file on a go‑forward basis and accept that the state may ask about prior years; (b) enter a VDA to limit lookback and abate penalties; (c) continue to rely on PL 86‑272 where you are confident your activities still fall inside it (a shrinking list). The right mix depends on exposure size, remaining statute of limitations, and whether the state has an open VDA program.
4. Set up a state income tax calendar
Most ecommerce sellers have a sales tax calendar but not a state income tax calendar. If you are now filing in 8–15 states, you need a compliance rhythm: quarterly estimates, annual returns, composite returns if you flow through, and extension tracking.
5. Get specific about apportionment
The single‑sales‑factor apportionment rule benefits states that receive your shipments. Make sure your accounting system can produce clean, auditable sales‑by‑state data from the payment processor level up, not just from the order management system.
The bottom line
PL 86‑272 was a powerful, quiet shield. It is still there, but the hole in the middle of it has grown so large that most ecommerce sellers should assume it no longer covers them. The right response is not panic—it is a deliberate, state‑by‑state filing strategy that closes the exposure before a state finds it for you.
At ECOM CPA, we help ecommerce sellers run this analysis end to end: website activity review, multistate receipts mapping, VDA strategy, and ongoing state income tax compliance. If you have not looked at PL 86‑272 exposure in the last 12 months, 2026 is the year to do it.
