State-by-State Vape Product Directory Tracker (2026)

Eight years running our specialty & counter-culture retail POS for vape and counter-culture retailers in Atlanta and across 30+ states, we've watched the state-directory layer go from "two states experimenting" in 2023 to a default compliance regime in 2026. If you operate in more than one state and you're still managing this in a spreadsheet, this is the article.

What a vape product directory actually is

A state vape product directory is a registry, maintained by a state's Department of Revenue or Department of Treasury, listing every nicotine vapor product that may legally be sold at retail in that state. Manufacturers submit a per-SKU certification — typically that the product has a PMTA on file with FDA, or is otherwise legally marketed under federal rules — pay a registration fee (commonly $500 per SKU variation, annually), and the state publishes the approved list.

If a product is not on the list, it is illegal to sell in that state. It doesn't matter whether:

• The product has an FDA PMTA submitted (federal layer is separate)
• The customer is 21+ (age compliance is a separate axis)
• The distributor told you it was "compliant" (their word is not the state's)
• The product is sold legally one state over (each state's directory is independent)

This is the structural shift counter-culture retailers need to internalize: federal PMTA status alone is no longer sufficient to know whether you can sell a product. You need state-by-state directory status, refreshed at least quarterly.

States with active directories (as of August 2026)

The exact roster shifts every few months as new states activate and others amend their rules. Below is our best read of the live status as of August 2026. Verify with each state's Department of Revenue or Treasury before relying on this for a compliance decision — directory pages change without much notice.

| Alabama | Yes | 2024 | Active (Dept. of Revenue) | export const blogPosts: BlogPost[] = [ ,000+ per violation | | Iowa | Yes | 2024 | Active | License risk + per-pack fines | | Kentucky | Yes | 2024 | Active (upheld after legal challenge) | export const blogPosts: BlogPost[] = [ 00–$500 per pack | | Louisiana | Yes | 2024 | Active (Office of Alcohol & Tobacco Control) | $250–export const blogPosts: BlogPost[] = [ 0,000 | | Mississippi | Yes | 2025 | Active | $250–$5,000 per violation | | Missouri | Yes | 2025 | Active | License suspension/revocation risk | | North Carolina | Yes | May 1, 2026 | Active | export const blogPosts: BlogPost[] = [ ,000 per violation | | Oklahoma | Yes | 2024 | Active | License risk + civil penalty | | Tennessee | Yes | Early 2026 | Active | $500–$5,000 per SKU | | Utah | Yes | 2024 | Active | License revocation on repeat | | Virginia | Yes | July 1, 2026 | Active | export const blogPosts: BlogPost[] = [ ,000–export const blogPosts: BlogPost[] = [ 0,000 | | Wisconsin | Yes | July 1, 2026 | Active | $500 per violation | | Florida | Pending | Late 2026 (statute passed) | Ramp-up phase | TBD by rulemaking | | Connecticut | Pending | 2026 (under final rulemaking) | TBD | TBD | | Texas | Considered | TBD 2026–2027 legislative session | n/a | n/a |

Sources for current status: the Public Health Law Center's state e-cigarette registry bill map tracks legislation in close to real time; each state's Department of Revenue publishes the live SKU directory. Treat anything in this table as a starting point, not a final answer. If a single SKU compliance decision turns on it, call the state directly.

How a directory is different from FDA PMTA

The most expensive mistake we see is operators conflating FDA PMTA with state directories. They are layered, independent, and not equivalent.

A product needs to clear both layers to be sellable. PMTA-authorized + on the state directory = legal to sell. PMTA-authorized but missing from Kentucky's directory = illegal in Kentucky, even though it's legal federally. PMTA-pending and on Louisiana's directory = legal in Louisiana under the pending federal status the state recognizes.

If your compliance program checks only one of the two layers, you have a gap. We cover the federal layer in detail in /resources/blog/pmta-compliance-for-vape-shops-2026; this article is the state layer.

What your POS actually needs to do

A spreadsheet-based directory check fails the moment you have more than one location or more than 200 SKUs. The POS is where directory compliance has to live, because that's where the transaction happens.

The five disciplines for POS-level directory gating:

1. Per-SKU directory status, per state

Every tobacco/vape SKU in the catalog needs a status field per state where you operate. Not a single global "compliant: yes/no" — a row per state.

For a multi-location chain, that means a SKU like Mythical Disposable Mango 5% might look like:

Same SKU, different legal status by location. The POS must store this granularity.

2. Cashier-facing block at scan

When a cashier scans a SKU whose directory status is "Not listed" or "Unknown" for that store's state, the register has to hard-stop the sale — not warn, not flag, stop. A warning gets ignored on the third busy Friday night. A hard stop forces a manager decision and an audit trail.

The block flow we configure:

1. 1Cashier scans SKU
2. 2POS checks per-location directory status
3. 3Status = "Not listed" → register displays a block screen with the reason
4. 4Sale cannot proceed without manager override
5. 5Override is logged with manager ID, SKU, reason, and timestamp

3. Blocked-attempt reporting

The blocked attempts are themselves a data signal. A SKU that gets scanned and blocked 40 times in a week is a SKU that's still on the shelf and needs to be physically pulled, not just gated electronically. Most operators discover at audit time that the gating was working but the inventory wasn't reconciled.

The weekly report we generate:

• SKU blocked + count of attempts + last attempted timestamp
• Location-by-location breakdown
• Manager overrides issued (a separate column — overrides are a yellow flag)

4. Automatic catalog updates

When a state adds 30 SKUs to its directory or removes 8, your POS catalog has to reflect that without manual SKU-by-SKU updates. The workflow we run:

• State directory pulled monthly (or whenever the state publishes a refresh)
• Diff against prior version → new approvals, new removals
• Status field updated automatically on all matching SKUs
• Operators get an email summary of what changed
• Removed SKUs auto-flag for delisting in stores in that state

5. Receiving-side gating

The cleanest version of directory compliance prevents non-compliant product from entering the store in the first place. On the PO/receiving side:

• Cashier or receiving manager scans incoming case
• POS checks: is this SKU on the directory for this location's state?
• If not, receiving is blocked and the case is rejected back to distributor

This is the discipline that keeps the audit clean. Once non-compliant product hits the shelf, you're relying on cashier gating to catch every transaction — better, but not perfect.

The common operator mistake (and why it's expensive)

The mistake we see most: an operator assumes the FDA PMTA Authorized list = the state directory. The internal monologue is "I checked FDA, the product's pending, we're good."

The reality:

• FDA PMTA controls whether a product can be marketed in the U.S. at all
• State directories control whether that product can be sold in that state
• Many PMTA-pending products are not on Kentucky's directory
• Many products on Louisiana's directory are still PMTA-pending (Louisiana recognizes that status)
• A product can clear FDA and fail a state directory, or pass a state directory and be federally questionable

These are two different verifications. The POS needs to track both because operators won't do it consistently by hand. We treat the federal layer as a global SKU flag and the state directory as a per-location overlay.

The compliance cadence: what to do every 90 days

Even with automated gating, a quarterly manual pass is the discipline that keeps you ahead of the next inspection. The 90-day checklist:

1. 1Pull each active state's current directory from the state DOR/Treasury portal (most states refresh monthly or quarterly)
2. 2Diff against last quarter's snapshot — note additions and removals
3. 3Match against your active SKUs by location — every SKU should have a directory status per state where it's stocked
4. 4Flag noncompliant items for physical removal from shelves in affected stores
5. 5Update your receiving filter so new product purchase orders auto-reject directory-removed SKUs at the warehouse
6. 6Pull blocked-attempt reports from the POS — anything blocked 5+ times should be investigated (likely still on shelf)
7. 7Document the audit log — sign and date a one-pager so a future inspector sees the discipline

Once you've built the cadence, it's a 2-hour exercise per quarter for a five-store chain. Without it, you're betting on FDA and the state not showing up — and in 2026, both are showing up.

What happens if you sell a noncompliant product

The penalty escalation pattern, drawn from the inspection reports we've reviewed in client audits during 2025–2026:

| 2. Civil penalty per transaction | Fines compound by SKU and by sale | $250–export const blogPosts: BlogPost[] = [ ,000 per transaction in most states | | 3. Product seizure | State inspectors confiscate non-listed stock on site | Loss of inventory value plus penalties | | 4. License action | Tobacco/vape license suspension or revocation | Store-level closure risk; multi-month | | 5. AG enforcement | Civil action for pattern of non-compliance | export const blogPosts: BlogPost[] = [ 0,000+ plus injunctive relief |

State enforcement intensified through 2025 and into 2026. Tennessee and Kentucky both ran undercover compliance sting operations in 2025 — inspectors purchasing non-listed products and citing on the spot. North Carolina launched a coordinated enforcement push around its May 2026 directory go-live. Virginia and Wisconsin followed when their directories went live July 1, 2026.

The audit pattern is consistent: inspector walks in, asks for the tobacco/vape license, pulls 10–20 random SKUs off the shelf, and looks each one up against the state directory in real time on a tablet. Findings get cited within 30 minutes. Penalties get assessed within 60 days.

Cross-state operations: where generic POS fails

A vape chain with stores in Florida and North Carolina has a structural problem that generic retail POS doesn't handle: a product that's legal in Florida may be banned in North Carolina, and the POS has to know which store is which.

The failure mode is invisible until it isn't. A multi-store operator buys a pallet of Mythical Mango on the assumption that "vape is vape." It ships to all five locations. The four Florida stores ring it through fine. The Raleigh store gets cited on the next inspection because it's not on North Carolina's directory.

The platform-level requirement:

• Per-location catalogs, not a single global catalog
• Per-location directory status on every SKU
• Receiving-side gating that blocks non-compliant transfers before they hit the shelf
• Operator dashboard showing per-store, per-SKU compliance status

This is the multi-state operator problem we wrote up separately in /resources/blog/multi-location-inventory-counter-culture-retail. State directories make it materially worse than the single-state version — you're now layering a state-by-state legal overlay onto an already complex inventory model.

Where Lifelong fits

We configure per-location SKU gating with directory status flags for every state where a client operates. Every vape deployment we run includes:

• Per-SKU, per-state directory status field
• Cashier-side hard block on non-listed SKUs with manager-override audit log
• Monthly automatic pull of each active state's directory with diff reporting
• Receiving-side gating so non-compliant product can't enter the store
• Quarterly self-audit report auto-generated for the operator and their attorney
• Per-location catalog management for multi-state chains

We're an Atlanta-based payments and POS team supporting 500+ general retail and counter-culture merchants across all 50 states, and we've been running vape-shop compliance configurations since well before state directories existed. For the broader payments + compliance picture, see our specialty & counter-culture retail POS.

FAQ

Does FDA PMTA approval mean I can sell the product in every state?

No. FDA PMTA is the federal layer — it controls whether a product can be marketed in the U.S. at all. State product directories are a separate, additional layer maintained independently by each state. A product can be PMTA-authorized federally and still illegal in Kentucky because it's not on Kentucky's directory. You have to check both.

How often do state directories change?

Most states refresh monthly or quarterly. Some, like Louisiana and Kentucky, post additions/removals on a rolling basis. The practical discipline is: re-pull every active state's directory at least once per quarter, and configure your POS to refresh more often where the state publishes monthly.

What if a customer brings in a noncompliant product they bought online for a return?

The cleanest answer is "we can't take the return." A return is a transaction in the state, and the POS should flag the SKU as non-listed when scanned. We configure the block to apply on returns as well as sales, with a manager-override path for genuinely exceptional cases (defective product, recall, etc.) — the override gets logged.

Can my POS notify me when a SKU is added or removed from a state directory?

Yes — modern vape-shop POS pulls each state's directory on a schedule, diffs against the previous version, and emails the operator a change log. Newly removed SKUs auto-flag for delisting at affected locations; newly added ones get added to the available catalog automatically. If your POS doesn't do this, you're managing it in a spreadsheet, which works until your fourth state.

What's the federal directory called, and where is it?

The federal layer is FDA's Tobacco Products Authorized for Marketing list, published by the FDA Center for Tobacco Products. It's separate from any state directory and lists products that have received a PMTA Marketing Granted Order or other federal authorization. Authoritative source: fda.gov/tobacco-products/products-ingredients-components/tobacco-products-authorized-marketing.

My state isn't on the list yet — do I need to worry about this?

If you operate in only one state and that state doesn't have a directory, you have a quieter compliance environment today. But the trend is one-way: 14 states in 2026, with Florida, Connecticut, and Texas in active consideration. Build the workflow now while you have time, rather than scrambling when your state activates.

Get a free read of your directory compliance posture

If you operate in any of the 14 active directory states and you're not sure whether your POS is gating correctly, we'll do a 30-minute walk-through — pull a random sample of SKUs, check them against the state directories live, and tell you where the gaps are. No contract pitch, no upsell. talk to our Atlanta team to book.