What multi-state shipping compliance actually requires

Most stores selling a regulated product handle shipping restrictions the same way: someone researches the rules once, puts them in a spreadsheet, and the team checks orders against it before fulfilment. That works until it doesn’t, and the way it fails is worth understanding before you pick a solution.

The rule is set by the destination

Compliance for shipped goods is determined by where the package arrives, not where your business is incorporated, where your warehouse sits, or where your supplier operates. A store in a permissive state selling into a prohibitive one is subject to the prohibitive rule.

This sounds obvious and is routinely got wrong, because every other part of running a store — licensing, taxes, employment, your own product sourcing — is anchored to where you are. Shipping restrictions are the exception, and they are anchored to the customer.

There are at least three layers, not one

A complete answer for a single order requires checking more than the state.

Federal law sets the floor for a few categories and is genuinely uniform.

State law does most of the work and is where the greatest variation sits.

County and city ordinances are the layer most programs miss entirely. They matter most precisely where state law is silent, because a state that hasn’t legislated often has cities that have. A state-level “no restriction” can be wrong for a specific delivery address.

There is a fourth layer that isn’t law at all: carrier policy. Major carriers refuse certain categories regardless of legality, and a shipment that is perfectly lawful can still be undeliverable, seized in transit, or grounds for terminating your account.

The failure mode is silent

This is the part that makes the spreadsheet approach genuinely dangerous rather than merely inefficient.

When a rule changes and your list doesn’t, nothing happens. No error, no alert, no failed order. You continue shipping, successfully, into a jurisdiction where the product is now prohibited — and you find out when a regulator, a carrier, or a payment processor tells you, by which point you have a history of violations rather than a single incident.

Contrast that with most operational failures, which announce themselves. An out-of-stock item blocks an order. A declined card blocks an order. An expired rule blocks nothing.

Why static lists rot quickly

A researched list of restrictions is accurate on the day it is compiled and begins decaying immediately. Legislatures amend and repeal. Courts strike provisions down, sometimes leaving unenforceable text sitting in the code. Agencies reinterpret definitions without any statute changing. Municipalities pass ordinances on timetables nobody tracks nationally.

We have repeatedly found widely repeated “bans” that had in fact been repealed years earlier, still being cited by compliance vendors and trade press. The direction of error runs both ways: lists over-block as often as they under-block, and over-blocking costs you sales silently too.

What a real program has to do

Four things, and the fourth is where most tools stop short.

It has to be destination-based, resolving the actual delivery address rather than a billing state.

It has to reach below the state level, because the local layer is where silence gets dangerous.

It has to be maintained on a schedule, with each rule re-verified against its primary source rather than against another aggregator — a recurring cost, not a project.

And it has to enforce at checkout, not at fulfilment. A rule that’s checked after the money is taken means refunds, cancellations, and a customer who has already been told yes. Blocking before the order completes is the only point where the cost is just a lost sale.

Where Gatekeep fits

We do the researching, the re-checking, and the blocking. The rules are maintained against primary sources on a quarterly cycle, they include the county and city layer where it’s stricter than the state, and they’re applied during checkout so a restricted destination simply can’t complete an order.

We don’t hand you the library. That’s deliberate: a rule list you hold is a rule list you have to maintain, and maintaining it is the actual work.