What are you responsible for when you sell online?

More than the payment. When you take money for an order in the US, you own the chargebacks that come back on it, including card-not-present fraud unless 3D Secure shifts the liability. You owe the buyer a shipment within the time you promised or 30 days, a refund within seven working days if they cancel, and a refund policy they saw before paying. You may owe sales tax in states you have never visited, an annual PCI DSS attestation for how you handle cards, at least 3 years of records, and answers to privacy requests. A payment processor covers the card data and moves the money. The rest attaches to your business, whether you wrote the checkout, bought it, or had an AI agent generate it.

Verified against official documentationReviewed October 22, 2026Send a correction

A payment is one event. An order around it creates a set of obligations that run for months or years afterward: a dispute can arrive 120 days later, sales tax returns come due on a schedule each state sets, and the IRS can ask for the records behind a return years after you file it. Every one of those obligations needs the same thing from your systems: a durable record of what was sold, at what price, with what tax, what shipped and when, and what was refunded.

Scope: sellers based in the US selling to US buyers, under the rules in effect on the review date. Not legal or tax advice. States change thresholds often, and your situation may differ, so confirm your obligations with an attorney or tax professional.

Where to start

Where you are	Your section
A buyer disputed a charge, or you want to know what a chargeback costs	Disputes and chargebacks
You ship physical goods and need your shipping and refund deadlines	Shipping, refunds, and your refund policy
You sell subscriptions or memberships that renew automatically	Subscriptions and auto-renewal
You don't know whether you owe sales tax in other states	Sales tax
You built, bought, or generated your own card form	Card data security
You need to know how long to keep records, or why you received a 1099-K	Records and income reporting
A customer asked you to delete their data, or you send marketing email	Customer data, privacy, and email
Your processor placed a reserve on your funds or closed your account	Reserves, closures, and MATCH
You're designing the database behind your store	What the order record has to hold

Who covers what

A payment processor here means one used on its own, such as Stripe, Square, or Adyen with your own code around it. A commerce engine is a platform that keeps the order, not only the payment.

Obligation	What it requires	A payment processor covers	A commerce engine adds	Still yours
Card data security	PCI DSS compliance, attested every year. Which questionnaire you file depends on whether any part of the payment page comes from your site.	Hosted pages and embedded card fields keep card numbers off your servers.	A hosted checkout also keeps the page around the card fields, and its scripts, off your site.	The annual attestation, and every script on any page you host around embedded card fields.
Disputes and chargebacks	Answer each dispute in the issuer's window, usually 7 to 21 days. Keep disputes and fraud reports under card network thresholds.	Notifies you, debits the disputed amount and a fee, and forwards your evidence.	Ties each dispute to the order: what was sold, what shipped, what was refunded, and to whom.	The loss on card-not-present fraud without liability shift, the evidence, the deadline, and prevention.
Shipping and refunds	Ship within the time you state, or 30 days. Let buyers cancel when you're late. Refund card orders within seven working days of a cancellation.	Moves refunded money back to the card.	Records what shipped and when, and refunds by line item.	The shipping promise, delay notices, and a refund policy shown at checkout.
Subscriptions	Disclose the terms before taking billing details, get express consent, and offer a simple way to cancel. California adds online cancellation and notices.	Charges the saved card on schedule.	A buyer account where subscribers can cancel, and events before each renewal.	The disclosure wording, consent records, and a cancellation path that meets each state's law.
Sales tax	Register and collect in each state where you cross its economic nexus threshold, then file and remit. Reverse tax on refunds.	Some processors sell tax calculation and filing as add-on products.	Tax on each line, reversed in proportion on refunds, and exported for filing.	Deciding where you owe, registering, and filing, unless you pay someone to file.
Records and income reporting	Keep business records for at least 3 years, longer in some cases. Report all income, with or without a Form 1099-K.	Issues Form 1099-K and itemizes payouts.	One record that joins items, tax, refunds, fees, and payouts.	Retention, reconciliation, and your tax returns.
Privacy and email	Answer access and deletion requests where state law applies, notify people after a breach, and follow CAN-SPAM for marketing email.	Secures the card data it holds.	A deletion flow that removes the buyer's identity but keeps the sale.	Your privacy notice, request handling, breach response for data you hold, and email opt-outs.
Account standing	Stay inside your processor's risk limits and the card networks' monitoring thresholds.	Sets reserves, holds payouts, closes accounts, and reports terminated merchants to MATCH.	Nothing separate: whoever processes your payments sets these terms.	The dispute and fraud rates that decide them.

Processor terms put the remainder on you in writing. Stripe's Services Agreement, for example, gives the user "sole responsibility and liability" for determining which taxes apply to its sales and for assessing, collecting, reporting, and remitting them, and lets Stripe close an account at any time.

Disputes and chargebacks

A dispute starts when a cardholder asks their bank to reverse a payment. On Stripe, the moment a dispute opens, the disputed amount plus a dispute fee comes out of your balance and is held until the bank decides. You can't refund the payment outside the dispute while it is open.

Fraud losses are yours by default

When a stolen card is used online and the real cardholder disputes the charge, the loss lands on the merchant. The exception is liability shift: for payments successfully authenticated with 3D Secure, liability for fraud disputes typically moves to the card issuer. Stripe's docs are explicit that it is never guaranteed for a specific payment, that it generally does not apply when a card doesn't support 3D Secure, and that a cardholder who disputes for another reason, such as an item not received, goes through the standard process regardless of authentication.

The clock

Cardholders typically have 120 days from the payment to dispute it. For a future event or service, such as a ticket or a reservation, the window usually starts on the event date.
You usually have 7 to 21 days to respond, depending on the card network. Missing the deadline loses the dispute.
You get one submission. Stripe forwards it to the issuer immediately, and you can't add files afterward.
The issuer then has 60 to 75 days to decide. The whole process typically takes 2 to 3 months.

The cost

On Stripe's US pricing, receiving a dispute costs $15, which isn't returned even if you win. Countering it costs another $15, returned only on a win. Contesting a Visa or Mastercard compliance dispute adds a $500 network fee, refunded if you win. If you lose, the disputed amount goes to the cardholder and neither $15 fee comes back.

The ratios that decide your account

Card network monitoring programs count disputes regardless of their outcome or of any refund. Stripe's docs describe dispute activity above 0.75% as excessive by industry standard, and the networks run monitoring programs with fines:

Visa Acquirer Monitoring Program (VAMP). Visa counts disputes plus issuer fraud reports (TC40 reports, which Stripe calls early fraud warnings), so a fraudulent payment you refunded before any dispute can still count. For US merchants, the excessive threshold is a monthly VAMP ratio of 1.5% and a count of 1,500. Visa assesses fees on merchants over that threshold and may assess them over the 0.5% non-compliant ratio.
Mastercard Excessive Chargeback Program. A month with 100 to 299 chargebacks and a chargeback rate of 1.5% to 2.99%, measured against the previous month's payments, places you in Excessive Chargeback Merchant. Fines start in month two at $1,000 and rise to $100,000 a month from month 19. At 300 or more chargebacks and 3%, the High Excessive tier fines run up to $200,000 a month.

The evidence you need to have kept

Disputes are won with records made at the time of the sale, not reconstructed after. Visa's merchant guide says card-absent responses are strongest with proof of delivery, access, or benefit, a consistent purchase pattern, and a clear link between your records and the disputed transaction. For fraud claims, Visa's Compelling Evidence 3.0 lets you point to at least two earlier undisputed transactions on the same card, processed between 120 and 365 days before the disputed one, that share a device ID or IP address plus another identifier such as the account login or the full shipping address. Each of those is a field you either stored on the order or didn't.

Shipping, refunds, and your refund policy

The FTC's Mail, Internet, or Telephone Order Merchandise Rule covers most goods ordered online, whatever the payment method. It doesn't cover services, C.O.D. orders, seeds and growing plants, or magazine subscriptions after the first issue.

Ship on time. You need a reasonable basis to ship within the time you state. If you state none, the deadline is 30 days, or 50 days when the buyer applies to you for credit to pay.
Ask before you're late. If you can't ship on time, you must get the buyer's consent to the delay: give a revised ship date, or say you can't give one, and offer cancellation with a prompt refund. For a first delay of 30 days or less, silence counts as consent. For longer or indefinite delays, and for any second notice, it doesn't.
Refund fast, in money. When an order is canceled, refund within seven working days if the buyer paid by cash, check, money order, or a credit card from a third-party issuer, or within one billing cycle if you extended the credit yourself. Store credit doesn't count as a refund.

The FTC's guide to the rule lists civil penalties of up to $53,088 per violation, its January 2025 inflation-adjusted figure.

The refund policy has to be shown, not just written

Visa's merchant guide lets you set your own return, refund, and cancellation policy, up to and including no refunds, though no policy limits the refunds that law requires, such as the FTC's refunds for canceled orders. For online purchases, Visa requires the policy to appear before checkout with a checkbox, click-to-accept button, or other acknowledgment, or on the checkout page near the button that places the order. A link to a separate page counts if the link is part of that acknowledgment. Visa also tells you to keep records of how and when the cardholder acknowledged the policy, and to keep prior versions with their effective dates, because a dispute is judged against the policy shown at the time of purchase.

Subscriptions and auto-renewal

The federal baseline for anything that renews online is the Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. 8403. Before charging a buyer through a negative option feature such as an automatic renewal, you must:

Clearly and conspicuously disclose all material terms before collecting billing information.
Get the buyer's express informed consent before charging their card or account.
Provide a simple mechanism to stop the recurring charges.

The FTC's 2024 "click to cancel" amendments to its Negative Option Rule are not in force. The Eighth Circuit vacated them on July 8, 2025, in Custom Communications v. FTC, which reinstated the narrower rule first issued in 1973. The FTC published an advance notice of proposed rulemaking on March 13, 2026, asking whether to keep the current rule, adopt parts of the vacated one, or rely on alternatives to regulation. The comment period closed in April 2026, and as of the review date no proposed rule has followed. ROSCA still applies: the FTC's notice lists negative option cases against Amazon, Adobe, Uber, LA Fitness, and Instacart, the last three filed in 2025.

States add their own rules. In California, for contracts entered, amended, or extended on or after July 1, 2025, Business and Professions Code section 17602 requires you to:

Get express affirmative consent to the automatic renewal terms, with nothing in the contract that undermines that consent.
Keep proof of that consent for 3 years, or 1 year after the contract ends, whichever is longer.
Let anyone who signed up online cancel online, at will, through a prominent link or button or an immediately accessible termination email, without steps that obstruct or delay it.
Notify subscribers of a price change 7 to 30 days before it takes effect, with how to cancel.
Send subscribers on annual plans a yearly reminder with the product, the charges and their frequency, and how to cancel.

Sales tax

Before 2018, a state could require you to collect its sales tax only if you had a physical presence there. On June 21, 2018, the Supreme Court overruled that rule in South Dakota v. Wayfair, a case over a South Dakota law that reached sellers delivering more than $100,000 of goods or services into the state a year, or making 200 or more separate sales there. States now set their own economic nexus thresholds, and they differ:

State	Remote seller threshold	Measured over
South Dakota	More than $100,000 in gross sales. The 200-transaction test was removed July 1, 2023.	The previous or current calendar year
California	More than $500,000 of tangible goods delivered into the state, counting related companies	The preceding or current calendar year
Texas	$500,000 or more in Texas revenue, counting marketplace sales	The preceding 12 calendar months
New York	More than $500,000 in goods delivered into the state and more than 100 sales, both required	The preceding four sales tax quarters

Marketplaces versus your own store. Where a marketplace facilitator law applies, the marketplace collects and remits tax on the sales it facilitates. New York puts that duty on marketplace providers, and Texas lets a seller who only sells through a marketplace that certifies it collects skip its own permit. Sales through your own site are different: you collect on those yourself. Texas counts marketplace sales toward your threshold even when the marketplace collects the tax, so a store selling $300,000 on its site and $300,000 on a marketplace owes Texas tax on its own site's sales. New York also requires its in-state sellers to register and file even when marketplaces collect for them.

Once you cross a threshold, you register with the state, collect the right rate for each buyer's location, file returns on the schedule the state assigns, and remit what you collected. Refunds have to reverse the tax correctly: California, for example, excludes returned merchandise from your taxable sales only when you refund the full sale price including the tax, less any actual restocking cost.

Tax products cover part of this for a fee. Stripe Tax calculates tax, and its Tax Complete plan adds threshold monitoring, registration, and filing of US returns. Its docs note that registration and filing are separate services and that you must file and remit for every location where you're registered.

Card data security (PCI DSS)

Every business that accepts cards must comply with the Payment Card Industry Data Security Standard. The current version is PCI DSS v4.0.1, published in June 2024 and the only active version since v4.0 retired at the end of 2024. Stripe's docs call it a shared responsibility: Stripe is assessed every year as a Level 1 service provider, and you attest every year that you accept payments in a compliant way. What you attest to depends on how card numbers reach the processor:

How you collect cards	Self-assessment questionnaire
Redirect to a processor-hosted payment page	SAQ A
Embedded processor fields in an iframe on your page, such as Stripe Elements	SAQ A, if you can confirm your page isn't susceptible to script attacks
Your site builds the payment page and sends card data straight to the processor, such as direct post or a JavaScript form	SAQ A-EP
Card numbers pass through your server to the processor's API	SAQ D, the most demanding

The dividing lines come from the PCI Security Standards Council. If any element of a payment page originates from your website, the integration isn't eligible for SAQ A. The Council's reasoning is that hosted pages and iframes resist transparent theft of card data as it is typed, while direct post and JavaScript forms don't.

Scripts on the payment page. PCI DSS v4 added requirements 6.4.3 and 11.6.1, in effect since March 31, 2025, so that payment page scripts are authorized, checked for integrity, and monitored for tampering. In January 2025 the Council removed them from SAQ A and replaced them with an eligibility criterion: you must confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems. Its FAQ 1588 says the criterion applies only when your page embeds a processor's payment form, not to redirects, and that you can meet it by protecting the page with techniques like those in 6.4.3 and 11.6.1, or by getting confirmation from your PCI DSS compliant processor that its solution includes them. The requirements were removed only from SAQ A; they remain in the standard.

This is where a store built quickly, by hand or by an AI coding agent, picks up the most compliance weight without anyone deciding to. A card form made of plain inputs that submits to your own API works, and it moves you from SAQ A to SAQ D. Every analytics tag, chat widget, and A/B testing script on a page that embeds card fields is a script you answer for.

Records, receipts, and income reporting

The IRS sets how long you keep the records behind a tax return: 3 years in general, 6 years if you leave out income of more than 25% of the gross income on the return, 7 years if you claim a loss from bad debt or worthless securities, 4 years for employment tax records, and indefinitely if you don't file or file a fraudulent return. For an online store, those records are the orders, refunds, fees, and payouts that add up to your reported income.

Form 1099-K. Payment apps and marketplaces, which the IRS calls third party settlement organizations, file a 1099-K for you only when your payments exceed $20,000 across more than 200 transactions. The One, Big, Beautiful Bill restored that threshold retroactively, reinstating the one in effect before the American Rescue Plan Act of 2021. Card processors report payments you accept by credit, debit, or gift card with no minimum. Neither changes what is taxable: the IRS expects all income from sales to be reported, whether or not a form arrives.

Reconciliation. A processor pays out a net amount: sales minus refunds, fees, and disputes over some window. Matching that deposit to the orders it came from is how you prove your books, and it requires the order, the payment, the fee, and the payout to share identifiers you can join on.

Customer data, privacy, and email

State privacy laws. The California Consumer Privacy Act applies to a for-profit business doing business in California that meets any one of three tests: gross annual revenue of $26.625 million or more (the figure since January 1, 2025), buying, selling, or sharing the personal information of 100,000 or more California residents or households, or earning 50% or more of revenue from selling or sharing personal information. Covered businesses must answer requests to know, correct, and delete within 45 calendar days, extendable once by another 45. Other states set their own scope; Virginia's law, for example, applies to businesses that process personal data of at least 100,000 consumers a year, or 25,000 if more than half of gross revenue comes from selling personal data.

Deletion has limits that matter for a store. California's law doesn't require deleting information that is reasonably necessary to complete the transaction it was collected for, or to comply with a legal obligation, which is why a deletion request should remove the buyer's identity and keep the financial record of the sale.

Breaches. Every state, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, has a law requiring businesses to notify people when their personal information is breached. The rules on timing, content, and whom else to notify vary by state; the FTC's breach response guide also tells you to notify law enforcement and any business whose account data was exposed.

Email. CAN-SPAM treats order confirmations, shipping updates, and other messages that complete or update a transaction the buyer already agreed to as transactional, exempt from most of the law. A message whose subject line reads as an ad, or that leads with promotion before the transaction details, is commercial. For commercial email, you need accurate headers and subject lines, your physical postal address, and a working opt-out honored within 10 business days. Penalties reach $53,088 per violating email, and you can't contract that responsibility away to your email provider.

Reserves, account closures, and MATCH

A processor that pays you before your buyers' disputes and refunds settle is taking your credit risk, and its terms let it limit that risk. Stripe places a reserve when it sees increased risk, such as long delivery windows, a risk of unfulfilled orders, elevated dispute activity, or an unexplained jump in volume, and in rare cases holds one indefinitely. Its Services Agreement lets it suspend services for reasons that include unacceptable risk and higher fraud, and close an account at any time.

A closure can follow you. Acquirers must screen applicants against Mastercard's MATCH list and Visa's VMSS and report merchants they terminate for qualifying reasons. MATCH reason code 4, excessive chargebacks, applies when a month's Mastercard chargebacks exceed 1% of that month's Mastercard sales transactions and total $5,000 or more. Winning the disputes later doesn't remove it, listings stay for 5 years, and most processors reject listed businesses and their principal owners. PCI DSS non-compliance and account data compromise are MATCH reasons too.

Website accessibility

The Department of Justice's position, in guidance published March 18, 2022, is that the ADA's requirements for businesses open to the public apply to the goods and services they offer on the web. It has no regulation setting detailed technical standards for private businesses and points to the Web Content Accessibility Guidelines as a reference. A checkout that can't be completed with a keyboard or a screen reader is a service offered on the web that some buyers can't use.

What the order record has to hold

Treated as data requirements, these obligations converge on one record. The payment alone, an amount against a card, answers almost none of them. The order around it has to carry:

On the record	Needed for	The rule behind it
Items, quantities, and the product description the buyer saw	Disputes for items not as described; Visa CE3.0 responses	Visa's CE3.0 asks for a description of the products in the disputed and prior transactions
Price, discounts, and tax per line, with the jurisdiction	Sales tax returns, line-item refunds, and the tax those refunds reverse	California excludes returned merchandise from taxable sales only when the full price, including tax, is refunded
The refund policy version shown, and when the buyer accepted it	Disputes for refunds not processed or cancellations	Visa: keep records of how and when the cardholder acknowledged the policy, and keep prior versions with their effective dates
Buyer account, shipping address, IP address, and device identifier	Fraud disputes	CE3.0 matches these across the disputed payment and two earlier undisputed ones
The promised ship date, the actual ship date, carrier, tracking, and delivery confirmation	Item-not-received disputes and FTC shipping deadlines	The FTC rule runs from the time you state, or 30 days
Delay notices sent, and the buyer's answers	FTC delay rules	A buyer's silence counts as consent only to the first delay of 30 days or less
Each refund: which items, how much, how much tax, and when	FTC refund deadlines, tax returns, and dispute responses	Seven working days after a cancellation for card orders
Subscription consent and every cancellation request	ROSCA and state auto-renewal laws	California: keep proof of consent for 3 years, or 1 year after the contract ends, whichever is longer
Payment IDs, processing fees, and the payout each amount landed in	Reconciliation, income reporting, and matching a Form 1099-K	IRS: keep records 3 years in general, 6 or 7 years in some cases

Three properties matter as much as the fields. The record has to be durable: it outlives the customer's account, a privacy request, and a migration between processors, for at least the IRS's 3 years. It has to be immutable where the rules look back: a dispute is judged on the price and policy at the time of purchase, not on today's catalog. And it has to join: one order to its payments, refunds, shipments, tax lines, dispute, and payout, without a reconciliation script holding the keys together. A store that keeps the payment in a processor and the sale in its own tables has to build all three properties itself, and the drift between the two halves is where they usually fail.

Five gaps that turn into liabilities

The refund policy lives in the footer#
You lost a dispute for a refund your policy didn't owe, because nothing showed the buyer agreed to that policy.
Visa's merchant guide lets you set your own return, refund, and cancellation policy, but for online purchases it has to appear before checkout with a checkbox or click-to-accept, or on the checkout page near the place order button. A link in the site footer is neither, and the policy that counts in a dispute is the one presented at the time of purchase.
Confirm it
Open your checkout as a buyer and look for the policy next to the button that places the order. Then look in your database for the policy version each order was placed under.
Fix
Show the policy, or a link to it, next to the place order button, store the version and the acceptance time on the order, and keep every prior version with the date it took effect.
Refunds move money but not tax#
Your sales tax return reports tax on orders you refunded months ago, so you remit tax on money you gave back.
A refund that only records an amount against a charge doesn't say which items it covers or how much of it was tax. California's rule for returned merchandise excludes the sale from taxable receipts only when the full price, including the tax, is refunded. Without a per-line record of the tax that went back, the deduction is guesswork.
Confirm it
Pick a partial refund from last quarter and find, in your own data, the tax amount it reversed and the jurisdiction that tax belonged to. If you can't, neither can your return.
Fix
Refund against line items, compute the tax share of each refunded line, and store it with the refund so tax reports can net it out by jurisdiction.
A generated card form posts card numbers to your server#
Your checkout works, and your annual PCI questionnaire grew from SAQ A to SAQ D.
A checkout form with plain inputs for card number, expiry, and CVC that submit to your own API, which then calls the processor, works on the first try, whether you or a coding agent wrote it. Card data passing through your server is the integration Stripe's PCI guide puts in SAQ D, the most demanding questionnaire. Even with the processor's fields, a payment page built on your site keeps its scripts in your scope.
Confirm it
Search your front end for inputs named like card number or CVC, and your server logs and request bodies for 13 to 19 digit numbers. Any hit means card data touches your systems.
Fix
Collect card data only in the processor's hosted page or its embedded fields, and inventory and monitor every script on any page you host around those fields.
Shipping lives in a different system than the order#
An item-not-received dispute is due in four days, and the tracking number is in a label tool that doesn't know the order ID.
Disputes for items not received are won with the order, the tracking number, the delivery address, and delivery confirmation, all tied to the disputed payment. When fulfillment sits in a spreadsheet or a shipping tool keyed by its own IDs, assembling that packet becomes a manual search against a 7 to 21 day deadline, and the FTC's shipping rule needs the same dates to show you shipped on time.
Confirm it
Take a random payment from 60 days ago and time how long it takes to produce its items, ship date, carrier, tracking number, and delivery confirmation.
Fix
Record each shipment against the order's line items, with carrier, tracking, ship time, and delivery status, so evidence is a query instead of a search.
Deleting a customer deletes your sales history#
A privacy request removed a customer, and the cascade took their orders, refunds, and tax lines with it.
California's deletion right has exceptions, including information a business needs to complete the transaction or to comply with a legal obligation, and the IRS expects records for at least 3 years. A foreign key with cascading deletes turns one privacy request into a gap in your tax records.
Confirm it
Read the delete path for customers and follow every relation it cascades to. Anything financial on that path is at risk.
Fix
Anonymize the customer instead: clear name, email, phone, and addresses, and keep orders, payments, refunds, and tax with the identity removed.

Questions, answered

What am I responsible for when I sell online in the US?

The business that sells carries the obligations, whoever wrote the checkout. The main ones: disputes and card-not-present fraud losses, the FTC's shipping and refund deadlines, disclosure and cancellation rules for subscriptions, sales tax in states where you cross an economic nexus threshold, PCI DSS for card data, record keeping and income reporting, and privacy and email rules. A payment processor covers card data handling and money movement; the policies, tax filings, and records are yours.

Who pays when an online customer uses a stolen card?

Usually you. When the cardholder disputes the payment as fraud, the disputed amount comes out of your balance along with a dispute fee. The exception is liability shift: payments successfully authenticated with 3D Secure typically move fraud liability to the card issuer, though Stripe's docs say it is never guaranteed, and it doesn't cover disputes for other reasons, such as an item not received.

How much does a chargeback cost a merchant?

The disputed amount, which is held for the length of the dispute and kept by the cardholder if you lose, plus fees. On Stripe's US pricing, receiving a dispute costs $15 that isn't returned, and responding costs another $15 that is returned if you win. Every dispute, won or lost, also counts toward the card network ratios that can lead to fines.

Do I need to collect sales tax on my online store?

Possibly in states where you have no physical presence. Since South Dakota v. Wayfair in 2018, states can require remote sellers to collect once their sales into the state cross a threshold. South Dakota's is now more than $100,000 a year; California and Texas use $500,000; New York requires more than $500,000 and more than 100 sales over four quarters. In New York and Texas, a marketplace collects on the sales it facilitates for you; sales through your own store are yours to collect on.

Do I need to be PCI compliant if I use Stripe?

Yes. Stripe's docs call PCI compliance a shared responsibility: Stripe is certified as a Level 1 service provider, and a business accepting payments must attest to its own compliance every year. A redirect to a hosted checkout, or embedded card fields on a page you've secured against script attacks, can keep you on SAQ A. Sending card numbers through your own server moves you to SAQ D.

How long do I have to ship an online order?

Under the FTC's Mail, Internet, or Telephone Order Merchandise Rule, the time you state, or 30 days if you state none. If you can't make it, you must tell the buyer before the deadline, give a revised date or say you can't give one, and offer the choice to cancel for a full refund. Card orders that are canceled must be refunded within seven working days.

How long do I need to keep sales records?

The IRS says 3 years in general, 6 years if you leave out more than 25% of your gross income, 7 years for bad debt or worthless securities claims, and indefinitely if you don't file or file fraudulently. Other rules add their own: California's auto-renewal law requires proof of subscription consent for 3 years, or 1 year after the contract ends if that is longer.

Does the Form 1099-K threshold change what I owe?

No. The threshold decides who receives a form, not what is taxable. Payment apps and marketplaces file a 1099-K when your payments exceed $20,000 across more than 200 transactions, after the One, Big, Beautiful Bill restored that threshold retroactively. Card processors report card payments with no minimum. The IRS expects you to report all income from sales whether or not a form arrives.

What Flint covers, and what it doesn't

Flint is a commerce API that keeps the order and its payments in one record, so several of these obligations move from your code to the platform. The rest stay yours, as they would anywhere.

Covered by the order record

Card data and the payment page. On Flint's hosted checkout, Flint runs the page, the buyer's session, and the code around the card fields, and card details go to Stripe Elements. If you build your own checkout, card data still stays in Stripe's frames, but the page's scripts become yours; Securing a headless checkout covers what that means for PCI scope.

Disputes. Each dispute carries its order_id, customer_id, payment_intent_id, evidence_due_at, and is_action_required, and the dispute.created and dispute.needs_response webhooks open the case. A deadline queue is one request:

cURL

curl --get https://api.withflintpay.com/v1/disputes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  --data-urlencode "status=needs_response" \
  --data-urlencode "evidence_due_before=2026-07-15T00:00:00Z" \
  --data-urlencode "page_size=100"

Merchants answer in the Flint dashboard, or in your own interface through a response session that embeds Stripe's dispute component. Flint doesn't store the evidence documents or customer messages. A card dispute's event fee is the card network's own dispute cost, passed through with no Flint markup, and risk rules can require 3D Secure on the payments you choose.

Refunds and tax. Refunds are made against the order: the whole order, an amount, specific line items, or one payment. Flint works out which payments to refund and how much tax comes back, and refunds stay blocked while a dispute on the payment is under review: