On December 27, 2020, and after threatening a veto, President Donald Trump signed the Consolidated Appropriations Act, 2021 (CAA) into law.  Despite the headline element of the bill being direct payments of $600, the spending package also contained a bill entitled the Preventing Online Sales of E-Cigarettes to Children Act (POSEC). This bill, hidden on page 5137, will have far-reaching negative effects for consumers of non-combustible tobacco products in terms of availability, price, and the security of consumer data.

POSEC amends the Prevent All Cigarette Trafficking Act (PACTA) to allow the federal government, state governments, and tribal authorities to enhance regulation of electronic vaping products. By amending PACTA to include electronic cigarettes, the federal government has taken steps to prevent consumers from receiving electronic cigarettes through the United States Postal Service and requires sellers to make regular reports regarding consumers to federal, state, and tribal authorities.

These actions will not only raise the cost of electronic cigarettes and limit the availability of a less harmful product that routinely diverts people from smoking, but it could also compromise consumer data.

One of the most profoundly damaging aspects of POSEC is how it will force lower-income and rural Americans to use more costly shipping options. Under the new rules, sellers of e-cigarettes will be unable to use the United States Postal Service to send their products. Instead, they will be forced to use more expensive carriers such as FedEx or the United Parcel Service. The raised cost of shipping will be particularly harmful to rural consumers, who smoke at higher levels than urban consumers, and face  Delivery Area Surcharges from both FedEx and UPS that add up to $31.50 to the cost of shipping.

For low-income Americans, the increased cost of shipping electronic cigarettes will likely see them turn to the more harmful alternative. Researchers have shown that if the costs of e-cigarettes are raised, consumers will turn to traditional combustible cigarettes. This should be particularly concerning to health officials because low-income Americans are significantly more likely to consume traditional tobacco products and will struggle to meet the increased costs.

The POSEC Act also poses a significant risk to the privacy of consumers who regularly purchase vaping products. Under current federal statutes, those who sell, transfer, or ship tobacco products, including electronic cigarettes, across state lines must “file with the tobacco tax administrators a copy of the invoice covering every shipment made during the previous calendar month.” Included in this invoice must be “the name and address of the person to whom the shipment was made.”

For individuals who purchase electronic cigarettes, these new requirements will see federal, state, and tribal authorities maintain records of sensitive information, information that is at risk of falling into the hands of cybercriminals. What should concern consumers about this aspect of PACTA is that state and local authorities are routinely targeted by cybercriminals. Since 2017, BlueVoyant estimated there have been 108 attacks on state and local governments. Making the situation worse is the fact cybersecurity infrastructure varies widely across the country, meaning consumer data in one state might be significantly more vulnerable when compared to another.

The regulatory changes to electronic cigarettes could also inflict significant harm to a growing sector of the U.S. economy. The Vapor Technology Association estimated in 2019 that this industry generated $9.15 billion in economic activity and provided 166,007 jobs that “earned wages and benefits of about $7.90 billion.” Raising the cost and limited access to electronic cigarettes could see this economic activity needlessly lost.

In an age when consumers are turning to safer alternatives than traditional combustible tobacco products, the federal government should not be enacting legislation that raises costs and leaves consumer data vulnerable to cybercriminals. Instead, they should be creating a regulatory environment that actively encourages to choose healthier alternatives by expanding access and lowering costs.