Massachusetts is the latest state to attempt to narrow the scope of Federal law P.L. 86-272. On October 10, the Commonwealth issued final regulations targeted at cookies placed on computers or other electronic devices of in-state customers, as well as post-sale activities.

The regulation, 830 CMR 63.39.1, provides that if a business has more than $500,000 in annual sales in Massachusetts, the mere placement of internet cookies on in-state customers’ computers or other electronic devices may demonstrate more than ancillary activities sufficient to eviscerate P.L. 86-272 protections. Specifically, the regulation provides that the use of cookies will go beyond the protections of P.L. 86-272 if such cookies “gather customer search information used to adjust production schedules and inventory amounts, develop new products, or identify new items to offer for sale.” The regulation further provides, citing Wisconsin Department of Revenue v. William Wrigley, Jr., that post-sale activities will generally not be considered entirely ancillary to solicitation.

In enacting this rule as a formal regulation, the state aimed to avoid the pitfalls other states have experienced. For instance, in California informal guidance was invalidated by the court in American Catalog Mailers Association v. Franchise Tax Board, and in New York retroactive application of its rule was struck down by the court in American Catalog Mailers Association v. Department of Taxation and Finance. Massachusetts also appears to have aimed to strike a balance in the regulation by imposing a minimum threshold of sales before the cookies or post-sale activities will trigger tax obligations.

It remains to be seen whether this middle-ground approach will be sufficient for Massachusetts. While following its rule-making procedures may help the Commonwealth avoid a claim under the Administrative Procedures Act, and the prospective nature of the regulation avoids any retroactivity claim, the regulations may nonetheless be subject to challenge, for several reasons. First, it is not clear under what authority Massachusetts can enact a regulation interpreting a federal statute, nor limit a federal statute preempting state law. Ultimately, resolution may require action by Congress to amend the Federal statute. Second, even if this regulation were deemed valid, the regulation oversimplifies where a “cookie” (i.e., a string of code) may reside. A cookie may be on a server or in the cloud and not actually on the device itself, making the location difficult, if not impossible, to know. 

Courts have previously rejected the Massachusetts Department of Revenue’s argument, in the pre-Wayfair sales tax context, that cookies give rise to physical presence nexus, in U.S. Auto Parts Network Inc. v. Commissioner of Revenue. This regulation could offer the courts an opportunity to revisit the issue in the income tax context. Properly identifying what the use of cookies means for an out-of-state business is critically important for a business trying to understand its tax obligations in the state.