C Is for Cookie, That’s Good Enough for New York: P.L. 86-272 Regs on Internet-Based Activities Upheld

Why It Matters

The ruling solidifies New York’s authority to tax out‑of‑state e‑commerce firms based on non‑solicitation internet activity, shaping multistate tax compliance strategies for online retailers.

Key Takeaways

• NY regulation upheld; not preempted by P.L. 86‑272
• Protection applies only to in‑state solicitation activities
• Cart‑only cookies retain tax exemption
• Tracking cookies trigger franchise tax liability
• Future cases require factual activity analysis

Pulse Analysis

New York’s affirmation of 20 NYCRR 1‑2.10 marks a pivotal moment for state tax authorities grappling with the digital economy. By interpreting the decades‑old P.L. 86‑272 in the context of modern e‑commerce, the court draws a clear line: only activities that constitute solicitation within New York’s borders enjoy the historic exemption from franchise tax. This nuanced approach acknowledges that static website content and basic cart‑support functions, such as session‑based cookies, do not constitute a taxable presence, preserving a level of predictability for businesses that merely host product listings.

The decision, however, introduces a sharper focus on data‑driven practices that extend beyond direct solicitation. Cookies employed to track user behavior, aggregate search terms, or build profiles for future marketing are now classified as non‑solicitation activity, subjecting out‑of‑state sellers to New York franchise tax. This distinction aligns with broader trends where states leverage digital footprints to establish nexus, echoing recent developments in California and Texas. Companies must therefore audit their web analytics and customer‑engagement tools, ensuring that any tracking mechanisms are either limited to the transaction window or re‑engineered to avoid creating a taxable nexus.

For multistate retailers, the ruling underscores the importance of a granular, fact‑based nexus analysis. While the appellate court refrained from issuing a blanket rule, it signaled that future disputes will hinge on the specific nature and purpose of online interactions. Legal and tax teams should collaborate to map each digital touchpoint against the solicitation criteria outlined in the regulation. Proactive adjustments—such as segregating tracking scripts to servers outside New York or obtaining explicit consent for data collection—can mitigate exposure and align compliance programs with the evolving landscape of internet‑based tax obligations.