By Jason Carignan

Top Takeaways:

• Enforcement gap: Retail and e-commerce restrictions cannot adequately address an illicit vape market that increasingly operates through informal supply chains and independent retailers.
• Technology shift: Device-level identity verification, product authentication and access controls could extend compliance beyond the point of sale and into actual product use.
• Two-front strategy: Stronger enforcement against illicit products and compliance technology embedded in legal products must work together to create a viable regulated market.

Last year, the U.S. Food and Drug Administration stated that roughly 54% of vape products sold in the United States are unauthorized and illegally distributed.

For disposables, the category most used by young people, Truth Initiative’s retail scan data puts that figure at 86%. An April 2026 Government Accountability Office report found that enforcement, despite record seizures in 2025 and new legislative authority to destroy illicit imports, still lags behind the market’s actual scale.

This is the commercial reality every legitimate vaping manufacturer operates in. Non-combustible nicotine products generally pose lower health risks than combustible cigarettes, and the evidence that they help adult smokers switch is well established.

But the illicit market and underage access undermine that public health logic. When most products in circulation are unverified, untested for safety, and sold without access controls, regulators face pressure to restrict everything rather than fix the enforcement failure driving the problem.

The premarket tobacco product application (PMTA) process was designed to protect public health, but in practice it has become a competitive disadvantage for compliant manufacturers and a subsidy for those that don’t comply.

Companies are investing in clinical studies, regulatory submissions, and compliance infrastructure to compete on legal shelves against products that have done none of those things and are priced accordingly. Until policymakers treat that as the primary problem, every other intervention addresses only a fraction of the market, while the majority continues unimpeded.

Currently, age verification occurs at the counter. It cannot prevent proxy purchasing, authenticate the product, or confirm that the person using it is a verified adult. Nor can it tell a consumer whether the product in their hand is what it claims to be. Most people buying illicit vapes don’t realize they’re doing so. Once a product is in circulation, whether through a licensed retailer or an illicit channel, the compliance system has no further reach.

That gap is precisely what has pushed enforcement toward blunter instruments. Shopify plans to remove all vaping products from its platform after pressure from a bipartisan coalition of state attorneys general. Mastercard has warned payment processors that investigations and fines will follow for partners facilitating unlicensed sales.

But most unauthorized products are manufactured in China, enter the U.S. through informal supply chains, and reach consumers via independent tobacco, liquor, and convenience retailers, not chain c-stores or mainstream online platforms. Removing a sales channel displaces compliant manufacturers without touching the market driving the problem.

The FDA has now formally acknowledged the structural gap and identified a technological solution. For the first time, its draft guidance recognized device access restrictions and technology built into the product itself as part of the public health analysis for flavored electronic nicotine delivery system (ENDS) applications.

In May, the agency authorized four Glas products and described their system of government-ID verification, smartphone pairing, and random biometric check-ins as a potential game changer. Compliance infrastructure that resides in the device, verifying identity, authenticating the product, and enforcing access at the moment of use, is now within the regulatory frame.

Critics are right that device-level technology is not a complete solution on its own. The FDA has said it may not be sufficient to justify flavored vapes without substantial clinical evidence that these flavors are appropriate for the protection of public health (APPH). The path forward requires two things. Enforcement against illicit imports needs to operate at a scale that matches the problem.

The END Act authorizes the FDA to destroy illicit imports at the border, and the $200 million Congress allocated for fiscal 2026 enforcement needs to be deployed urgently. The legal market also needs compliance infrastructure that stays with the product, including authenticated hardware, verified identity at the point of use, and auditable data that regulators can inspect and researchers can study.

These are not competing priorities. They are the same priority approached from different angles. Clearing the illicit market creates the conditions for device-level compliance to work and a commercially viable market for compliant manufacturers. Device-level compliance gives the legal market a defensible architecture that enforcement alone cannot provide. Neither works without the other. But both give consumers confidence that the product they are using is genuine and has met required standards.

For manufacturers serious about building in this category for the long term, the compliance question has become as much a commercial issue as a regulatory one. The companies investing in authenticated, verifiable, access-controlled products are building the only defensible commercial position in a market where enforcement alone has already proven insufficient. The tools exist now, and the question is whether the industry is ready to use them.

Jason Carignan is a founding member of IKE Tech and chief commercial officer at Chemular, Inc.