Insight: If You Give a Mass. a Cookie … It’ll Ask You to Collect Sales Tax

Daily Tax Report: State provides authoritative coverage of state and local tax developments across the 50 U.S. states and the District of Columbia, tracking legislative and regulatory updates,...

Bloomberg Tax regularly spotlights the insights of state and local tax professionals at Grant Thornton. In this installment of Grant Thornton Insights, Brian Howsare discusses cookie nexus, a lesser utilized method of requiring remote sellers to collect sales tax.

Brian Howsare

By Brian Howsare, with contributions from Rob Clarke and Adam Raschke

Brian Howsare, JD, is a State and Local Tax Manager in Grant Thornton LLP’s Tampa office. Rob Clarke, JD, is a State and Local Tax Principal in Grant Thornton LLP’s Tampa office. Adam Raschke, JD, is a State and Local Tax Senior Manager in Grant Thornton LLP’s Tampa office.

In the wake of the South Dakota v. Wayfair [901 N.W.2d 754 (S.D. 2017), cert. granted, 199 L. Ed. 2d 602 (2018).] oral arguments [U.S. Supreme Court, No. 17-494.] on April 17, the online retail world is parsing the questions posed by the justices. The retailers are trying to predict what, if anything, will become of the physical presence requirement established in QuillCorp. v. North Dakota. [504 U.S. 298 (1992).] While the potential outcomes vary drastically, there are numerous scenarios in which the physical presence standard could remain in place after the U.S. Supreme Court issues its opinion. If this occurs, states will continue to find creative ways of maximizing their collection impositions within the limitations imposed by Quill and National Bellas Hess, Inc. v. Department of Revenue. [386 U.S. 753 (1967).]

One option, as noted in the Wayfair arguments, is for states to impose notice requirements similar to those put in place by Colorado, which have coerced many online vendors to begin collecting the state’s sales tax. Another option, however, is to draft “cookie nexus” laws similar to the one adopted by Massachusetts. With cookie nexus, out-of-state sellers are deemed to have a physical presence with the state simply by placing a cookie on the computer or device of an in-state purchaser. Although it arrived with less fanfare and open controversy than Colorado’s notice requirements, Massachusetts’s cookie nexus approach may be better positioned to impact the sales tax landscape for online sellers.

Physical Presence and Adoption of the Massachusetts Regulation

In recent decades, with the rapid rise of the online retail industry, states increasingly perceived a massive loss of sales tax revenues as consumer purchases shifted from brick-and-mortar retailers to out-of-state online retailers such as Inc. Very often, these retailers would not collect or remit a state’s sales and use tax, considering themselves excluded from the state’s collection requirements under the standard set in Quill—specifically, that an out-of-state vendor must have a substantial physical presence in a state before a state can require the vendor to collect the state’s sales and use tax. To recapture this lost revenue, states successfully enacted so-called “Amazon laws,” which used novel interpretations of “physical presence” to establish nexus and impose collection obligations on out-of-state retailers. Despite these laws, states still determined that they were missing out on too much revenue from online retail. As a result, states shifted their focus away from establishing nexus within the limitations of Quill, in favor of trying to lay to rest the Quill physical presence standard altogether. South Dakota is the most prominent example of this trend, having enacted a nexus law with the stated purpose of generating a legal challenge to overturn the Quill standard. [S.D. Codified Laws Secs. 10-64-1 to 10-64-9, as enacted by S.B. 106, Laws 2016.] Other states with similar laws establishing nexus primarily on sales volume as opposed to physical presence include Alabama and Vermont. [S ee Ala. Admin. Code r. 810-6-2-.90.03(1); Vermont Act 134 (H. 873), Laws 2016.] This challenge ultimately culminated in a U.S. Supreme Court case: Wayfair.

In contrast to South Dakota’s campaign to put to rest the physical presence requirement, Massachusetts adopted a regulation in the spirit of the prior Amazon laws that aimed to further erode Quill’s utility. Effective September 22, 2017, Massachusetts adopted Mass. Regs. Code tit. 830, Sec. 64H.1.7, Vendors Making Internet Sales. [The requirements set forth in this regulation were originally published as Directive 17-1, which was subsequently withdrawn due to a successful challenge by online retailers ( Am. Catalog Mailers Ass’n f. Heffernan, Memo. of Decision and Order Entering Declaratory Judgment on Count I of Plaintiffs’ Verified Compl ., Mass. Superior Ct., No. 2017-1772 BLS1 (Jun. 28, 2017)) in which the directive was deemed to be invalid on procedural grounds because it was essentially drafted as a regulation. See Directive 17-1, Massachusetts Department of Revenue, April 3, 2017, revoked by Directive 17-2, Massachusetts Department of Revenue, Jun. 28, 2017. Note that Directive 17-1 was revoked before its scheduled July 1, 2017 effective date.] The regulation requires out-of-state Internet retailers to collect and remit Massachusetts sales tax to the extent that the vendor uses cookies that are stored on the computers or devices of in-state customers. [Mass. Regs. Code tit. 830, Sec. 64H.1.7(1)(b)(2), (3), (4).] The regulation provides that a vendor has physical presence to the extent that (among other requirements) it has “property interests in and/or the use of in-state software (e.g., ‘apps’) and ancillary data (e.g., ‘cookies’) which are distributed to or stored on the computers or other physical communications devices of a vendor’s in-state customers, and may enable the vendor’s use of such physical devices . . ..” The collection requirement is only imposed to the extent that the vendor’s annual sales total at least $500,000 or 100 individual transactions. [ Id.] Cookies are defined by the regulation as:

Text data files generally used by an Internet vendor to enhance its sales. Cookies are stored locally on computers and physical communications devices of the customers of an Internet vendor when such customers visit the vendor’s website for the first time and act to identify the customer on each subsequent visit.

Simply stated, cookies are minute files that websites put on a device’s browser to recognize that device on return visits to the site. By tracking the device’s (and thus the device user’s) history, the website can tailor its presentation for the user. This contact and its claimed potential to enhance vendor sales, the state suggests, is sufficient contact to constitute a physical presence under Quill.

Is the Cookie Rule Constitutional?

This is a tricky question. Constitutionality is a concept that, at least in theory, is independent of revenue considerations that are concerning to states that have adopted cookie nexus to recapture the revenues that would otherwise be lost to online sales. Other states’ recent kill- Quill nexus laws have spurred compliance from many online retailers without a challenge. For instance, some reports indicate that Alabama has seen substantial compliance with its new economic nexus model. [Jennifer McLoughlin, Many Companies Accepting States’ Growing Online Tax Reach, Bloomberg Tax Daily Tax Report: State, May 4, 2017.] Similarly, since Colorado’s notice requirements were upheld in Direct Marketing Ass’n v. Brohl [814 F.3d 1129 (10th Cir. 2016), cert. denied, 137 S. Ct. 591 (2016).], many companies have opted to begin collecting and remitting sales tax rather than providing customer purchase data to state tax authorities and sending use tax notices to the customers. It makes sense that for many online retailers, the available technology may make compliance a better alternative. If large online retailers continue to fall in line without challenging this rule, then it is possible that the state may not have to force the issue and subject its rule to a legal challenge.

If history is an indicator, however, not all retailers will fall in line quietly. Retailers have been quick to challenge aggressive nexus laws in other jurisdictions. [ See Complaint at 13, South Dakota v. Wayfair, Inc., No. 32 Civ. 16-000092 (6th Cir. Apr. 28, 2016); Newegg, Inc. v. Dep’t of Revenue, No. S. 16-613 (Ala. Tax Trib. appeal filed Jun. 8, 2016) (challenging the economic nexus laws in South Dakota and Alabama).] Industry groups are also likely to join the fray because they were responsible for the defeat of the first iteration of Massachusetts’ cookie rule. [NetChoice and American Catalog Mailers Association were the industry groups to challenge and defeat Massachusetts’ initial directive on this rule. See Complaint, Am. Catalog Mailers Ass’n v. Heffernan, No. 2017-1772 BLS1 (Mass. Super. Ct. Jun. 9, 2017) (challenging Directive 17-1), Mass. Dep’t of Revenue, Directive 17-2 (Jun. 28, 2017).] So although the state may recognize a substantial degree of unchallenged compliance, it is also likely to find itself in a fight on this issue if the physical presence standard survives Wayfair.

But Seriously, Is it Constitutional?

Possibly. The best indicator of success for Massachusetts may be the track record of prior court rulings on physical presence. Over the past 25 years, the trend of state court rulings on nexus challenges has been in favor of state tax authorities and their increasingly inclusive views of the concept of physical presence. Most notably, state courts have validated the laws that created affiliate nexus and click-through nexus in California and New York, respectively. [ SeeBorders Online v. State Bd. of Equalization, 129 Cal. App. 4th 1179, 1196 (Cal. App. 1st Dist. May 31, 2005) (upholding affiliate nexus between an online bookseller and its brick and mortar affiliate);, Inc. v. N.Y. Dept. of Taxation & Fin., 20 N.Y.3d 586 (N.Y. 2013) (upholding click-through nexus for online retailers and] Even outside of nexus controversies, state courts have appeared more inclined to apply the physical presence limitation in as narrow a manner as possible. [ See, e.g.,Lamtec Corp. v. Wash. Dep’t of Revenue, 246 P.3d 788 (Wash. 2011) (finding that the Quill physical presence requirement does not apply to Washington’s B&O excise tax); KFC Corp. v. Iowa Dep’t of Revenue, 792 N.W.2d. 308 (Iowa 2010) (holding that the Quill physical presence requirement does not apply to Iowa’s corporate income tax).] It could certainly bode well for Massachusetts if the trend of state courts to diminish the physical presence limitation continues.

However, this is not to say that victory for the state is a certainty. Massachusetts would have to overcome one major hurdle: convincing the court that cookies constitute more than the “slightest physical presence.”

In addressing this issue, the threshold question is whether a cookie can be considered a “physical presence” at all. It can certainly be argued that the electronic data that comprises a cookie is intangible and therefore incapable of creating a physical presence. A cookie, after all, cannot physically be held, weighed, or touched on its own. But the idea of what can be considered “tangible” is expanding in many contexts. In many jurisdictions, for instance, “tangible personal property” is defined broadly to include any object that can be seen or measured or is in any manner perceptible to the senses. [ See e.g., Ind. Code Sec. 6-2.5-1-27 (2017); Ohio Rev. Code Ann. Sec. 5739.01(YY).] These blanket definitions often include items that may not typically be thought of as tangible, such as electricity or software, even when the software is not associated with any tangible medium. [ Id.]

Granted, cookies are not software applications. A cookie, as contemplated by the regulation, is a text data file that is stored locally on the device of a customer that visits a vendor’s website. The data file acts to identify the customer on subsequent visits to the vendor’s website. Software, on the other hand, is generally thought of as a more complex sequence of code that can perform a function. Although different, the two, generally speaking, seem to share common characteristics: being comprised of code and for the purpose of impacting a user’s interaction with an application. This commonality is likely why software and cookies are also lumped together by the regulation, which depends on the seller’s use of “software (e.g., ‘apps’) and ancillary data (e.g., ‘cookies’)” stored on the devices of in-state customers. Accordingly, since software is more commonly being considered tangible, it would not seem too far a stretch to consider cookies as tangible, and therefore a physical presence, as well.

Another issue that the state would have to overcome is that the in-state cookies must not just constitute a physical presence, they must be more than the slightest physical presence. An ideal example of the slightest physical presence may be gleaned from Quill itself. In Quill, a retailer’s ownership of a floppy diskette that was present in the state was not sufficient to establish nexus. [ See Quill, 504 U.S. at 315 n.8 (noting that the presence of a few floppy diskettes owned by Quill did not establish substantial physical presence).] Relative to a floppy disk, a data file stored on a customer’s browser is unquestionably less of a physical presence. The cookies, however, if viewed in the aggregate, could arguably be much more substantial than a diskette. In terms of quantity, cookies are placed on every computer or device that visits a specific website. [Although in some instances, cookies may be erased after a browsing session or rejected.] Because individuals access websites through multiple devices, one individual could be responsible for the placement of cookies on multiple machines. In a state like Massachusetts, with over six million residents, even a website with modest traffic could place thousands of cookies on devices in the state. Websites with heavy traffic could likely place hundreds of thousands or millions of cookies.

In terms of value, the cookies collectively are far more substantial than the floppy disks. One criteria that has been considered by courts weighing the Amazon laws is the extent to which the in-state contacts serve to establish a market in the state. [ See Borders Online, 129 Cal. App. 4th at 1196 quoting Tyler Pipe Industries v. Dep’t of Revenue, 483 U.S. 232, 250 (1987).] Most online shoppers can likely identify with ease the role that retailers’ cookies play in establishing and maintaining a market—remembering the customer’s prior searches, displaying items that are recommended for the customer, suggesting offerings based on geography and demographics, and presenting advertisements that are related to the customer’s browsing history—all functions that serve to facilitate and increase sales. When considering the volume and value of the cookies collectively, there is a good argument to make that their presence is substantial. Consequently, cookie-based nexus may have all the ingredients needed to survive a constitutional challenge.

Cookie-Based Nexus: A Half-Baked Rule or the Future of Nexus Law?

Even with the implementation of Amazon laws and the corresponding erosion of Quill’s physical presence limitations, the perceived amount of uncollected tax on online sales has been too much for some states to bear without taking action. In response, the push to kill Quill was born and has steadily gained momentum.

This kill- Quill movement, however, may be (or has been) the path of most resistance in states trying to close the gap of online sales tax collections now that there is an alternative that can achieve the same ends. Lower courts, being bound by U.S. Supreme Court jurisprudence, were all but forced to rule against South Dakota in its Quill challenge. [Of course, anticipatory overrulings by lower courts are possible. In fact, the Quill case itself overturned an anticipatory overruling by the North Dakota Supreme Court. See State ex rel. Heitkamp v. Quill Corp., 470 N.W.2d 203, 208 (N.D. 1991).] Stare decisis may yet prove to make for a more difficult battle at the U.S. Supreme Court as well. Additionally, in the Wayfair arguments, at least one justice suggested that the issue was not with Quill’s restraints, but with the states’ ability to enforce their use tax laws. While cookie-based nexus is not an easy dunk, it would seem that the cookie rule has a better chance of surviving a constitutional challenge than the kill- Quill laws, at least at lower court levels. And if cookie nexus were to make its way to the U.S. Supreme Court, it could be seated more advantageously as the lower court winner.

At least one other state seems to be following the path taken by Massachusetts. Ohio has followed suit with a similar law, stating that substantial nexus with the state is presumed to exist when a vendor “uses in-state software” to sell taxable goods or services to Ohio customers. [Ohio Rev. Code Ann. Sec. 5741.01(I)(2)(h) (effective Jan. 1, 2018). The seller must have Ohio gross receipts in excess of $500,000 for this provision to apply. Id.]

To the extent that Wayfair does not result in a reversal of the physical presence requirement, additional states will likely be looking look for an alternate (or additional) way to reach more online sales. If enough states decide that nexus based on cookies can serve this end, Massachusetts’ cookie nexus rule may emerge as the favored approach to supplant the kill- Quill movement.

Copyright © 2018 Tax Management Inc. All Rights Reserved.

Request Daily Tax Report: State