After pressure from a bipartisan coalition of 25 state attorneys general, Shopify recently ordered all electronic nicotine delivery systems (ENDS) merchants to remove vaping products from their online stores built on its eCommerce platform. While the coalition was specifically targeting illegal sellers (those whose products were not FDA approved), Shopify took a broader course of action and banned all products, even those that are authorized.
This story caught the attention of our team here at Human Element, and we got together to talk it through. Our panel included Jason Magee, managing partner; Kevin Gardner, development manager; Dane Dickerson, client strategy team lead; Sabra Bander, director of account management; Gary Goodman, senior strategist; and myself.
Shopify’s Decision Leaves Merchants Scrambling
A blanket ban on this industry got us wondering why Shopify took this approach. We reasoned that broad restriction was easier and less risky for Shopify than evaluating whether thousands of individual merchants are compliant. It also seems likely that scrutiny from payment processors and credit card networks played into the decision.
Regardless of the exact reasons, when merchants were given a two-week notice — Shopify’s announcement came out on June 24 and gave merchants until July 8 to comply — to remove these products or shut down their store, this swift and broad action raised some questions.
- What are the eCommerce platform alternatives for vape vendors?
- How quickly can these vendors spin up a new webstore to help mitigate revenue loss and brand erosion?
- What other regulated industries might be next?
Limitations of SaaS Commerce Platforms
Software as a Service (SaaS) platforms like Shopify simplify hosting, security, updates, and payment processing. And time to market, especially with Shopify, is a huge advantage. However, that convenience can come with a loss of control. As we’ve seen in this scenario, the platform may be able to:
- Remove products or suspend a store
- Freeze funds
- Change fees or policies
- Restrict payment options
- Require migration on a compressed timeline
Merchants technically own their own business but are reliant on infrastructure governed by someone else. So what is a vape vendor who’s left scrambling to do? Unfortunately, the answer isn’t clear cut. The options are:
- choose another SaaS platform
- choose a licensed, on-premises option
- build a custom platform
- choose an open source option
Choosing the Best Platform for Your Regulated Industry Business Site
While SaaS models offer considerable flexibility and several key advantages, they also come with certain limitations. Software-as-a-Service platforms provide a user-friendly approach that enables businesses — particularly small and medium-sized companies — to launch an eCommerce site quickly with little to no custom code. They are well suited for organizations that want to manage day-to-day eCommerce operations without relying heavily on developers.
On-premises platforms, whether licensed or custom-built, offer businesses greater control through a more traditional development and deployment model. These solutions are typically hosted on a company’s own servers or through a third-party hosting provider, giving the business ownership of the codebase and the flexibility to customize nearly every aspect of the eCommerce experience. A software provider cannot necessarily deactivate a self-hosted store as easily as a SaaS provider can suspend an account.
The important distinction for this particular use case: with an on-prem model, you own and are responsible for everything. A software provider cannot necessarily deactivate a self-hosted store as easily as a SaaS provider can suspend an account. You own the code and your data, and you are also on the hook for keeping the system running efficiently and securely. Merchants have to follow the law and maintain security, PCI compliance, hosting, and software updates.
If you sell regulated products, on-prem may be the best option for you. The potential downside is it comes at a cost and isn’t the speediest way to get up and running. But the tradeoff may make those costs worthwhile.
You can read more about the difference between these two models in this blog post.
Risk Is Not Equal for Every Merchant
Choosing the right platform — whether you are replatforming under duress, replatforming to improve performance, or just getting started with your eCommerce storefront — is critical to mitigate risk.
We’re writing this as a cautionary tale about regulated industry merchants and the risk for something like this to happen in other industries is low. Conventional retailers selling apparel or household goods, for example, face little danger of category-wide prohibition.
But this isn’t necessarily the case for businesses selling products that are highly regulated, age-restricted, or exposed to changing state laws, with products such as:
- Alcohol
- Cannabis
- 2A products such as firearms and firearm accessories
- Compounded pharmaceuticals
- Healthcare-related products
- Live animals
- Other age-restricted or high-risk goods
The question isn’t whether SaaS is inherently bad or that an on-prem solution is the only answer. It is whether a particular platform’s policies and business model fit the merchant’s risk profile.
Platform Selection Must Account for Regulatory Risk
When considering a platform, in addition to considering features, pricing, design, and launch speed, regulated businesses should also take into account:
- Whether the product category is permitted
- Whether permission depends on using the platform’s payment system
- Which high-risk payment gateways are supported
- Whether age verification or geographic restrictions can be implemented
- How quickly products can be removed by state or region
- Who owns and controls the underlying data
- What happens when policies change
- How difficult it would be to migrate
The Challenge of an Emergency Replatform
Two weeks may be enough time to remove banned products from a web store, but what is the longer-term play for merchants who want more control over the way they sell online? Migrating from one platform to another — depending on the size and scope of your business or product selection — can take significant time and resources.
Migrating from SaaS to a self-hosted platform would be difficult to do in a short timeframe. A minimal viable product may be the first step. Get a basic commerce store up and running and add features and integrations later.
Potential complications of having to start over are:
- Exporting customer, order, and product data
- Rebuilding payment processing
- Implementing age verification
- Reconnecting the ERP, shipping tools, tax systems, and marketing platforms
- Preserving search visibility and redirects
- Rebuilding design and frontend functionality
- Operating while funds or revenue are disrupted
No Matter Your Industry or Platform, A “Digital Go Bag” is a Must Have
Yes, it is a little more tricky for regulated industries to protect themselves from situations like the one vape vendors find themselves in with Shopify. But our panel concluded that the real story here is this:
Do everything you can to ensure that you have set in place as many protections as possible to not be left stranded when anything outside of your control threatens your ability to do business online.
And let’s be clear, outside threats are not limited to SaaS providers making changes that deeply impact a business. They can also include things like cyber attacks, hosting provider failures, or data breaches, for example.
In order to be prepared, our team suggested putting together a plan — a “digital go bag” (a term coined by Gary Goodman, the strategist on our panel) — to help deal with a crisis. Whether you’re in a regulated industry or not, a digital go bag can be a lifesaver. It can include:
- Current exports of product, customer, and order data
- Copies of product images, videos, documents, and other media
- Documentation of integrations and data flows
- Access credentials and a record of account ownership
- Copies of themes, custom code, and configuration details where available
- A list of alternative platforms, hosts, and payment processors
- An emergency migration plan with internal and external contacts
- A clear understanding of which business functions depend on each SaaS provider
The cost (in time, effort, and dollars) of putting these backups in place will be far less than the cost of starting over should the need arise.
Be Prepared and Remain Vigilant
To summarize, the Shopify decision is a specific event that impacted a particular industry, but the lesson applies broadly. Don’t assume that today’s policies and laws won’t change. Evaluate your risk thoroughly during platform selection and keep on top of it as laws, payment rules, and platform policies evolve. Working with a trusted agency is one way to help you choose the platform that best suits your needs, and Human Element has 20+ years of experience doing just that.
