PL 86-272 Explained: Safe Harbor Activities and Audit Risks

Under Public Law 86-272, protected activities are limited to soliciting orders for tangible personal property and the narrow set of in-state functions that exist only to support that solicitation. Anything an employee, independent rep, or contractor does inside a state that serves an independent business purpose — servicing customers, holding inventory, approving orders locally, providing technical help — falls outside the safe harbor and gives the state authority to impose net income tax on the company.

The statute is narrow by design. It shields only net income taxes, only sellers of tangible goods, only sales that cross state lines with approval and shipment from outside the destination state, and only companies that are not incorporated or domiciled in the taxing state.¹ Sales taxes, gross receipts taxes like Ohio’s commercial activity tax or Washington’s B&O, franchise taxes not measured by net income, and property taxes are all outside its reach.² Service providers, SaaS vendors, and companies licensing intellectual property get no protection at all, because they are not selling tangible personal property. Once those threshold conditions are met, the question of which in-state activities keep the immunity intact becomes the whole game.

How Courts Decide What Counts as Solicitation

The Supreme Court set the working definition in Wisconsin Department of Revenue v. William Wrigley, Jr., Co. in 1992. The Court read “solicitation of orders” to cover both the literal act of asking for a purchase and activities that are ancillary to it, meaning activities that serve no independent business purpose apart from requesting sales. Recruiting sales staff, training them, evaluating their performance, and renting hotel rooms for sales meetings all fit that description.³

The Court also recognized a de minimis exception, but it is narrow enough that most auditors treat it as nonexistent. Wrigley’s reps replaced stale gum on store shelves and occasionally sold product directly from stored inventory. Those tasks had their own business function — keeping shelf presence fresh and moving product — separate from asking retailers to place orders. That was enough to sink the company’s immunity in Wisconsin.³

The practical test that comes out of Wrigley: if the activity would still make business sense even if it never produced a sale, it is probably not ancillary to solicitation, and it is probably unprotected.

Activities That Stay Within the Safe Harbor

The Multistate Tax Commission’s Statement of Information catalogs the specific in-state activities that qualify as solicitation or ancillary support.⁴

A sales representative taking orders in the state and forwarding them to an out-of-state office for approval.
Missionary sales work — introducing products or cultivating potential customers — without accepting payment or closing the sale on the spot.
Distributing free product samples and promotional literature to prospective buyers.
Checking a customer’s stock levels to gauge the need for a reorder, as long as the check is incidental to soliciting the next order.
Using hotels, homes, or other temporary spaces for sales meetings and rep recruiting.
A sales rep working from a home office, provided the company does not pay for or lease the space and the office is not publicly attributed to the company.
Providing company cars, training, and field supervision to sales staff inside the state.
Investigating customer complaints about defective products or late shipments, so long as no repairs or ongoing maintenance are performed.
Collecting current or overdue accounts through independent third parties or through legal action.
Delivering goods in a company-owned truck, but only when the delivery is the immediate continuation of an interstate shipment.

Each of these either directly involves asking for a purchase or exists only because the company has a sales force in the field. That is the throughline. The moment an activity starts serving the customer rather than selling to the customer, it drifts across the line.

Activities That Void the Protection

A single unprotected activity by any employee or agent can destroy immunity for the whole company in that state. The MTC identifies the following as exceeding the solicitation safe harbor:⁴

Repairing or servicing products already sold, warranty or otherwise.
Installing equipment or machinery at a customer’s site, or supervising installation.
Having a company employee (as opposed to an independent third party) collect delinquent accounts.
Investigating a customer’s creditworthiness or accepting cash or checks at the time of the order.
Storing goods in a warehouse, distribution center, or any company facility, other than non-monetary product samples.
Providing design, engineering, or consulting services related to the products.
Training a customer’s employees on how to use the product, unless the training is limited to a brief demonstration during the sales pitch.
Hiring, training, or supervising employees who are not part of the sales function.
Using a company credit card for local purchases or maintaining a company bank account in the state.
Accepting or rejecting orders inside the state rather than routing them to an out-of-state location.
Stationing a resident sales manager who supervises staff and handles administrative duties beyond personal selling.

The line that trips up companies most often is between complaint resolution and repair work. A rep who calls a customer to apologize for a late shipment is fine. That same rep picking up a screwdriver to fix a jammed mechanism has just created nexus for the entire company.

Website and Digital Activities

The MTC has revised its Statement of Information to apply the same framework to online activity. The controlling principle is direct: if a website performs an activity that would be unprotected coming from a human sales rep, it is unprotected when the website does it.⁵

Protected Online Activities

A website stays inside the safe harbor when it functions as a digital catalog and order form. Displaying static product information, posting FAQs, letting customers download an order form, and providing an email address for inquiries all qualify. Accepting orders through the site is also protected, provided the orders are transmitted to and fulfilled from a location outside the customer’s state.⁵

Unprotected Online Activities

The MTC’s unprotected list is where most modern sellers create nexus without realizing it:⁵

Post-sale support through the site, including troubleshooting, product-use guidance, or technical help delivered by live chat or email. The MTC specifically calls out advising customers on how to use products after delivery.
Placing tracking cookies on in-state customers’ devices to gather data used to adjust production, develop new products, or identify new items to sell. That use serves a business function beyond soliciting the current order.
Using in-state personnel or contractors to repair, update, or maintain the company’s website.
Offering customers access to proprietary software or delivering subscription services through the site.
Using a content delivery network or cloud provider when the company directs the provider’s in-state activities beyond passive hosting.
Auto-renewing service contracts or licenses for anything other than tangible personal property.
Transmitting code or electronic instructions to repair or upgrade products already delivered to customers.

States Have Not All Adopted the Internet Guidance

The MTC’s position on internet activities is not the law everywhere. As of late 2025, New York, New Jersey, and Massachusetts have amended their regulations to align with the MTC’s approach. California’s tax agency issued a memorandum taking a similar view, but a court invalidated it on procedural grounds in 2023; even so, businesses report that California auditors continue to apply its principles in examinations. Many other states have taken no formal position, which leaves real uncertainty about how they would treat website-based activities in an audit. A seller in multiple states has to check each state’s stance individually rather than assume the MTC’s framework applies.

What a Lost Audit Costs

Immunity is not lost gradually. The moment an unprotected activity occurs, the company has nexus for net income tax purposes in that state, and the state can assess tax on all income apportioned to it — not only income tied to the offending activity.

The exposure comes in three layers. Back taxes cover every open year the company had nexus but did not file. Failure-to-file penalties commonly run around 5% of the unpaid tax per month, capped at 25%. Interest on underpayments accrues on top, generally in the 7% to 12% annual range across states. When the company has never filed a return, the assessment statute of limitations may never begin to run, which means the state can potentially reach back to the first year nexus existed. That is how PL 86-272 audits produce six-figure and seven-figure assessments.

Keeping the Protection Intact

Staying protected is an ongoing operational discipline, not a one-time legal conclusion. Auditors start from the assumption that people in a state are doing more than soliciting. The company has to be able to prove otherwise.

Train every person who enters the state on the company’s behalf, including employees, independent reps, and third-party vendors, on what they can and cannot do. Cover specific situations: what to do when a customer asks for installation help, what to do if a customer hands over a check, why inventory cannot be stashed at a local facility. Reps who do not understand the boundaries eventually cross them.

Keep detailed records of in-state travel and activity. Travel logs, expense reports, and meeting summaries are the primary evidence in an audit. Gaps in documentation get read against the company; an auditor who cannot see what a rep did on a given trip will assume the rep did something that voids immunity.

Review third-party contracts closely. An independent contractor performing installation, warranty service, or technical support on your behalf destroys immunity as effectively as an employee would. Contract language should limit the vendor’s in-state activities to functions on the protected list, and the company should periodically verify that the vendor is honoring the limits.

Consider filing a protective return in states where you claim immunity. A protective return does not concede that tax is owed; it formally notifies the state of your presence and your claim of protection.⁶ It also starts the statute of limitations running. Without a filed return, the assessment window may stay open indefinitely, keeping the company exposed to back-tax claims for every year it operated in the state.

1
Office of the Law Revision Counsel. 15 U.S. Code 381 – Imposition of Net Income Tax
2
Office of the Law Revision Counsel. 15 U.S. Code 383 – Net Income Tax Defined
3
Justia. Wisconsin Dept. of Revenue v. William Wrigley, Jr., Co., 505 U.S. 214 (1992)
4
Multistate Tax Commission. Statement of Information Concerning Practices Under Public Law 86-272
5
Multistate Tax Commission. Statement of Information Concerning Practices Under Public Law 86-272
6
Congressional Research Service. Public Law 86-272 and State Taxation