Well that depends, where the business is licensed and where the product is shipped form, I guess. Here is a review of the law.

What exactly does the law require?

In brief, INFORM requires online marketplaces (i.e., platforms that enable third parties to engage in sales, purchase, payment, storage, shipping, or delivery of consumer products in the US) to do the following:

Collect and Verify Seller Information: Marketplaces must collect and verify certain identifying, contact, and financial information from high volume third party sellers operating on their platforms. Such sellers are those that (in any 12-month period during the previous 24 months) have entered into 200 or more transactions involving new or unused products, with aggregate gross revenues of $5000 or more, and for which payment is processed by the marketplace or its payment processor. Marketplaces also must request and obtain information updates, at least annually.

Disclose Information to Purchasers: For high-volume third party sellers with aggregate gross revenues of $20,000 or more, marketplaces must make certain “clear and conspicuous” disclosures to purchasers, so purchasers have recourse if something goes wrong. The required disclosures are: (1) specified contact information for each seller, either on the seller’s product listing pages or in the purchaser’s order confirmation and transaction history; and (2) a “reporting mechanism” to allow purchasers (and presumably anyone) to report “suspicious marketplace activity” to the relevant marketplace.

Suspend Noncompliant Sellers: Marketplaces must suspend any seller that fails to comply with the above collection, verification, update, and disclosure requirements within specified timeframes.

Protect the Information: Marketplaces may only use the data they collect to comply with the law and must provide reasonable security for this data.

Notably, INFORM’s legal obligations all fall on the marketplaces. They are the entities subject to enforcement and civil penalties if INFORM’s requirements are not adhered to. They are the ones responsible for ensuring compliance after a seller reaches the “high volume” sales and revenue thresholds. (This is true even for the disclosure requirements, which must appear on sellers’ landing pages or in their communications with purchasers.) However, the Act will have significant, if indirect, effects on high volume sellers, too, who will risk swift suspension if they fail to furnish accurate and timely information to the market places, or fail to cooperate in providing the required disclosures.

Why was this law passed?

The law is designed to address concerns about the sale of stolen and counterfeit goods online, which, according to the law’s sponsors and several influential reports (see here and here), harms consumers and costs legitimate businesses billions of dollars a year. These sales often occur through online marketplaces, where criminals exploit the anonymity of the web to sell goods that have been stolen from stores, and/or are counterfeit or unsafe, and where the marketplaces historically have had minimal obligation to verify the identity of sellers.

As press releases heralding passage of the Act explained, requiring marketplaces to verify sellers’ identities will “shine a light” on anonymous online sellers, thus choking off a key avenue for them to sell stolen and harmful goods, while also protecting online purchasers and legitimate competitors.