What data sources do states use to identify ecommerce brands for sales tax audits?
State Departments of Revenue do not wait for brands to self-report. They operate inbound data feeds that build a picture of a seller's revenue footprint before any audit notice issues. Four feeds matter most for a brand registered in 20 to 40 states.
1099-K reports from payment processors
Under IRC §6050W, payment processors that settle merchant transactions are required to report gross payment volume to the IRS.[1] Shopify Payments, Stripe, and PayPal each file 1099-K forms annually. The original reporting threshold was $20,000 in gross payments plus 200 transactions; Congress lowered it to $600 under the American Rescue Plan Act, and the IRS has been phasing in that reduction with intermediate thresholds for transition years.[1] The IRS transmits 1099-K data to participating states under the federal-state data-sharing agreement administered through the Federation of Tax Administrators.[2] A brand processing $400,000 through Shopify Payments in California is visible to the CDTFA regardless of whether the brand has filed a California return.
The audit-selection logic follows directly. If a 1099-K reports $180,000 in Massachusetts and the brand has no Massachusetts return on file, the state threshold is $100,000 under 830 CMR 64H.1.9.[13] DOR systems match 1099-K data against registered sellers and flag unregistered high-volume merchants automatically.
Marketplace facilitator settlement data
Under marketplace facilitator statutes now enacted in every state with a sales tax, platforms like Amazon, Walmart, and eBay are required to collect and remit tax on facilitated sales.[3] They also report gross settlement amounts to state DORs. This gives states a view of a brand's marketplace revenue that is separate from and additive to the 1099-K data. A brand generating $1.5M through Amazon and $800,000 through its own Shopify storefront may appear in state audit pipelines from both feeds simultaneously.
Customs and excise data for cross-border physical goods
Brands importing goods through US ports generate CBP (Customs and Border Protection) records. For certain categories of physical goods, that data flows to state tax authorities with active cross-border enforcement programs. This feed is most relevant for brands with high international sourcing volume selling finished goods into states where they have not registered.
IRS data sharing
The federal-state data-sharing agreement allows state DORs to access IRS audit findings and adjustment notices.[2] If an IRS examination of a brand results in federal tax adjustments, participating states receive notification and can open their own examinations based on the same underlying facts without conducting independent selection.
Whistleblower and employee tip programs
Most states operate a formal tip line and reward program for information about tax noncompliance. The California CDTFA accepts and compensates tips.[4] The Texas Comptroller's office has a published informant policy.[5] A former employee with specific knowledge of unreported sales in a given state is the highest-credibility signal a DOR audit unit can receive.
Cross-state data sharing and the MTC Joint Audit Program
A brand that treats audit risk as siloed by state is misreading the enforcement architecture.
The Multistate Tax Commission operates the Joint Audit Program, which coordinates simultaneous sales and use tax audits across multiple member states from a single examination.[6] An auditor from one participating state conducts the fieldwork; findings are shared with and accepted by all other participating states in the program. More than 40 states participate as of 2026. A brand selected for a joint audit by California may simultaneously be subject to an examination in New York, Texas, Washington, and Illinois without any separate selection process in those states.
The data-sharing mechanism that feeds joint-audit selection is the Multistate Information Sharing Agreement (MISA), which allows state DORs to exchange taxpayer data with each other.[7] A registration event in one state creates a data record that flows to adjacent states through MISA. A brand that registers in Colorado because it crossed the $100,000 threshold (Colo. Rev. Stat. §39-26-102(3)(b)) becomes visible to state tax authorities in states where it has not yet registered.
State-to-state data sharing operates at the operational level as well: auditor networks. Revenue officers in high-enforcement states communicate directly with counterparts in adjacent states. A CDTFA auditor who discovers a brand has significant nexus exposure in Washington during a California examination routinely flags the finding to the Washington DOR.
For a brand with a 25-state footprint, the implication is that a compliance failure in one state is a compliance risk across all of them. An audit opening in one state can trigger examinations in 20 others without any independent selection event.
Consistent monthly filing cadence is the primary behavioral signal that suppresses this cross-state exposure. TaxCloud's consolidated SST filing across the 23 full member states plus Tennessee as associate produces a regular filing record in the states where filing-frequency consistency matters most for audit-selection purposes. A brand filing on time every month across all SST states is not producing the cadence anomalies that DOR systems queue for review.
Which states are most active on remote-seller enforcement in 2026
Not every state pursues remote-seller audits with the same intensity. Five states account for a disproportionate share of multi-state ecommerce audit activity in 2026.
California (CDTFA)
The California Department of Tax and Fee Administration operates a dedicated remote-seller enforcement unit that cross-matches 1099-K data against California-registered sellers and marketplace settlement data against unregistered out-of-state sellers. California's $500,000 threshold (Cal. Rev. & Tax. Code §6203) means only high-volume brands face the registration obligation, but the CDTFA pursues retroactive audits going back to the brand's threshold-crossing date.[8]
New York (DTF)
The New York Department of Taxation and Finance operates a remote seller compliance program that is among the most aggressive in the country. New York's AND test ($500,000 AND more than 100 transactions, measured over the preceding four sales tax quarters; NY Tax Law §1101(b)(8)) means the threshold requires both conditions simultaneously, but the DTF's retroactive lookback and its MTC joint-audit participation make New York a recurring source of multi-state exposure.[9]
Texas (Comptroller)
The Texas Comptroller's marketplace facilitator audit initiative reconciles facilitator-reported settlement data against registered seller returns. Texas counts total revenue including exempt sales toward its $500,000 threshold (Tex. Tax Code §151.107; 34 TAC §3.286), which means brands underestimate Texas exposure when measuring only taxable sales.[10] The Comptroller requires registration and collection by the first day of the fourth month after the threshold month.
Washington (DOR)
The Washington Department of Revenue pursues combined economic-and-physical-nexus enforcement, reviewing both threshold data and physical presence indicators simultaneously. Washington's threshold counts cumulative gross receipts including facilitated sales (RCW 82.08.052), and Washington routinely contests deregistration claims from brands that attempt to exit after dropping below the threshold.[11]
Illinois (DOR)
Illinois is running a Remote Retailer Amnesty Program from August 1 through October 31, 2026, for remote retailers that have not previously registered.[12] Brands that participate receive penalty waivers and capped lookback. Brands that were selling into Illinois before 2026 without a registration and do not participate in the amnesty window will be visible to the Illinois DOR as post-amnesty audit targets. Illinois's current threshold is $100,000 (35 ILCS 185; P.A. 104-0006, effective 1/1/2026) on a dollar-only basis following removal of the 200-transaction test.
| State | Threshold | Enforcement focus | Key inbound data feed |
|---|---|---|---|
| California | $500,000 (Cal. Rev. & Tax. Code §6203) | Remote-seller enforcement unit | 1099-K + marketplace settlement |
| New York | $500,000 AND >100 tx (NY Tax Law §1101(b)(8)) | Remote seller compliance program | 1099-K + MTC joint audit |
| Texas | $500,000 total revenue (Tex. Tax Code §151.107) | Marketplace facilitator audit initiative | Marketplace settlement data |
| Washington | $100,000 gross receipts (RCW 82.08.052) | Combined nexus enforcement | Gross receipts + physical presence |
| Illinois | $100,000 (35 ILCS 185; eff. 1/1/2026) | Post-amnesty enforcement | Amnesty non-participant list |
Internal signals that elevate audit risk
State DOR audit-selection systems weight specific patterns in a seller's filing history. Five internal patterns consistently surface in multi-state audit contexts.
Sudden filing-frequency changes
A brand that files monthly in a state and shifts to quarterly without explicit DOR approval produces an anomaly that selection systems flag. Monthly filers are required to stay monthly above certain revenue thresholds. A shift to quarterly reads as either a genuine volume decline or an attempt to reduce filing obligations while volume remains high. Both outcomes are auditable: one requires a threshold review, the other opens a compliance examination.
Large exempt-sales spikes
A brand that reports a sharp increase in exempt sales in a quarter without a corresponding business change (new B2B channel, new product line entering an exempt category) draws attention. Exempt-sales claims require supporting exemption certificate documentation. A spike that the brand cannot support with a current, valid certificate chain is a primary audit finding in B2B-heavy ecommerce operations. Exemption certificate management at scale means every exempt transaction is paired with a valid, non-expired certificate in a retrievable format. TaxCloud's exemption certificate workflow handles collection, validation, and renewal, so exempt-sales reconciliation is documentable on the day of an audit notice rather than reconstructed three months later.
Refund patterns inconsistent with stated returns rate
A brand claiming a high refund rate against filed returns while 1099-K data shows proportionate gross volume creates a reconciliation gap. DOR systems check whether refund claims are consistent with gross sales volume reported by payment processors.
Threshold crossings on 1099-K with no corresponding return
This is the most direct selection signal. A 1099-K from Shopify Payments reports $180,000 in Massachusetts.[13] No Massachusetts return on file. The gap between the payment-processor report and the seller's filing record is an automated flag in most DOR matching systems.
Marketplace-collected offsets that don't reconcile to the seller's return
A brand selling through Amazon is not responsible for remitting tax on Amazon-facilitated sales, but Amazon's settlement data shows the gross facilitated amount. Some states require sellers to report marketplace-facilitated volume even though they don't remit on it, and to show the facilitator-collected offset explicitly. A brand that omits facilitated volume entirely produces a return that doesn't match the marketplace data the DOR already holds. That discrepancy is a direct reconciliation trigger.
The VDA flag: how voluntary disclosure in one state surfaces exposure in others
A brand that has operated unregistered across multiple states and completes a Voluntary Disclosure Agreement to remediate prior-period exposure faces a follow-on risk that is not well understood at the time the VDA is executed.
The VDA closes the prior period in the state where it is executed. It does not close prior-period exposure in other states. What it does create is a data record. The VDA filing establishes that the brand was operating in that state without registration during the prior period. Under the Multistate Information Sharing Agreement (MISA), that data record is available to other state DORs.[7]
The result is a predictable sequence. A brand completes a VDA in Texas covering 2021 through 2024. Texas marks the VDA as closed. Within 12 to 18 months, the California CDTFA, the New York DTF, and the Washington DOR may open examinations based on the inference that a brand operating at Texas revenue volumes during that period was also selling into their states without registration.
The VDA is the right remediation tool for prior-period exposure. The risk is real and manageable, not a reason to avoid VDAs. The operational implication is that a brand approaching a VDA in one high-volume state should evaluate its exposure profile across all states simultaneously, not sequentially. Completing Texas, waiting for the cascade, and then remediating California one audit at a time is substantially more expensive than a coordinated multi-state VDA approach executed before any state contact.
Staying off the trigger map: the operating model
Audit selection is probabilistic. A brand cannot eliminate the possibility of a state audit. It can systematically avoid the signals that elevate selection probability. The operating model breaks into four areas.
Regular, correct filing cadence across all registered states
Filing on time, in the correct frequency tier for each state, with no unexplained gaps, is the most effective way to suppress filing-frequency-change flags. For a brand registered in 30 states, this means a filing calendar that accounts for each state's frequency rules and due dates. The SST states simplify this significantly: a consolidated filing covering the 23 full SST member states plus Tennessee as associate reduces 24 separate state compliance actions to one.
Current nexus map across all registered states
A nexus map should reflect the current physical footprint (3PLs, FBA inventory nodes, remote employees, contractors) and current economic nexus status in every state. A nexus map that lags the actual footprint by six months creates registration gaps, which produce the threshold-crossing-with-no-return pattern that is the clearest selection signal.
Marketplace-offset reconciliation, documented
A brand selling through Amazon, Walmart, or eBay should be able to show, for any taxable period, the gross marketplace volume, the facilitator-collected amount, and the net amount reported on its own return. That documentation should be current and retrievable before any audit notice arrives.
Exemption-certificate evidence chain, current and retrievable
Every exempt sale should have a corresponding certificate that is valid, complete, and stored in a format producible within the timeframe a state audit notice typically requires. Certificates that expire and are not renewed before the next exempt transaction are a recurring primary finding in B2B ecommerce examinations.
A brand registered in 25 to 40 states is managing compliance at real operational scale. The work that keeps a brand off the trigger map is exactly the work that compounds into audit exposure when left inconsistent: filing cadence, nexus currency, marketplace reconciliation, certificate management. Consolidated SST filing across the 23 full member states handles the cadence requirement; the exemption certificate workflow keeps the certificate chain retrievable before a notice arrives; the reporting API produces the marketplace-offset documentation the prior paragraph describes.