Toy, hobby and game store software in Baltimore: the warning on the box never reaches the product page

A boxed toy is two legal objects, and only one of them fits in a database

Walk into a small toy shop on Falls Road or a game store off Boston Street and pick up a boxed set. Somewhere on the carton, usually near the barcode, there is a black-bordered rectangle with a triangle in it. It says WARNING, then CHOKING HAZARD, then some short sentence about small parts, then a line telling you the toy is not for children under three. That rectangle is not decoration and it is not the manufacturer being careful. Its wording, its position, its type size and even the number of lines it occupies are specified by federal regulation, down to fractions of an inch.

Now take a photograph of that box, write two paragraphs of friendly copy about how much your nephew will love it, and publish it in the shop’s online store. The physical object has not changed. The legal object has. What you have just created is an advertisement that provides a direct means of purchase, and federal law has had something specific to say about those since 2008: the same cautionary statement is supposed to come along.

Almost nobody does it. We know this because we read the catalogs.

This article is about that gap and about six or seven others like it, all of which share a shape. In every case, a rule that a shopkeeper could satisfy in the physical store by putting the right thing on the right shelf becomes, online, a field — a piece of structured data that has to exist on a product record, be required at the point of entry, and render in a template. And in every case, the software most independent shops run has no such field. Not because the vendors are careless, but because a field that nobody asks for does not get built.

We build custom software for small businesses in Baltimore, so our interest here is practical rather than legal. We are not lawyers and this is not legal advice. What follows is an attempt to answer a narrower question that we run into on nearly every retail project: which of the obligations attached to a product survive the trip into a database, and which ones stop at the loading dock?

The rule: since 12 December 2008, the warning belongs on the page

The choking-hazard warning on toy packaging dates from the Child Safety Protection Act of 1994. For its first fourteen years it was a labeling rule, and labeling meant packaging, bins, display containers and vending machines. Then the Consumer Product Safety Improvement Act of 2008 added a new subsection to the statute, and the new subsection was about advertising.

The operative language is at 15 U.S.C. §1278(c)(1)(A). Any advertisement by a manufacturer, importer, distributor, private labeler or retailer for a product that requires one of these warnings, where the advertisement

“(including advertisements on Internet websites or in catalogues or other printed materials) that provides a direct means for the purchase or order”

must include the appropriate cautionary statement, displayed “on or immediately adjacent to that advertisement.” The statute names Internet websites in its own text. There is no interpretive stretch involved and no guidance document doing the work. Congress wrote the words down.

It also wrote down a deadline. §1278(c)(2)(A) gave internet advertisements 120 days from 14 August 2008, which lands on 12 December 2008. Catalogs got 180 days. That date matters for a reason we will come back to: this is not a new rule anyone could reasonably have missed. It has been in force for longer than most of the e-commerce platforms these shops run on have existed.

The implementing regulation is 16 CFR 1500.20, and it is the clearer of the two documents. Paragraph (d) states the requirement plainly — a product subject to a 16 CFR 1500.19 labeling requirement

“must bear that cautionary statement in the product’s advertising if the advertising provides a direct means to purchase or order the product”

and paragraph (c)(6) defines the trigger in terms nobody can argue with. A “direct means of purchase or order” includes

“Internet Web sites that enable consumers to purchase a product online or through the use of a telephone number”

There is one textual wrinkle worth knowing, because a careful reader will spot it. The “Scope” paragraph at 1500.20(a) describes the section as applying to catalog and other printed-material advertisements, a holdover from the fact that the 2008 Act only directed the Commission to write rules for catalogs. The internet obligation is self-executing in the statute and did not need a rule. Paragraphs (b), (c)(6) and (d) are all written generally and expressly name websites. The Commission itself resolves the tension in the obvious direction, in a business-guidance page called Common E-Commerce Safety Violations Found by CPSC, where it describes 1500.20(d) as requiring the cautionary statement in advertising that provides a direct means to buy

“(such as a webpage)”

Three words in a parenthesis, on the agency’s own site, under a heading about choking-hazard labeling. If you were looking for the sentence that converts a packaging rule into a content-management requirement, that is the one.

It is not one warning. It is six, and they are pictures

Here is the first place the physical world and the database diverge. A merchandiser thinks of “the choking warning” as a single thing. The regulation contains six distinct statements, and which one you owe depends on what the item is and who it is for. They live at 16 CFR 1500.19(b)(1) through (b)(4), and — a detail that tells you a great deal about why this data never made it into anyone’s product feed — the Code of Federal Regulations publishes them as images, not as text. To read them you have to open the figure files.

Read that table as a data model and the shape of the problem appears immediately. The statement is not free text. It is a value selected from a controlled list of six, where the selection is a function of three product attributes — does it contain a small part, a small ball, a marble or a latex balloon; what is the intended age floor; what is the intended age ceiling. A product record that stores those three attributes can compute the warning. A product record that stores a description cannot.

The regulation goes further and classifies the parts of the statement. Under §1500.19(d)(2) to (d)(4), “WARNING” is a signal word, “CHOKING HAZARD” is the statement of the principal hazard, and everything after it is other cautionary material. Each class has its own minimum type size, scaled across eight bands by the area of the display panel, in a table at §1500.19(d)(7) that runs from three sixty-fourths of an inch up to half an inch. Paragraph (d)(1) adds that the statements must be “blocked together within a square or rectangular area,” that this “means that the statements must appear on at least two lines,” and that they sit on a solid background.

Three type classes, a two-line minimum and a solid background is, in web terms, a component with three slots and a style contract. It is genuinely easy to build. It is just not something a product description field can express, which is why the one place you reliably find it — the printed carton — is the one place the data was structured to begin with.

One last detail, and it cuts against the shops rather than for them. §1500.20(e) allows an abbreviated warning — a numbering scheme from one to six, a safety-alert symbol, the words CHOKING HAZARD in capitals and a single age line. That allowance is written for catalogs and other printed materials, where space genuinely costs money. No equivalent abbreviation is granted for websites, where it does not. On a webpage you owe the full statement.

We read 16,759 product listings from six Maryland catalogs

We wanted to know what actually reaches the page, so on 20 September 2026 we read the public product feeds of six toy, game, hobby and comic retailers in Maryland — Baltimore-area and other Maryland shops whose storefronts publish a machine-readable catalog. We took the title, the full description HTML and the tags for every product, stripped the markup, and searched the resulting text for the things the rules above would put there. Where a shop’s catalog ran past the feed’s pagination limit we took the first 6,000 products. In total we read 16,759 distinct listings.

We are reporting pooled numbers only, and we are not naming which shop produced which figure. None of these businesses did anything unusual; the point of the exercise is precisely that the result is normal.

Two of 16,759. That is the headline, and on its own it would only tell you that small shops are busy, which everyone already knows. The interesting number is the one next to it.

The warning that travels is the one with a plaintiff attached

Four hundred and sixty-nine of those 495 warnings — ninety-five percent of every warning on every page we read — are California’s. They are the Proposition 65 notices, the ones that end in a link to www.P65Warnings.ca.gov, and they appear on the listings of a Maryland retailer selling to Maryland customers, at a ratio of 234 to one against the federal warning that those same pages actually owe.

A Maryland toy shop’s product page is two hundred and thirty-four times more likely to carry California’s warning than the federal one.

Nobody chose this. It is an emergent property of how product data moves. The Prop 65 text is in the listings because it is in the supplier feed — the spreadsheet or API response the distributor hands the retailer, which the retailer imports whole. It is in the supplier feed because California’s statute is enforced substantially by private plaintiffs who send notices of violation, which means a manufacturer that omits the warning has a concrete, countable, quarterly financial exposure. So the manufacturer put it in the product record. And once it was in the product record, it propagated, free of charge, to every retailer in the country, including retailers in states where nobody will ever ask for it.

The federal choking warning has no private plaintiff. It has an agency with a finite inspection budget and a preference for working with large marketplaces, which is why the enforcement you can find in public tends to involve Amazon or Walmart listings rather than a shop in Hampden. So it stayed on the carton, where the printer put it, and never entered the data layer at all.

The lesson is not really about toys. It is a general one about how compliance enters software, and we have watched it play out in enough projects to state it as a rule: a requirement gets into your product data when somebody upstream of you has a financial reason to put it there. Otherwise it does not, no matter how old the rule is or how clearly it is written. If you are deciding what to build, that is the test worth applying to every obligation on your list. The ones nobody upstream is motivated to send you are the ones you will have to model yourself.

The safe harbor is a database row

This is the part we did not expect to find, and it is the single most build-shaped fact in the statute.

Congress anticipated exactly the problem above. A retailer usually does not know whether a toy contains a small part; the manufacturer does. So §1278(c)(1)(B)(ii) gives the retailer a defense. A retailer is not in violation if the retailer

“requested information from the manufacturer, importer, distributor, or private labeler”

and was given false information, or was given none at all. Read that as a software requirement and it is startling. The defense is not a property of the product, the supplier or the shop. It is a record of an act — evidence that on some date you asked a named party a specific question about a specific item. If you have that record, the gap in your data is somebody else’s problem. If you do not, it is yours.

We have never seen an off-the-shelf retail system with a place to put this. There is no “supplier compliance request” object in Shopify, Lightspeed or Square. There is no field on a purchase order for “we asked whether this contains a small part and they did not answer.” And yet it is perhaps forty lines of code: a table with a supplier, a SKU or a purchase-order line, a question, a sent date, a response and a response date; a nightly job that flags any children’s-product SKU with no answered request; and a template that prints the log. Build that once and every unanswered question in your catalog becomes an asset instead of a liability.

It is also, incidentally, a purchasing tool. A supplier who cannot tell you the age grading and small-parts status of an item they are selling you has told you something useful about the supplier.

Your category tree is evidence

The next thing that surprises people is that the merchandising decisions made inside the CMS can change a product’s regulatory status, rather than merely describing it.

“Children’s product” is a statutory term, defined at 15 U.S.C. §2052(a)(2) as a consumer product “designed or intended primarily for children 12 years of age or younger,” and being one pulls an item into third-party testing, certificates and tracking labels. Four factors decide it, and the second of them is this:

“Whether the product is represented in its packaging, display, promotion, or advertising as appropriate for use by children 12 years of age or younger.”

Promotion and advertising. Not the design of the item, not what the factory intended, but how it is presented. When a shop builds a collection called Gifts for 8-year-olds and drops a hobby kit into it, or writes “great for younger players” in a board game’s description, or tags a model set with an age facet to make the site’s filters useful, it is producing evidence under factor two. The fourth factor points at the Commission’s Age Determination Guidelines, whose operative edition is the January 2020 staff document, superseding the 2002 version the statute still names by date.

We are not suggesting anyone should stop merchandising. We are pointing at where the compliance object actually lives. It is not in the warehouse and it did not arrive on a pallet. A person typing into a content-management system creates it, usually while thinking about conversion rate. That is an argument for making the CMS aware of the consequence — for example, by making the age facet and the small-parts flag the same act of data entry rather than two unrelated ones, so that tagging a product for the Ages 5–8 filter is also the moment the system asks whether it contains a small part.

Who this is actually about: 963 businesses, and 86% of them have no employees

Before going further it is worth being precise about the reader. The Census Bureau counts hobby, toy and game stores under NAICS 451120, and the 2023 County Business Patterns file gives Maryland 135 such establishments with a payroll, employing 1,685 people against an annual payroll of $34,329,000. That works out to $20,373 per employee, about sixteen percent below the national figure of $24,264.

The Baltimore–Columbia–Towson metro accounts for 69 of those establishments and 923 of the jobs. Size distribution is the important part. Of Maryland’s 135 stores, 54 have fewer than five employees and 97 — 71.9% — have fewer than twenty. Not one has fifty or more; the size-class rows reconcile exactly to the published total, so that zero is a real zero rather than a suppressed cell.

Baltimore City itself is suppressed at the six-digit level, but the four-digit aggregate gives it away. The city’s whole 4511 group is 19 establishments, of which 10 are sporting goods and 5 are musical instruments, leaving four for hobby/toy/game and sewing combined. Cross-checked against the metro file, the residual points to two or three employer toy-and-game stores inside the city line. FAO Schwarz was founded in Baltimore in 1862. The city now has two or three toy and game stores with staff on a payroll.

Except that is not the market, because the employer file is only 14% of it. Nonemployer Statistics — the only federal file that publishes receipts — counts 828 Maryland businesses in this industry with no employees at all, grossing $34,782,000, or $42,007 each against a national average of $64,403. Add the two files and Maryland has about 963 toy, hobby and game businesses, 86.0% of which are one person. Baltimore City has 31 of them, and they gross $88,129 each — the highest per-business figure of any jurisdiction in the state, more than double Baltimore County’s.

That is the customer. Not a chain. A person, or a person and three colleagues, running a shop with a website attached.

And the category is growing, which is the other thing worth saying. Maryland added fifteen establishments between 2022 and 2023, a 12.5% jump against a national rate of 3.9%. Nationally the pattern is more stores and smaller stores: establishments up 11.7% since 2019 while employment fell 2.9%, average store size down from 13.7 employees to 11.9. Circana reported US toy dollar sales up 6% in 2025 with Pokémon at $2.5 billion and up 87% year over year; ICv2 put the hobby games market at $3.66 billion, up 40%, in what it called the seventeenth consecutive year of growth; and Hasbro’s FY2025 annual report records Magic: The Gathering passing $1.7 billion, up 59%, its best year ever. Three unrelated sources, one story: more small stores, selling more cards, on software built for none of it.

We also looked at what those shops run. We probed twenty-seven candidate storefronts in Baltimore and the surrounding Maryland and DC region and could identify the platform on fourteen of them. Six are on Shopify, three on WooCommerce, two on Wix, one on Square Online, one on Lightspeed, and one on Crystal Commerce, the long-standing specialist for card stores. Two of the Shopify shops layer a trading-card system on top — one BinderPOS, one a TCGplayer integration. There is no dominant vertical product here. There is a general-purpose cart with a hobby bolted to the side.

The certificate moved upstream of the border in July

If you import anything directly — a pallet of European wooden toys, a case of Japanese model kits, a container of anything — the most consequential change in this area happened ten weeks before this article was published, and a lot of small importers have not noticed.

The Children’s Product Certificate has been required since 2008. 15 U.S.C. §2063(g)(3) says every certificate “shall accompany the applicable product or shipment of products covered by the same certificate,” and that “a copy of the certificate shall be furnished to each distributor or retailer of the product.” Under 16 CFR 1110.7 the party that issues it is the importer for imported goods and the manufacturer for domestic ones. A retailer never issues a certificate; a retailer receives one. Unless the retailer is the importer, in which case the retailer is both.

16 CFR part 1110 was rewritten wholesale in January 2025, and any description of it written before then is stale. §1110.11(a) now lists seven required elements: a unique product identifier drawn from a named list including GTIN, model number, SKU and UPC; every rule certified to, identified separately; the certifier’s full contact block; a records contact, which may be a position title “provided that the position is always staffed”; the date and place of manufacture; the date and place of testing plus each testing lab’s contact details; and the prescribed attestation. Records are kept five years (§1110.17) and must be producible “within 24 hours” on request (§1110.13(c)).

The useful part for anyone building a system is §1110.9(c), which blesses an electronic certificate so long as it is “identified prominently on the finished product, shipping carton, or invoice by a unique identifier” and can be reached “via a World Wide Web uniform resource locator (URL) or other electronic means.” In other words the regulation itself contemplates a foreign key. The clean model is a row on the SKU carrying a certificate URL, its unique identifier, any password, the issue date and the list of rules certified.

And then the deadline. CPSC’s eFiling rule, published at 90 FR 1800 in January 2025 and corrected in September 2025, took effect on 8 July 2026. Since that date an importer must transmit the certificate data elements electronically at the time of entry, through the ACE message set, before the goods enter commerce. Goods routed through a foreign trade zone follow on 8 January 2027. The Commission’s own announcement that day described the program as “now in effect.”

Read as a systems requirement: the seven data elements have to exist in a database before the container reaches the pier, not after it reaches the stockroom.

That is a genuine change in where product data has to live. For a shop that imports even one pallet a year, the certificate stops being a PDF in a drawer and becomes a record in the purchasing system, populated upstream of customs.

Tracking labels, recalls, and the join key nobody stores

Two more federal obligations are worth putting next to each other, because together they describe a single missing column.

15 U.S.C. §2063(a)(5)(A) requires a manufacturer of a children’s product to place “permanent, distinguishing marks on the product and its packaging, to the extent practicable,” sufficient to identify the maker, the location and date of production and the batch or run. CPSC’s guidance breaks that into four elements it expects to see. That is an obligation on the manufacturer, not the shop — but the data arrives at the shop, on the carton, at receiving, and nothing captures it.

Meanwhile 15 U.S.C. §2068(a)(2)(B) makes it unlawful to “sell, offer for sale, manufacture for sale, distribute in commerce, or import” a product subject to a voluntary corrective action of which the Commission has notified the public, or one under a Commission order. CPSC’s Resellers Guide to Selling Safer Products, published February 2025, puts it in one line: “It is unlawful to offer recalled products for sale under Section 19 of the Consumer Product Safety Act.” The same document is refreshingly clear about what it does not demand — “CPSC does not require resellers to test their products for safety” — and about who is expected to keep track: a business that resells is “expected to know” whether an item it sells has been recalled.

Notice the verb in the prohibition. Offer for sale. A product page is an offer. A recalled SKU that is out of stock but still published is still an offer for sale, and an unpublished draft that a customer can reach by an old link is worse. The control is not a note on the stockroom door; it is a scheduled job that diffs the catalog against CPSC’s recall data and force-unpublishes matches, with a log of what it unpublished and when.

The join key is the thing that makes both work. If receiving captures lot code, production date and production location against the SKU, then a recall notice naming a date range resolves to a list of orders and a list of customers in seconds. If it does not, a recall resolves to a week of somebody reading invoices.

A one-star review can start a legal clock

This is the obligation that most surprises retailers, and it lands squarely on the part of the software everyone thinks of as marketing.

15 U.S.C. §2064(b) applies to “every manufacturer…and every distributor and retailer” who obtains information reasonably supporting the conclusion that a product fails a safety rule, contains a defect that could create a substantial product hazard, or creates an unreasonable risk of serious injury or death. On obtaining it, the firm

“shall immediately inform the Commission of such failure to comply, of such defect, or of such risk”

and the Commission has defined “immediately.” 16 CFR 1115.14(e) reads it as “within 24 hours,” with weekends and holidays excluded from the computation under (a). If a firm wants to investigate first, (d) says that investigation “should not exceed 10 days” absent a demonstrated reason.

The paragraph that matters for software is (b): five days “should be the maximum reasonable time for information to reach” the chief executive or the person responsible for compliance. That is an imputation rule. It does not ask whether anyone read the message. It asks how long a well-run company should take to route it.

Now consider where information arrives in a modern shop. A product review saying a wheel came off and the toddler put it in her mouth. A return-reason code of “broken on arrival” selected four times in a month against the same SKU. A support ticket with a photograph. Each of these is information, attached to a product, sitting in a system, on a five-day clock that starts whether or not a human opens it.

We are not suggesting anyone should panic about a bad review. Most of them are not reportable, and the statute’s threshold does real work. We are suggesting that if your reviews, return reasons and support tickets are in three systems that do not share a product identifier, you have no way to see the fourth identical complaint — and the pattern, not the individual message, is usually what makes the threshold. Routing rules on a keyword list, aggregated per SKU, with an alert at the third hit, is an afternoon of work and a genuinely useful thing to own.

Maryland’s own layer, and the statute that names the Internet

The federal material above is the same in every state. Maryland then adds a few things of its own, one of which is unusually well drafted for our purposes.

Md. Code, Environment §6–1303 prohibits manufacturing a lead-containing children’s product, and separately prohibits any person from doing this:

“Sell, offer for sale, import, or distribute, by any means, including through a sales outlet, a catalog, or the Internet, a children’s product that is a lead-containing product.”

Maryland wrote “the Internet” into the operative sentence of a product-content ban. “Product” expressly includes toys, and “child” here means under thirteen. Then §6–1304(d) puts a duty on the shop itself: a retailer “shall maintain a copy of any certificate” of lead testing and “provide a copy to the Department or any person on request.”

Any person. Not the regulator. A customer who emails asking for the lead certificate on a wooden train set is exercising a statutory right, and the shop owes a copy. If the certificates are PDFs in an inbox, that request costs an hour. If they are rows keyed to the SKU, it costs a click. The used-goods trade gets a carve-out at §6–1304(e)(2) for thrift stores, consignment stores and yard sales, which is worth knowing if part of the shop is secondhand. And a violation is an unfair or deceptive trade practice under §6–1309, which routes it into the Consumer Protection Act.

Two flame-retardant statutes sit alongside it, in the Health-General article rather than Environment. §24–306(c) bars importing, selling or offering for sale a child care product — defined to include “a baby product, toy, and car seat” — containing more than a tenth of one percent of TCEP or TDCPP and intended for a child under three. §24–306.1(c)(2), from the Family and Firefighter Protection Act of 2020 and in force since 1 January 2021, bars any juvenile product, mattress or upholstered furniture containing more than 0.1% of flame-retardant chemicals by mass. Both bind retailers, and both exempt resale by a consumer.

Two clean negatives are worth stating because people assume otherwise. Maryland has no PFAS restriction covering children’s products — the 2022 Act reaches firefighting agents, food packaging, rugs and carpets, and stops there. And Maryland has no Toxic-Free Kids Act; that is Minnesota, Washington, Oregon and Massachusetts. Maryland legislated narrowly and specifically instead.

There is also a purely local rule that will surprise an out-of-state drop-shipper. Baltimore City Code Art. 19, Subtitle 39 provides that “no person may own, carry, or possess a replica gun in the City of Baltimore,” and §39–1(a) defines a replica gun to include “any toy, imitation, facsimile, or replica pistol…which because of its color, size, shape, or other characteristics, can reasonably be perceived to be a real firearm.” Federally compliant orange-tipped items are excluded. If a shop stocks cap guns or airsoft, that is a destination rule — a SKU that cannot ship to a set of ZIP codes — and destination rules are exactly the sort of thing a cart either models or does not.

The license fee that reads off your inventory

A trader’s license is required under Md. Code, Bus. Reg. §17–1803(a) for anyone doing business as a trader in the State, and §17–1803(b) requires a separate license for each place of business. The fee is graduated by the value of your stock in trade, and Baltimore City has its own eight-band table at §17–1807(c)(3), considerably steeper at the top than the general-county table:

Under §17–1807(d)(2) the clerk takes as prima facie evidence the value certified to the tax authorities or declared on the inventory return — which means the number flows off your Business Personal Property Tax Return, which in turn flows off whatever your system says your average inventory is worth. A card shop holding a large singles position can cross a fee band without noticing. That is a small, concrete, and slightly unusual reason to care whether your inventory valuation is actually right.

Sales tax: no, the board game is not tax-free that week

Maryland charges 6% under Tax-Gen. §11–104(a)(2)(i). We swept the entire exemptions subtitle, §§11–201 through 11–246, for “book,” “toy,” “game,” “hobby,” “puzzle” and “textbook.” There is exactly one hit in the whole subtitle, and it is the word “bookbag.” Maryland exempts no books, no toys, no games and no educational materials at any time of year.

Shop Maryland Tax-Free Week, at §11–228(b), runs the seven days from the second Sunday in August and exempts exactly two things: any item of clothing or footwear priced at $100 or less, excluding accessories, and the first $40 of a backpack. Clothing is not otherwise exempt in Maryland — a point at least one accounting firm’s blog currently gets wrong — so for fifty-one weeks of the year a licensed T-shirt and the board game next to it are taxed identically. For one week they are not, and a shop that sells both needs a tax engine that can tell them apart on a date.

There is a sharp edge in that week for online orders, and it is a software bug rather than a tax question. The exemption attaches to orders paid for and delivered during the period. A store that authorizes at checkout but does not capture until the box ships can push a customer out of the exemption by a day. If you run the promotion, capture on the day.

Digital goods deserve a line too, because game shops sell more of them than they realize. §11–101(c-4)(2) puts “video or electronic games” and e-books squarely inside the definition of a taxable digital product, and §11–101(c-3)(1) defines a digital code to include one obtained “in a tangible form, such as a card.” The download card on the rack by the register is a digital code, not merchandise. A plain gift card with a monetary value is carved out. Economic nexus, for shipping out of state, is $100,000 or 200 transactions under COMAR 03.06.01.33 — and 200 transactions is a threshold a singles seller can cross in a month without approaching the dollar figure.

The buylist is a police report and a ten-day quarantine

Here is the second thing we did not expect, and for a Baltimore card or game shop it is probably the single largest piece of unbuilt software in this article.

Buying used product from the public — cards, cartridges, board games, minis — puts a shop inside Baltimore City Code Art. 2, Subtitle 12, “Second-Hand Property, Antiques, and Consignment Goods.” The definition at §12–1(f) covers a person in the business of buying for resale “used or previously owned property or merchandise,” listing clothes, furniture and household items and then adding “other moveable personal property.” It excludes motor vehicles, records, tapes, compact discs and books. Trading cards, board games and cartridge games are on none of the exclusions.

And §12–1(g) defines “transfer” as “to purchase, sell, trade, consign, or otherwise exchange personal property or merchandise for consideration.” Trade. Store credit for a stack of cards is a transfer. The whole trade-in counter is inside the subtitle, not just the cash side of it.

What follows is a set of requirements that read like a specification:

Read the ten-day hold against how a card shop actually works and the conflict is obvious. The commercial logic of a buylist is to acquire at a discount and list immediately, ideally the same afternoon while the price is what you paid against. The Code says the item is not sellable for ten days. A system that does not model a sellable-from date per acquisition lot will either break the rule or, more commonly, break the rule without anyone realizing there was a rule.

We checked the obvious alternative theory, that this is really the pawnbroker statute and cards fall outside it. It is not. Maryland’s Secondhand Precious Metal Object Dealers and Pawnbrokers Act is Bus. Reg. Title 12, and §12–101(i) limits “precious metal object” to gold, iridium, palladium, platinum and silver, items with stones inlaid in same, or objects at least a quarter precious metal by weight. Cards are none of those. §12–102(d) preempts local regulation of dealers or coins in that field specifically, which is why the City can and does regulate used non-precious-metal goods. If the shop also buys coins, the state statute is the one to read. The junk dealer provisions are about metals and do not apply.

One thing we could not resolve: whether disc-based console games fall inside the “compact discs” exclusion at §12–1(f). Read in context the phrase “records, tapes, compact discs” looks like a recorded-music grouping, but the text does not say so and we found nothing interpreting it. Cartridges, cards and boxed games are unambiguously inside. If a large part of the buy counter is disc games, that is a question for a lawyer rather than a blog.

The privacy law that probably does not apply to you

We want to include this section precisely because the honest answer is reassuring, and nobody writes the reassuring version.

Maryland has an Age-Appropriate Design Code, the Maryland Kids Code, enacted by Chapters 460 and 461 of 2024, approved 9 May 2024 and effective 1 October 2024. It is codified at Com. Law §§14–4801 through 14–4813 — note that the bill as passed used a different subtitle number, which the revisor changed, so citations to §14–4601 that still circulate point at an unrelated statute about evidence kits. Its duties are real and demanding: a data protection impact assessment, default high-privacy settings, a prohibition on profiling a child by default, a ban on dark patterns and tight limits on precise geolocation, with penalties of $2,500 per affected child for negligent violations and $7,500 for intentional ones.

Two gates keep almost every shop in this article outside it. The first is §14–4801(m)(2), which excludes from the definition of “online product”:

“The sale, delivery, or use of a physical product sold by an online retailer”

The second is the definition of a covered entity at §14–4801(h), which requires annual gross revenue over $25,000,000, or the personal data of 50,000 or more consumers, households or devices in a year, or half of revenue from selling personal data. A shop with four employees and $400,000 of turnover clears none of those.

Two caveats keep it from being a clean dismissal. The physical-product exclusion is a definitional carve-out rather than a blanket exemption, and it does not obviously cover the surrounding furniture — accounts, wish lists, a loyalty program, a community forum, an event system with a roster of minors. And the Act is under constitutional challenge: in NetChoice v. Brown in the District of Maryland, the State’s motion to dismiss was denied in November 2025 and the case remains pending. Nothing has been enjoined; the law is in force; the scope may yet move.

COPPA is the one that can actually reach a small shop, and its compliance deadline has already passed. The amended Rule was published 22 April 2025, took effect 23 June 2025, and full compliance was required by 22 April 2026. The provision most likely to break a stock build is the new 16 CFR §312.10, which says children’s personal information “may not be retained indefinitely” and requires a written data retention policy, published in the site’s privacy notice, stating why the data is collected and when it is deleted. The other is §312.5(a)(2), which requires separate verifiable parental consent for disclosure to third parties. A single “I agree” checkbox cannot carry both running the site and sharing with an ad pixel.

If the shop runs a birthday club, a kids’ league roster or a Pokémon event sign-up that collects a child’s name and date of birth, that is the corner of the business to look at — not the product catalog.

If you ship to Europe, the product page is a form

Plenty of Baltimore card and hobby shops ship internationally, because singles and out-of-print product have a global market. It is worth knowing that the European Union has spent the last two years turning the online listing into something much closer to a legally specified form than anything in US law, and that the direction of travel is toward more of it, not less.

The centerpiece is the General Product Safety Regulation, Regulation (EU) 2023/988, which has applied since 13 December 2024. Its Article 19 governs distance sales and says that where products are offered online, “the offer of those products shall clearly and visibly indicate at least” four things:

Recall the census: of the 16,759 Maryland listings we read, 28 named a manufacturer or importer and none named an EU responsible person. That is not a criticism of anyone — these are American shops selling mostly to Americans. It is a measure of how far the product record would have to travel to satisfy Article 19, and of how much of that distance is data rather than effort.

A lawyerly reader will object that toys are separately harmonized and GPSR therefore should not apply. The objection is a good one and the answer is specific: GPSR Art. 2(1) switches off Chapter III Section 1 and several other chapters for harmonized products, and Article 19 sits in Chapter III Section 2, which is not switched off. The recitals of the new Toy Safety Regulation confirm it in terms, noting that GPSR’s online-sales provisions “also apply to toys.”

Toy-specific warnings have their own rule and it is older than the US internet provision in spirit and younger in text. Directive 2009/48/EC, Article 11(2), third subparagraph:

“Warnings which determine the decision to purchase the toy…shall appear on the consumer packaging or be otherwise clearly visible to the consumer before the purchase, including in cases where the purchase is made on-line.”

Annex V, Part B goes further than the US rule in one respect that is easy to miss. The warning “Not suitable for children under 36 months” is not sufficient on its own: it “shall be accompanied by a brief indication…of the specific hazard calling for this precaution.” Two linked fields, not one badge — the age statement and the reason.

That regime is being replaced. Regulation (EU) 2025/2509 of 26 November 2025, published in the Official Journal on 12 December 2025, repeals the Directive. Most of it applies from 1 August 2030, with the notified-body machinery live since the start of 2026, and toys lawfully placed on the market before the changeover may continue to be sold. Its Article 6(3) restates the online rule in cleaner language, and Annex III hard-codes presentation: an x-height of at least 1.2 mm, pictograms no smaller than 10 mm, sufficient contrast against the background.

The part worth planning for is the Digital Product Passport. Article 3(17) defines it as “a set of data specific to a toy…accessible via electronic means through a data carrier,” Article 19(1) requires the manufacturer to create one before placing a toy on the market, and Article 19(7) is the provision that reaches the storefront: the data carrier

“shall be physically present on the toy or on an affixed label” and “clearly visible to the consumer or other end users before any purchase…including in cases where the toy is made available on the market through distance sales.”

Article 19(12) obliges the operator placing the toy on the market to hand distributors and online marketplaces a digital copy of that carrier or identifier, free of charge, within five working days of a request. In other words there will be, by 2030, a supplier-to-retailer data pipe for exactly the information that today does not travel at all. If you are specifying a product information system now and you sell anything into Europe, reserve the two fields.

Two more European rules touch the storefront rather than the product. The Consumer Rights Directive at Article 8(2) still requires the checkout button to be labeled “order with obligation to pay” or an unambiguous equivalent, on pain of the consumer simply not being bound. And the European Accessibility Act has applied to e-commerce services since 28 June 2025, with a microenterprise exemption at Article 4(5) for a business with fewer than ten people and turnover or a balance sheet of no more than €2 million — which covers essentially every shop in this article, but not the platform they run on.

Lithuania, as a worked example of the same idea

We work with clients in Europe as well as the US, so it is easy for us to check what one Member State actually does with these rules, and Lithuania makes a clean example because its instruments are short and public.

Lithuania implements the toy Directive through the Žaislų saugos techninis reglamentas, a technical regulation approved by ministerial order No. 4–174 of 1 April 2011 and substantially restated since; the consolidated text in force from 29 August 2026 is the one to read. Point 5 designates the market surveillance authority, the Valstybinė vartotojų teisių apsaugos tarnyba, and point 14.6 carries the online rule into national law:

„Įspėjimai, kurie nulemia sprendimą įsigyti žaislą…turi būti nurodomi ant vartotojui skirtos pakuotės ar kitaip aiškiai matomi vartotojui prieš įsigijimą, įskaitant tuos atvejus, kai perkama internetu.“

— warnings that determine the decision to buy a toy must be shown on the consumer packaging or otherwise be clearly visible to the consumer before purchase, including where the purchase is made online. The regulation adds, in several places, the requirement an American reader will find most alien: warnings and safety information must reach the buyer in Lithuanian. The warning is not one field. It is one field per market.

And then there is the tax, which is the detail we would put in front of anyone building a cart for a shop that sells both games and books. Lithuania’s standard rate is 21%, set by Article 2(32) of the VAT law and applied by Article 19(1). Books — printed and electronic, including textbooks, exercise books, dictionaries, children’s picture books and coloring books — sit in the reduced 5% band at Article 19(4)(4). They arrived there on 1 January 2026, having previously been at 9%. Toys, board games, puzzles and hobby kits appear nowhere in the reduced-rate lists at all, so they take the standard rate by residue.

A Lithuanian shop selling a board game and an illustrated children’s activity book in the same basket is charging 21% on one line and 5% on the other — a sixteen-point spread inside one order, widened from twelve points at the start of this year.

We point at this not because our Baltimore readers owe Lithuanian VAT, but because it is the cleanest possible illustration of the thing this whole article is about. The difference between those two lines is not visible in the warehouse, not visible on the shelf, and not visible to the person packing the box. It exists only as an attribute on a product record. Get the attribute wrong and you are collecting the wrong tax on every sale, forever, silently. Maryland’s version of the same problem is quieter but identical in shape: the taxable digital code that looks like a gift card, the T-shirt that is exempt for seven days a year while the game beside it is not.

So does any software actually do this?

This is the question we ask on every project, and the honest answer is usually “partly.” Here it is almost entirely no, and the pattern of what exists is more interesting than the absence.

We swept the Shopify App Store, the BigCommerce marketplace and the WordPress plugin directory on 20 September 2026 for anything that puts a required safety warning on a product page. Shopify has a real, if small, category: a warning-engine app with 240 reviews and a good rating, a checkout-block variant, a handful of Proposition 65 specialists, a catalog scanner, and two one-person apps — one with a built-in choking-hazard template matched by tag or vendor, one that renders the EU under-three symbol from merchant-authored metafields.

Not one of them derives the warning from an age attribute. Every app asks the merchant to assert which products are hazardous. Two say so in their own copy: one states that it “never decides which products need a warning,” the other that “warnings are never generated for you — you enter the wording that is on the toy.” Which is a reasonable product decision, and it means the compliance engine is the shopkeeper.

BigCommerce has nothing: searching its marketplace for warnings and Proposition 65 returns tax, privacy and accessibility apps and one result that matched the string “65%.” The WordPress directory returns zero plugins for “choking hazard” — and seventeen real ones for GPSR.

The European rule has applied for twenty-one months and has a plugin ecosystem. The American rule has been in force since 2008 and has none. Once again: tooling follows exposure, not age.

Shopify’s own position is consistent with that. Its help documentation on product compliance is framed entirely around GPSR, points merchants at a “Disclosures” product metafield, and says plainly that “Shopify does not currently offer such services directly.” There is no mention of CPSC and no age-conditional logic anywhere in it.

There is exactly one platform that enforces the American rule, and it is the one nobody in this article wants to depend on. Amazon’s listing schema carries a cpsia_cautionary_statement attribute, with enumerated values including choking_hazard_small_parts and no_warning_applicable, alongside a separate minimum-age attribute, and Amazon renders the statement on the detail page. The capability exists. It exists on the marketplace that competes with the shop.

We have seen this exact shape before, in a bakery context, where every one of 136 order-limit apps could count units, orders or weight and not one could track cumulative revenue against a statutory cap — while the platform that could compute it to the dollar did so in order to upgrade your plan. The capability is never missing. It is just pointed somewhere else.

While we were in there: what the vertical apps look like

One more finding from the same sweep, which says something about how thin this market is. The Shopify App Store contains about ten trading-card apps — inventory managers, importers, scanners, a trade-in tool — priced from $10 to $100 a month. Between all of them they hold ten customer reviews. A single generic preorder app holds 3,705.

And searching that store for “tournament,” the workflow that defines the entire vertical, returns exactly two apps store-wide, neither of which runs a tournament; one is a collectibles loyalty program and the other connects a golf marketplace. The control query “inventory” returns 4,188, so the index is working fine. There is no league or tournament management software in the general app economy at any price. The stores that have it have it because a specialist vendor bundled it.

What this software actually costs, at published prices

We checked every price below on 20 September 2026 on the vendor’s own pricing page. Where a vendor publishes nothing, we say so, because that is information too.

The general platforms

The vertical vendors

Two footnotes on that table, both worth knowing before anyone picks up a phone. BinderPOS now redirects to TCGplayer’s seller site and states that new seller onboarding is paused with a waitlist — so the best-known product in this vertical currently cannot be bought. And Crystal Commerce has been advertising a struck-through $599 setup fee at $0.99 for a very long time; the page’s own metadata dates it to 2020, so treat the numbers as indicative and confirm them.

The channels, and where the meter actually bites

Look at the third column rather than the second. The American marketplaces charge commission on the shipping and the sales tax; the European one charges on the article value and nothing else. On a $12 card with $5 shipping and 72¢ of tax, TCGplayer’s 13.25% runs against $17.72 rather than $12, which is 19.6% of the card rather than 13.25%. The headline rate is not the rate.

Three pieces of arithmetic fall out of those tables, and all three are decisions somebody is making by feel right now.

When does your own storefront beat the marketplace? A non-Pro TCGplayer seller pays 13.25% plus 30¢. A Shopify Basic store on the annual plan with a card-inventory app runs about $58 a month fixed and 2.9% plus 30¢. The fixed 30¢ cancels, leaving a 10.35-point saving, so the fixed cost is covered at $560 a month of online sales. With BinderPOS on top the crossover is about $1,545 a month; with Crystal Commerce, about $1,261. Those are low numbers — but the commission is buying demand, and the store is not. The honest way to read the crossover is as the price of the traffic, not as free money.

Event ticketing is where small numbers get silly. On a $5 Friday-night entry, Eventbrite takes 3.7% plus $1.79 plus 2.9%, which is $2.12, or 42.4% of the ticket. A Shopify ticketing app at a dollar a ticket plus card fees takes $1.45. Across a hundred and thirty tickets a month the difference is about $1,000 a year, on a service the shop is running mainly to fill the tables.

And the fixed-cent leg decides the singles business. On a $4 card, Square Premium’s 2.4% plus 15¢ is an effective 6.15%; Shopify Advanced’s 2.4% plus 10¢ is 4.90%. A five-cent difference in the fixed leg inverts the usual assumption about which is cheaper, because at trading-card ticket sizes the percentage barely matters and the flat fee is most of the cost.

Two meters that punish you for having a big catalog

If you carry singles you have tens of thousands of SKUs, and a surprising number of vendors price on exactly that. The card-inventory apps meter on cards managed, at two thousand, fifteen thousand and fifty thousand breakpoints. More oddly, one of the main cookie-consent platforms meters on subpages — which for a shop means product pages. Four thousand SKUs puts it around €600 a year and eight thousand around €1,080, on a site that might see five hundred visitors a day, while a flat-rate competitor does the same job for $59 a year. That is roughly an eighteen-fold spread driven entirely by how many products you list.

One more gap worth pricing, because it is the one place where the market simply has no product. Verifiable parental consent — the COPPA mechanism, not an adult gate — is quote-only across every vendor we checked, with a single published floor of $250 a month on a twelve-month minimum. Every age-verification app in the Shopify store is an 18-plus or 21-plus gate built for alcohol, vape and CBD. The direction that actually binds a toy shop is the direction nobody sells.

What we would build, and what we would tell you to keep renting

Take a representative Baltimore shop: three people, a storefront, an online store doing singles and sealed product, a weekly event night and a buy counter. At published prices, a lean stack of a Shopify Basic annual plan, POS Pro for the register, a card-inventory app, a preorder app, an event-ticketing app and a trade-in app comes to roughly $3,600 a year before card fees. Move each of those to the tier the shop will actually need by next year and it is closer to $5,800. Neither number is outrageous, and both buy a great deal of working software.

Against that, our Online Store package starts at $6,000 and an Operations System at $12,000, both fixed price. On subscription savings alone the lean stack pays back a $6,000 build in about twenty months and the comfortable stack in about twelve. That is a real but unexciting argument, and if it is the only argument, keep renting. We would tell you that on the call.

The better argument is the list of ledgers that nothing above sells at any price, all of which came out of the research in this article:

• A supplier request log — who you asked, about which SKU, on what date, and what came back. It is the statutory safe harbor at §1278(c)(1)(B)(ii) rendered as a table, and it is perhaps forty lines of code.
• An age and small-parts attribute pair captured in the same act of data entry, driving the warning component rather than sitting beside it in prose.
• A certificate and lot register keyed to the SKU, so that the seven eFiling elements exist before the container lands and a Maryland customer asking for a lead certificate gets it in a click.
• A sellable-from date per acquisition lot, so the ten-day hold on bought-in goods is enforced by the system rather than remembered by a person, and a daily transaction export in the format the City asks for.
• A signal queue that pools reviews, return reasons and tickets by SKU and raises a flag on the third matching complaint.

That is not a rewrite of the point of sale. Most of it sits beside whatever you already run, reads from it, and writes the records nobody else keeps. It is the kind of project we price at the low end, and it is usually the right first project — because it is the part that no vendor will ever build for you, since no vendor is exposed to it.

If you would rather see the shape of this than read about it, there is a working e-commerce demo running in the browser on our demos page, and we have written up what a custom app really costs and how we think about custom versus SaaS versus no-code elsewhere on the blog.

Frequently asked questions

Does the choking-hazard warning have to appear on my product page, or just on the box?

On the page as well, if the page lets someone buy the item. 15 U.S.C. §1278(c)(1)(A) requires the cautionary statement in any advertisement — expressly including “advertisements on Internet websites” — that provides a direct means for purchase or order, and 16 CFR 1500.20(c)(6) defines that to include “Internet Web sites that enable consumers to purchase a product online.” CPSC’s own e-commerce guidance says the statement must appear where advertising provides a direct means to buy “(such as a webpage).” The compliance date for internet advertisements was 12 December 2008.

Can I use the short version of the warning online?

No. 16 CFR 1500.20(e) permits an abbreviated warning — a number from one to six, the alert symbol, the words CHOKING HAZARD and a single age line — but that allowance is written for catalogs and other printed materials. No equivalent abbreviation is granted for websites, so a web listing carries the full statement.

What is a small part, and which toys need the warning?

The warning at 16 CFR 1500.19(b)(1) applies to a toy or game intended for children at least three but under six that contains a small part. Below three, a toy with a small part is not a labeling question at all — it is banned. There are six distinct statements in the regulation, covering small parts, latex balloons, small balls and marbles, each with its own age condition, which is why a single “choking hazard” checkbox does not model the rule.

I am a retailer, not a manufacturer. How am I supposed to know whether something contains a small part?

By asking, and by keeping the record that you asked. 15 U.S.C. §1278(c)(1)(B)(ii) says a retailer is not in violation if the retailer requested the information from the manufacturer, importer, distributor or private labeler and was given false information or none. The defense is the request, not the answer — which makes it a database row rather than a product attribute, and it is the single most useful thing a small shop can build here.

Are toys tax-free during Maryland’s tax-free week?

No. Tax-Gen. §11–228(b) exempts only clothing and footwear priced at $100 or less per item, excluding accessories, plus the first $40 of a backpack, during the seven days from the second Sunday in August. Toys, games, puzzles and hobby supplies are taxed at the usual 6%. Clothing is not otherwise exempt in Maryland either — for the rest of the year a licensed T-shirt and a board game are taxed the same. For online orders the exemption attaches to orders paid for and delivered in the window, so capture payment on the day rather than at shipment.

Do I need a license to buy used cards and games from customers in Baltimore?

Yes. Baltimore City Code Art. 2, Subtitle 12 covers a dealer buying used “other moveable personal property” for resale, and its exclusions — vehicles, records, tapes, compact discs and books — do not reach cards, boxed games or cartridges. The license is $50 a year per place of business under §12–3(a). “Transfer” is defined to include trades, so store credit counts as much as cash.

Is there really a ten-day hold before I can resell what I buy in?

Under §12–9(a)(2) of that subtitle, yes — every item other than precious metal must be held at least ten days after the transaction is reported. There is also a daily report of every acquisition to the Police Commissioner and the Director of Consumer Protection under §12–7(a)(1), with seller identification and signatures, though §12–7(b) allows one line for a group of substantially similar items, which is what makes a bulk card buy practical. Consignment is exempt from both the report and the hold under §12–14(a).

Does the Maryland Kids Code apply to my online store?

Almost certainly not, for two independent reasons. Com. Law §14–4801(m)(2) excludes “the sale, delivery, or use of a physical product sold by an online retailer” from the definition of an online product, and §14–4801(h) only makes you a covered entity above $25 million of revenue, 50,000 consumers’ data, or half your revenue from selling personal data. The parts of a shop worth a second look are the ones that are not product sales: accounts, loyalty, forums and event rosters that hold data about minors. COPPA, whose amended Rule required full compliance by 22 April 2026, is the more realistic concern there.

What does it cost to sell on TCGplayer versus my own site?

A non-Pro marketplace seller pays 10.75% commission plus a 2.5% plus 30¢ transaction fee, charged on the item, the shipping and the tax. Pro drops the commission to 9.25% and adds 2.5%, with no subscription, no contract and no start-up cost. Running your own Shopify store with a card-inventory app costs roughly $58 a month on annual billing plus 2.9% and 30¢, so the fixed cost is covered by the fee saving at about $560 a month of online sales. The marketplace fee is buying demand, though, which your own store has to replace.

Is there off-the-shelf software that handles buylists, events and singles together?

Only from the vertical specialists, and the field is thinner than it looks. Crystal Commerce bundles a buylist at 0% and charges $99 a month plus 2.5% online; BinderPOS bundles buylist and events at $100 to $150 a month on top of Shopify, but has paused new seller onboarding. In the general app economy there is no tournament or league management software at any price — a search of the Shopify App Store for “tournament” returns two apps, neither of which runs one.

Is it worth building custom software for a toy, hobby or game store?

On subscription savings alone, usually not for a small shop. A lean stack around $3,600 a year pays back a $6,000 fixed-price build in roughly twenty months; a fuller stack at about $5,800 pays back in twelve. The stronger case is the handful of records nothing on the market keeps: the log proving you asked a supplier about small parts, the certificate and lot register that answers a recall or a customer’s statutory request in a click, the sellable-from date that enforces the ten-day hold on bought-in stock, and a complaint queue pooled by SKU. If those gaps are costing you time or exposing you to risk, a fixed-price build of $6,000 to $12,000 is worth pricing.