No — the premise that nexus requires purchases or contracts with in-state users is not correct. Whether browsing-only users create nexus depends on the tax type and how the business monetizes those users. The risk is lower than for a seller, but it is not zero, and in several states it is affirmatively present.
The Constitutional Baseline: Physical Presence Is Not Required, and Virtual Presence Counts
*South Dakota v. Wayfair* (2018) eliminated the physical-presence requirement: "Physical presence is not necessary to create a substantial nexus"1 — nexus exists when a taxpayer "avails itself of the substantial privilege of carrying on business" in the jurisdiction1. The Court specifically addressed the exact fact pattern at issue here: "a company with a website accessible in South Dakota may be said to have a physical presence in the State via the customers' computers. A website may leave cookies saved to the customers' hard drives, or customers may download the company's app onto their phones."1 The Court also noted that Massachusetts proposed defining physical presence to include apps downloaded by in-state residents and cookies placed on in-state browsers, and that Ohio adopted a similar standard at Ohio Rev. Code §5741.01(I)(2)(i)1. So the argument that mere browsing/engagement is constitutionally incapable of creating nexus is foreclosed — cookies and app downloads on in-state devices are recognized contacts.
Sales/Use Tax: Browsing Users Alone Generally Don't Trigger Collection Obligations
Post-*Wayfair* economic nexus statutes are framed around sales and transactions into the state, not user counts:
| Regime | Trigger | Effect of browsing-only users |
|---|
| South Dakota model (upheld in *Wayfair*) | >$100,000 of goods/services delivered into the state or 200+ separate transactions annually1 | No sales into the state → threshold never met |
| Illinois remote retailer (86 Ill. Adm. Code 150.201) | $100,000+ cumulative gross receipts or 200+ separate transactions with Illinois purchasers2 | Same — measured by sales, not visits |
| Click-through nexus statutes (e.g., N.Y. Tax Law §1101(b)(8)(vi); Illinois) | In-state persons compensated for referring customers, e.g., Illinois presumes nexus where tracked referrals generate >$10,000 in sales over four quarters12 | Requires a referral contract — passive browsing doesn't qualify |
If the company makes no taxable sales into a state, there is nothing to collect and the dollar/transaction thresholds are never satisfied. Caveat: in cookie/app-presence states (Ohio-style statutes1), in-state software presence can establish nexus as a legal matter, though it is consequential only once the company has taxable sales to collect on.
Income/Franchise Tax: User Engagement Can Create Nexus If It Is Monetized
This is where the "users don't buy anything" framing breaks down. Most ad-supported or data-driven businesses do derive receipts from their users' in-state activity — just from advertisers and data buyers rather than from the users themselves — and states source those receipts to the users' location:
- Factor-presence statutes. Alabama §40-18-31.2(b) establishes substantial nexus when in-state property exceeds $50,000, payroll exceeds $50,000, sales exceed $500,000, or any factor exceeds 25% of the total3, and counts toward the sales threshold receipts from "services, intangibles, and digital products for primary use by a purchaser known to the seller to be in this state"3. Michigan imposes substantial nexus on a taxpayer that has physical presence for more than one day or actively solicits and has $350,000+ in gross receipts sourced to the state4.
- Market-based sourcing of ad revenue. Oregon's sourcing rule assigns advertising receipts to the state "to the extent that the audience for the advertising is in Oregon," and its Example 20 directly covers an out-of-state web company paid per view or click: those receipts are Oregon receipts to the extent the viewers are in Oregon55. In-state browsers therefore pull the company's advertising revenue into the state's sales factor — which is exactly what factor-presence thresholds measure.
So if the platform earns advertising, data-licensing, or sponsorship revenue attributable to an audience in a state, that audience's browsing is what sources the receipts there, and sufficient receipts create income tax nexus without any user paying anything.
P.L. 86-272 Offers Little Protection Here
P.L. 86-272 (15 U.S.C. §§381–384) immunizes only the solicitation of orders for tangible personal property; services, intangibles, licensing, and digital products are outside its protection6. For internet activities, New Jersey's regulation (N.J.A.C. 18:7-1.9A, following the MTC's revised statement) draws the line precisely on the browsing/cookie issue:
- Protected: cookies used only ancillary to soliciting orders for tangible goods; a searchable e-commerce website; posting FAQs777.
- Unprotected (nexus-creating): placing cookies on in-state users' devices that gather market or product data assembled for sale to data brokers or third parties7; selling targeted advertising based on in-state users' location and cookie data7; contracting with in-state customers for subscriptions7.
A free-to-use, engagement-driven platform that monetizes user data or attention is squarely in the unprotected column. Note also that even where P.L. 86-272 does apply, it preempts only net income taxes — Alabama §40-18-31.2(e) confirms protected taxpayers escape the income tax despite exceeding factor thresholds3 — but it does not shield against gross-receipts taxes (Washington B&O, Oregon CAT, Ohio CAT), minimum/franchise taxes7, or sales/use tax collection duties.
Conclusion
For sales/use tax, browsing-only users do not by themselves trigger a collection obligation, because economic nexus thresholds are measured by sales and transactions into the state12 — though cookie/app-presence statutes mean the company may technically have nexus that becomes relevant the moment it makes a taxable sale1. For income, franchise, and gross-receipts taxes, the conclusion does not hold if the company monetizes those users: advertising and data receipts are sourced to the states where the audience sits5, factor-presence statutes convert those sourced receipts into substantial nexus at thresholds as low as $350,000–$500,00034, and cookie-based data gathering and targeted-ad sales defeat P.L. 86-272 immunity77. The accurate framing is not "no purchases, no nexus" — it is "no in-state-sourced revenue, no nexus." A revenue model built on user engagement (ads, data sales, subscriptions sold elsewhere but consumed in-state) sources revenue to users' states and can create nexus on the strength of browsing activity alone.
