FTC Mail Order Rule Refund Timing, State Restocking Fee Disclosure, EPA Electronic Waste and Battery Handling, Serialized Product Resale Rules and NIST 800-88 Data Sanitization for Returned Devices: Compliance for US Returns Software

This article is part of our series on Custom Reverse Logistics and RMA Platform Development for US Returns Operators: Building a Return Authorization, Grading and Disposition Routing System

Introduction: Five Rule Sets, One Returned Item

A single returned laptop can touch every rule named in the title, which is why returns software compliance is a design question rather than a policy document.

The refund is governed by consumer protection law and the retailer’s disclosed policy. A restocking fee depends on state disclosure rules. Its battery may be regulated waste. Its resale depends on recall status, honest disclosure and its serial number’s history. And its drive holds someone’s data.

This article covers each rule set and what it means for software, plus the fairness expectations around fraud controls, which together make up most of what returns software compliance involves in practice.

This is educational content, not legal advice. Confirm positions with counsel experienced in consumer protection and product safety, environmental compliance professionals and certified data sanitization providers. Compliance is the rules layer of the full custom software development guide to reverse logistics software development, and it shapes every screen of returns portal development (web application development).

FTC Mail Order Rule Refund Timing

The FTC’s Mail, Internet, or Telephone Order Merchandise Rule is often cited as the federal return refund rule. It is not quite that.

The rule requires sellers to have a reasonable basis for shipping time statements, to notify customers of delays and offer the option to cancel, and to refund promptly when an order is cancelled under the rule: generally within seven working days for payments by cash, check or money order, and within one billing cycle for credit purchases.

Ordinary returns of delivered goods are governed by other things: the retailer’s disclosed return policy, state refund disclosure laws, card network and processor rules, and the FTC Act’s prohibition on deceptive practices, which applies when a retailer does not honor the policy it advertised.

For software, and this distinction is the heart of returns software compliance on the refund side: apply the Mail Order Rule’s deadlines to cancellations, apply the disclosed policy to returns, and keep records showing that every refund met whichever applied.

State Restocking Fee and Refund Policy Disclosure

Several states require retailers to disclose their refund policies, and some address restocking fees directly, which makes the policy data model a compliance artifact rather than a configuration screen.

New York’s General Business Law 218-a applies to stores and online retailers. The policy must state whether refunds are given and on what terms, including any restocking fee with its dollar or percentage amount. If no policy is posted, customers may return unused, undamaged goods within 30 days for a refund or credit.

California’s Civil Code 1723 requires retailers to display their policy when it is more restrictive than common expectations, such as a full refund, exchange or credit within seven days. Other states have their own requirements, including standalone restocking fee disclosure rules.

For software: policy terms and fees held as data by jurisdiction and channel, the disclosed policy and the applied policy kept identical, and a record of what each customer was shown at purchase.

EPA Electronic Waste and Battery Handling

When a Return Becomes Waste

A returned item is not waste while it is being evaluated for reuse. Once the decision is made to discard or recycle it, waste rules apply to how it is stored, labeled, transported and documented, which means the disposition decision is also the moment a different rule set attaches.

Batteries

Most discarded lithium batteries are hazardous waste that can be managed under the federal universal waste rule. EPA has been developing a dedicated universal waste category for lithium batteries with fire-safety requirements, projected for proposal in 2026; verify its status before relying on it.

Damaged, defective or recalled batteries also have strict shipping rules and are generally barred from air transport.

Electronic Waste

Electronics disposal and recycling are governed largely by state e-waste laws, which vary widely in what they cover and who must handle it. Many operators use recyclers certified under recognized programs and keep their certificates on file per lot.

For software: battery screening and quarantine at receiving, waste routes with documentation, and recycler certificates attached to each lot.

Serialized Product Resale Rules

Serial numbers connect a returned unit to obligations that follow it into resale, which is why capture at receiving matters more than it looks.

Recalls come first. Federal product safety law makes it unlawful to sell or offer for sale a consumer product subject to a recall, and that applies to resellers and liquidation buyers as much as to retailers. A recall check by model and, where relevant, serial number belongs before every resale route.

Disclosure comes next. Used, open-box and refurbished goods must be described as what they are; presenting them as new is deceptive under federal and state law. Manufacturer warranties may not transfer to refurbished units, so listings must describe warranty accurately.

For phones and some electronics, serials and device identifiers also connect to activation locks and to industry lists of lost or stolen devices, both of which belong in the gate rather than in a later check.

And trade-in or buyback programs that purchase used goods from the public may fall under state secondhand dealer laws with record-keeping and holding requirements.

For software: serial capture at receiving, recall and device checks as gates, and listings generated from verified grades and warranty status. How these rules become gates and features is mapped in Reverse Logistics Software Features: Must-Haves for 2026.

NIST 800-88 Data Sanitization for Returned Devices

Returned phones, laptops, tablets and smart devices often still hold the customer’s data, and protecting it is both a legal and an ethical obligation.

NIST Special Publication 800-88 is the reference most contracts and certification programs use. In September 2025, NIST published Revision 2 and withdrew Revision 1.

The new version focuses on running a media sanitization program rather than prescribing techniques device by device. It keeps the Clear, Purge and Destroy outcomes, distinguishes verifying that a technique ran from validating that it worked, and, apart from cryptographic erase, points to IEEE 2883 and NSA specifications for specific methods. NIST does not certify erasure tools.

NIST guidance is not itself law for most private businesses, but contracts, certifications and state data protection and disposal laws make a defensible sanitization program essential, and buyers increasingly ask to see it.

For software: identify every data-bearing device at receiving, restrict access to it, route it to sanitization by an appropriate method for its media, record verification and a certificate per device, and keep chain of custody until it leaves.

Fair Fraud Controls and Customer Data

Return fraud is real, and controls are legitimate. They must also be fair: based on behavior rather than protected characteristics or proxies for them, explainable to the customer and to a regulator, and reviewed by a person before a refund owed under the policy is refused.

Sharing customers’ return histories across companies raises consumer reporting and privacy questions that need counsel.

And customer data in returns systems falls under state privacy and breach notification laws. Settling this scope before building is covered in Why US Returns and Reverse Logistics Leaders Need a Technology Consultant in 2026.

Conclusion

Returns platforms that apply the right refund rule to each case, keep disclosed and applied policies identical, treat batteries and electronics as regulated when they leave as waste, gate resale on recall checks and honest disclosure, and sanitize every device under a documented program protect customers, buyers and themselves.

This is educational content, not legal advice. Confirm your position with qualified counsel and specialists before relying on any of it, and brief the software companies in the United States quoting you on where the platform’s job stops.

If you are scoping a returns platform, mapping these five rule sets to specific gates and records before architecture is fixed is what keeps recovery from creating liability.

FAQ