In this Ironwood Registrations podcast episode, hosts A and B walk nonprofit leaders through the evolving legal landscape of charitable solicitation in the digital age. They begin by describing the anxiety nonprofit executives feel when a seemingly innocuous email or social‑media post might unintentionally trigger multistate fundraising registration requirements. The conversation traces the shift from clear, physical solicitation (rubber‑chicken gala invites) to today’s “digital blur,” where a single email, newsletter, or TikTok video can be interpreted as a solicitation in any state where a recipient resides. The core legal framework discussed is the Charleston Principles (2001), which distinguish between a nonprofit’s domicile and “substantial non‑incidental contact” with donors in other states. The hosts illustrate how regulators assess intent, not just specific wording, using a fictional nonprofit, Community Table, to explore scenarios such as: - A monthly newsletter with a generic “support our mission” link (passive vs. active solicitation). - The “2‑click rule” for direct asks. - Safe‑harbor communications that contain no ask or donation link. - Social‑media virality (TikTok, celebrity shares) and the follow‑up emails that convert passive exposure into active solicitation. - Peer‑to‑peer fundraising where supporters act as solicitors. - Website donate buttons and the difference between passive availability and targeted advertising. Myths are debunked: size of the organization, reliance on fundraising platforms, and the informality of a post do not shield an organization from registration obligations. The episode then offers a practical compliance playbook: break down silos between marketing and finance/compliance, conduct donor‑by‑state data reviews, suppress solicitation in unregistered states, and register where needed. Finally, the hosts reframe compliance as a sign of growth, encouraging nonprofits to use their existing analytics as a “compliance map” to proactively manage multistate fundraising risk. Key takeaways: understand the Charleston Principles, differentiate passive from active outreach, use data to identify geographic exposure, apply geo‑suppression or register, and view compliance as a sustainable scaling tool rather than a bureaucratic burden.
Chapters
Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.
It's great to be here for another deep dive.
Yeah, let's, let's get right into it today because there is this very specific anxiety, and I think pretty much every executive director or development director out there feels it, even if they never bring it up at the weekly staff meetings.
Oh, I know exactly what you're talking about.
You're sitting there at your desk. You've just drafted an email to your list, and it's heartfelt. It's urgent. It's got a great picture of your team actually out on the ground doing the work. And right there at the bottom, there is a link. Maybe it just says, help us, or maybe even just learn more. You hit send, and then at like 2:00 AM, you jolt awake wondering, wait, did I just accidentally break the law in 20 different states?
Yes. That is the classic 2:00 AM panic. And frankly, and people aren't gonna want to hear this, it is not entirely unfounded.
Well, that's not comforting at all.
No, but it's the truth.
But I guess that is exactly the tension we are dealing with today. We're looking at that line between, you know, just communication and official solicitation. Because 10 years ago, that line was basically a brick wall.
Very clear.
Very clear. But today, with digital outreach, it's It's just a blur. A friendly update on Instagram or a quick e-newsletter can actually trigger these intense regulatory requirements. And most leaders don't even know those rules exist until they get a scary letter from an attorney general.
Exactly. And our mission for this deep dive is to dissect that blur because we aren't talking about the obvious stuff today. I mean, if you mail a formal printed invitation to a gala—
Everyone knows that's a solicitation.
Right. You know it, the state knows it. We're looking at the gray areas today, the e-newsletters, the viral social media posts, those donate buttons sitting on your homepage. We really need to unpack how regulators view digital outreach versus how we tend to view it as marketers.
Because often those 2 views are diametrically opposed.
Completely opposite.
And for everyone listening, whether you're on the finance side trying to keep the organization safe, or you're in marketing just trying to keep the lights on, This deep dive is about giving you the confidence to press send without constantly looking over your shoulder.
Because confidence comes from clarity. If you actually know where the lines are drawn, you can walk right up to them without accidentally stepping over.
Totally. So to understand the mess we're in now, I feel like we have to look briefly at where we came from. And I don't want to get too nostalgic for the good old days of direct mail because stuffing thousands of envelopes was an absolute nightmare.
It really was.
But legally speaking, it was clear, right?
It was incredibly clear. Historically, a solicitation was defined by physical presence or direct contact. You sent a physical letter to a specific address. You knew that Mrs. Smith lived in Ohio.
Right.
Therefore, you were soliciting in Ohio. It was a tangible physical transaction of information.
Or like the classic rubber chicken dinner. If I rent a hall and hold a gala in Chicago, I am soliciting in Illinois. It's distinct. It's contained.
Precisely. You had jurisdictional certainty. The regulator knew exactly where you were operating, and you knew exactly where the donor was sitting. But then, you know, the internet happened.
Yeah.
And we entered what we in the field call the digital blur.
And this is where it gets so messy. Because a digital message, it does everything at once. I can send an email that shares a touching success story, educates the donor on a complex policy issue, and asks for $5. All in the exact same paragraph.
And that creates a massive compliance paradox. That email feels informal to you. It feels like you are just chatting with your community.
Right. It feels like an update.
But to a regulator, if that email lands in an inbox in Florida and it asks for money, you have physically entered Florida to solicit funds.
Wait, hold on. Physically entered? Because that seems like a massive stretch. I'm just sitting at my laptop in Oregon.
It definitely feels like a stretch to us, but legally, that is the framework they operate under. When you send a targeted message into a state with the intent to receive funds, you are subject to that state's jurisdiction.
Okay, but that sounds literally impossible to police. If I have an email list of, say, 5,000 people, they could be anywhere. People move, they check their email on vacation in Hawaii. How on earth do regulators actually define solicitation in this context? Is it just looking for the exact phrase, please donate?
No. And that is a very common misconception. It is not just about specific magic words. Regulators, and the courts for that matter, look at the overall context. They are looking for the intent of the message.
Okay, give me the technical breakdown here, because I know there's a framework regulators use. They can't just make it up as they go along based on vibes.
Right, they don't. Most states look to a framework called the Charleston Principles.
The Charleston Principles?
Yeah. These were established way back in 2001 to guide states on internet solicitation. Now, they aren't binding law in every single state, but they are the playbook that most attorneys general use.
Okay. What do they actually say? In plain English, if possible.
They basically distinguish between where you are domiciled, meaning where your physical office is, and where you have what they call substantial non-incidental contact. Yep. Essentially, they say that just having a website isn't enough to trigger registration everywhere in the country. But if you use that website to specifically target people in a state, or if you receive substantial repeated contributions from a state and then follow up with those people, then you are on the hook. Then you're on the hook. The activity moves from passive to active.
Let's apply this to a real scenario because terms like substantial contact start to sound like legalese. Let's imagine a fictional nonprofit.
Okay.
Let's call them Community Table. They are a food bank operating in Kansas City, and they have a pretty decent email list.
Okay. Community Table's our test subject.
So they send out their monthly newsletter. It's mostly stories like, here's a family we fed this month, or here's our brand new delivery truck. But right at the bottom of the email, there's a link that just says, support our mission. That email goes out, and it hits the inbox of a donor who moved from Kansas City to New York 3 years ago. Is Community Table now soliciting in New York?
This brings up what we often call the 2-click rule in compliance circles. Though I should clarify, it's more of a rule of thumb than an actual written statute.
Walk us through the 2-click rule.
If the email itself says, we need $50 to buy a new tire for the truck, please click here to give, that is a direct solicitation. You are soliciting in New York, period.
Okay, that's very clear. But what if the email just links to a blog post about the new truck, and then on that blog post, there happens to be a sidebar with a donate button?
That is the gray area. Generally speaking, if the email is purely informational, hey, read about our truck, and the links to a webpage that is also purely informational, the fact that a donate button just exists on the website's global template might be seen as passive. You aren't driving them to the donation, you are driving them to the story.
But regulators aren't stupid. They know the ultimate goal of all of this is eventually money.
Correct. And that's why context is everything. If the overall context suggests the entire purpose of the email was actually just to funnel people to a donation page under the guise of a story, they will view it as a solicitation. If you internally track click-throughs and financial conversions on that specific email, you are treating it as a fundraising campaign, And the regulator will too.
Wow. That is a terrifying distinction for a marketing team. You're saying if I measure the success of my newsletter by how many donations it brought in, I have essentially turned it into a solicitation.
Intent matters. If you are engineering the user journey to extract a donation, that is solicitation. This is exactly why informational outreach really needs to be genuinely informational.
So, do safe harbors actually exist? Can Community Table send anything to that New York donor without having to register in New York?
Yes, absolutely. Purely administrative Educational updates are fine, like, here's our annual impact report, here is a change to our operating hours, or here's a research article about hunger statistics in our region.
So strictly news?
Strictly news. If there is no ask and no direct link to a donation form in the body of the message, you are generally in the clear.
But the very moment I add a little line at the bottom saying, and if you want to help, click here—
You have crossed the line. The classification of that entire document shifts immediately from stewardship to solicitation.
Okay, let's pivot slightly to social media, because if email is tricky, social media feels like the absolute Wild West. You have even less control over who sees it.
Oh, definitely.
So Community Table posts a video on TikTok. It's meant for the Kansas City community, but algorithms are weird.
Algorithms are effectively random distribution engines. You don't control them.
Right. So let's say a celebrity— let's Paul Rudd, since he loves Kansas City, sees the post and shares it.
Okay.
Suddenly, Community Table has 50,000 views, and donations are pouring in from California, Texas, Florida, everywhere. Did they just accidentally break the law?
Well, this is basically the nightmare scenario for compliance, but it's the dream scenario for development. This is the viral effect.
So what actually happens? Because they didn't ask Paul Rudd to share it.
This goes right back to the Charleston principles. Initially, that TikTok post was likely passive. They didn't actively target residents of California. But once the money starts coming in, that non-incidental part of the rule kicks in.
Meaning they are taking the money.
Right. If Community Table accepts those donations and then— and this is the crucial key here— sends a follow-up email to those new donors saying, Thank you so much, please consider giving again next month. They have now officially established a solicitation relationship in those states.
Ah, so the initial viral explosion might be forgivable, or at least passive, but the follow-up is what traps you.
Exactly. You can't control the organic spread of the internet, but you absolutely can control how you process the result. If you suddenly have 200 brand-new donors sitting in California, you can no longer claim you don't have a presence there. You are now a multistate fundraiser.
And what about peer-to-peer campaigns like Facebook birthday fundraisers? It's my birthday, donate to Community Table.
That's a major complication. In that case, the donor is acting as a solicitor on your behalf. Most states will look at whether the charity authorized or enabled that fundraising.
How do they define enabled?
If you have a button on your own website that says, start your own fundraiser for us, You are explicitly authorizing it. You are responsible for where those individuals solicit.
Wow. Okay, I want to clarify something about websites in general because I feel like this is where the most confusion lies. I've heard leaders say, if I put a donate button on my website, I have to register in all 41 states that require it, period. Is that true?
That is the absolute most conservative interpretation you could have, but generally, no, that is not the standard.
Okay, thank goodness. So what is the actual standard?
It comes back to that difference between passive availability versus active promotion. Let's use a specific example. Let's say I am sitting in Texas. I search Google for Midwest Hunger Relief. I organically find Community Table's website in the search results. I click donate. That is passive. Community Table didn't find me. I went out and found them.
Okay. That makes total sense. They didn't reach into Texas.
Exactly. Now contrast that. Community Table buys a targeted Facebook ad. They set the audience targeting to people interested in charity, and they set the geography to Texas. I see the ad in my feed, I click, I donate.
That's active.
That is highly active. Active promotion. You paid money to digitally enter Texas. You targeted a resident there. You are soliciting in Texas. So the website itself isn't the trigger, it's how you purposefully drove traffic to it.
This sounds logical when you lay it out, but it still feels like a really heavy burden for organizations. And I want to play Mythbusters here for a second because I know leaders constantly try to talk themselves out of these requirements.
Oh, I've heard them all.
I bet you have. I'm going to throw a justification at you and you tell me if it holds any water.
Ready.
Myth number 1, we are too small. Leaders think the Attorney General of California has bigger fish to fry. They don't care about my $50,000 nonprofit.
That is a very dangerous gamble. Now, it's true that some states have threshold caps. For example, if you raise under $25,000, you might be exempt from the formal registration process.
Okay.
But you are not exempt from the law itself. Generally, these regulations are not based on your total budget size; they are based on your activity. If you solicit, you must register, unless you specifically qualify for a written exemption. And remember, smaller organizations are often the ones that get reported by disgruntled former board members or unhappy donors.
That's a really good point. It's not just state aggressively auditing people. It's the public reporting things. Okay, myth number 2: the platform handles it. People say, we use GoFundMe, or we use Network for Good. They're massive tech companies. Surely they handle all the legal registration stuff for us.
I hear this constantly, and the answer is almost always no. The platform is merely a payment processor. They are a tool. You are the charity. You are the legal beneficiary of those funds. The legal obligation to register, falls on the entity that is actually asking for the money, and that's you. You cannot outsource your legal liability to a tech platform.
I mean, that feels unfair to people. Those platforms take a hefty fee.
They take a processing fee, not a compliance fee. Now, unless you are using a very specific donor-advised fund model where the platform legally takes ownership of the money first and then grants it to you later, the burden is entirely yours.
Okay, myth number 3: It's just informal. Like, it's just a casual tweet, it's just an Instagram story that disappears in 24 hours.
We touched on this earlier, but it absolutely bears repeating. The law does not care about the medium. It cares about the message. A request for money in a casual, funny TikTok dance video is a solicitation, legally speaking, just as much as a 100-page formal grant proposal. Informal does not mean unregulated.
Alright, well, you've sufficiently scared all of us. We see the risk. The digital blur is Very real. But nonprofits can't just stop fundraising. We have to operate. We have to fund our missions. So what are the practical steps? If I'm that executive director at Community Table, what do I actually do tomorrow morning when I get to the office?
It has to start with breaking down the silos between your marketing team and your compliance team or your finance person.
That's easy to say, but hard to do in practice. They speak completely different languages. Marketing speaks conversion rates, and compliance speaks risk and liability.
True, but they have to learn to speak strategy together. You need a simple coordination meeting. Before the massive end-of-year digital campaign launches, compliance needs to be in the room asking marketing, who exactly is getting this email? Are we segmenting our list?
Right, so if you know you aren't registered in Florida, maybe you just exclude Florida zip codes from that specific appeal.
Exactly. That is a highly manageable step. You can suppress specific geographies in almost any email marketing tool today, like Mailchimp or Constant Contact. If you aren't legally registered to ask there, just don't ask there. Send them an informational update instead.
But that requires actually knowing where your donors are physically located.
Which brings us to step 2, data review. You need to pull a report, look at donors by state, If you suddenly see you have 500 active donors in a state where you aren't registered, you have a strategic decision to make.
Right.
You either stop asking them for money, which no one wants to do, or, and this is obviously the better option, you go get registered in that state.
And this actually brings me to a mindset shift I really wanted to discuss in this deep dive, because we usually talk about all this stuff as a huge headache. It's red tape, it's bureaucracy. But isn't there a positive way to look at this?
There absolutely is. And this is a core theme I try to impart to organizations. I truly believe that compliance issues are actually a symptom of success.
How so? Unpack that for us.
Think about our fictional Community Table. If they are suddenly waking up worrying about accidentally soliciting in New York and California, what does that actually mean? It means their message is incredibly powerful. It means their mission is resonating far beyond their local neighborhood in Kansas City.
Right.
It means they are growing. Compliance tends to expand alongside fundraising growth. It goes hand in hand.
So, getting that notice— well, okay, maybe not getting the penalty letter itself, but realizing you need to register— is actually a badge of honor.
It's a growing pain, but it's a necessary positive one. Organizations that review these requirements periodically avoid most of the major problems. And if you reframe compliance as scaling sustainably, It completely changes the internal conversation. You aren't registering in these new states because the government is being mean to you. You are registering because your organization is successfully becoming a national player.
Scaling sustainably. I really like that framing. It means you're building a foundation that can actually hold the weight of the money you're starting to raise.
Exactly. If you build a massive viral fundraising engine on top of a shaky compliance foundation, eventually the whole thing cracks. Doing this administrative work upfront gives you the freedom to just grow fearlessly.
Well, let's wrap this up. We've covered a lot of ground today. We looked at the major shift from the physical rubber chicken days of clear mortars to the digital chaos we operate in today. We talked about the Charleston Principles and that really crucial distinction between passive availability on a website and active targeted promotion.
And we busted those persistent myths that your budget size or the informality of a social post offer any sort of legal protection.
Yeah, they don't. I think the big takeaway for everyone listening is that this is entirely manageable. It just requires actually looking at your data and making intentional strategic choices about where you are asking for support.
Intentionality really is the word of the day here. Don't let your technology or an algorithm decide your compliance footprint for you. You need to decide it.
So true. Now, before we sign off, I know you have a final thought for us to mull over, something to leave the audience with.
I do. We spend so much time in this sector obsessing over click-through rates. We look at open rates, clicks, digital conversions. But I want to challenge every nonprofit leader listening right now. Have you ever stopped to map the geographic footprint of those clicks?
Meaning not just that they clicked, but where their computer was sitting when they made that click.
Exactly. Your Google Analytics, your email provider data, it all tells you exactly where your audience is physically located right now. You already have this information at your fingertips. The question is, Are you just using that data to ask for more money, or are you using that exact same data to proactively protect your organization? Your digital dashboard isn't just a marketing tool; it's a compliance map that's just waiting to be read.
That is a fantastic visual. The map is already there; you just have to actually look at it.
Exactly.
If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.
