Simple, there were no sales prior to this year.
Then delete all of your online sales records... and claim it was a virus (Stuxnex, anyone?).
And thus, the state won’t have any records one way or the other. If they push it, you can ask for their records, for yours are now ‘lost’.
Care to guess whether they have your records? (I think not.)
Would not surprise me at all if access to citizen credit card info was included in Fin Reg bill. Prolly under the guise of "consumer protection."