Is an authentication service that provides a digital certificate subject to Colorado sales or use tax?

Plain-English summary

Colorado’s Department of Revenue ruled that an authentication solution built around digital certificates was a nontaxable service. The company verified a customer and its website, issued a digital certificate, and communicated with end users to confirm that the certificate remained valid.

The Department said the certificate was not computer software because it did not contain binary programming code or instruct a computer to perform a task. It did not need to decide whether the certificate was tangible personal property, because the true object of the entire transaction was the authentication and certification service. The lump-sum subscription charge for the authentication service, certificate, and resolution process was therefore not subject to Colorado sales or use tax.

What this means for you

Technology and certification businesses

A transaction that provides a certificate alongside a verification or certification service may be treated as a service when the true object is the service. The business model and what the customer is actually buying matter.

Digital-product providers

Electronic delivery does not itself decide the tax result. The Department focused on the certificate’s function and the transaction’s true object, and found the certificate was not computer software under the cited definition.

Accountants and tax professionals

The ruling assumes the company completely and accurately disclosed all material facts. It is subject to modification or revocation under the Department’s ruling procedure.

Common questions

Q: Was the digital certificate taxable computer software? A: No. The company represented that it contained no binary programming code and did not instruct a computer or equipment to perform a task, so it did not meet the cited software definition.

Q: Did the Department decide whether the certificate was tangible personal property? A: No. It said that issue did not need to be decided because the true object of the transaction was a nontaxable authentication service.

Q: Can every digital certificate provider rely on this ruling? A: No. A private letter ruling binds the Department only under its stated facts and cannot be relied on by another taxpayer. It may also be modified or revoked.

Q: Does the ruling cover self-collected home-rule taxes? A: No. It addresses Colorado state and state-administered taxes and excludes taxes administered by self-collected home-rule jurisdictions.

Citations and references

• §§ 39-26-104 and 204, C.R.S. (sales and use tax on tangible personal property)
• § 39-26-102(13.5)(b), C.R.S. (computer software definition)
• Special Regulation 52 (service enterprises and transactions that include tangible property)
• City of Boulder v. Leanin’ Tree, 72 P.3d 361 (Colo. 2001) (true-object analysis)
• Department Regulation 24-35-103.5 (private letter ruling procedure)

Source

• Landing page: https://tax.colorado.gov/all-letter-rulings
• Original PDF: https://tax.colorado.gov/sites/tax/files/documents/PLR_11-003.pdf

Original ruling text

Office of Tax Policy
P.O. Box 17087
Denver, CO 80217-0087
[email protected]

PLR-11-003
May 31, 2011
XXXXXXXXXXXXXX
Attn: XXXXXXXXXX
XXXXXXXXXXXXXX
XXXXXXXXXXXXXX
Re: XXXXXXXXXXX
Dear XXXXXXXXXX,
Your firm submitted on behalf of XXXXXXXXXXXXXXX (“Company”) a request for a private letter ruling to the Colorado Department of Revenue (“Department”) pursuant to Regulation 24-35-103.5. This letter is the Department’s private letter ruling. Issue Are Company’s sales of authentication services by means of a digital certificate to the Company’s customers subject to Colorado sales and use taxes when provided to customers located in Colorado? Conclusion Company’s sales of authentication services by means of a digital certificate are not subject to Colorado sales or use taxes. Background Company provides authentication solutions for businesses and individuals seeking to perform secure electronic commerce and communications over the Internet. The solution at issue in this ruling involves the use of a digital certificate. The customer’s web server generates a private and public key. The private key is retained by the customer on its web server and the public key is sent to the Company. Company performs due diligence necessary to authentic the identity of the customer, the related web site and business, and the information presented by the customer during the registration process with Company. Once Company completes the authentication process, Company electronically sends to the customer a digital certificate. The digital certificate is a “flat” file containing the customer’s public key, and other data relating to the customer. The certificate does not contain binary computer programming code. When end users (customers of the Company’s customer) connect to the customer’s web server through a web browser, the browser establishes the authenticity of the digital

–2–

certificate by mathematically proving that the certificate presented by the customer’s web server was digitally signed by the Company. The end user’s browser then creates a session key that is used to encrypt the transmission between the customer’s web server and the end user’s browser. The browser uses the public key which was presented by the web server via the digital certificate to encrypt the transmission which includes the session key, which is then transmitted to the web server. The customer’s web server then uses its private key to decrypt the transmission. The web browser also communicates with the Company to ensure that the certificate is valid and not revoked. If the certificate is valid, the end user’s browser will show the end user a notification that the certificate is valid. Company charges customers for the authentication solution. Charges for the authentication service, digital certificate, and a resolution process are part of a lump sum subscription charge. Discussion Colorado levies sales tax on the sale of tangible personal property and use tax on the use, storage or consumption of tangible personal property. §§39-26-104 and 204, C.R.S. With exceptions not relevant here, Colorado does not levy sales or use tax on the provision of services. Company advances several arguments that the authentication solution is not subject to Colorado sales or use tax. Company correctly notes that computer software is defined as “a set of coded instruction designed to cause a computer or automatic data processing equipment to perform a task.” §39-26-102(13.5)(b), C.R.S. Company represents that the digital certificate does not contain binary computer programming code and does not otherwise instruct a computer or equipment to perform a task. Therefore, the digital certificate is not taxable computer software. Having determined that the digital certificate is not computer software does not also mean that it is not tangible personal property. Company asserts that the digital certificate is not tangible personal property because it is electronically delivered over the Internet. However, this is not an issue that we need to address in order to reach a ruling in this case. For reasons discussed below, we conclude that the authentication solution provided by the company is a non-taxable service regardless of whether the certificate is tangible personal property. Some transactions are non-taxable because they are provisioning non-taxable services, even though some tangible personal property is transferred by the provider to the consumer. See Special Regulation 52 (Service Enterprises). For example, a charge by a film maker for production of a film for a specific buyer is a non-taxable service even though the film maker provides the buyer with celluloid film. In City of Boulder v. Leanin’ Tree, 72 P.3d 361 (2001), the Colorado supreme court discussed a variety of tests employed by states to determine whether a transaction is a sale of taxable tangible personal property or non-taxable services. These tests included consideration of the “true object” of the transaction, the comparative value of the tangible property, as well as consideration of whether such transactions are commonly understood to be for property or services. Although somewhat easy to state in the abstract, these tests are often difficult to employ in specific cases.

2

–4–

We are persuaded that the “true object” of the authentication solution is the provision of a non-taxable service. In general, testing and certification processes, such as that provided by Underwriter’s Laboratories and other companies who test and certify the safety, quality, and/or functionality of equipment, are commonly understood to be services, even though these companies may also provide a certificate that their customers can present to end users. Company provides a similar service. It verifies that the customer and its web site are who and what they claim to be. Once the verification is completed, Company provides customer a certificate which it can present to its end users. The communication between end users and Company for purposes of ensuring that the certificate is valid also strikes us as a service. Other states that have considered this issue have reached similar conclusions. Tennessee Letter Ruling No. 04-03, 01/28/2004 (digital certificate not computer software / transaction is a service and not a sale of tangible personal property); Texas Policy Letter Ruling No. 9911887L, 11/18/1999; New York Advisory Opinion TSB-A-00(7)S, 02/02/2000; Illinois Dept. of Rev. General Information Letter ST 01-0148-GIL, 08/06/2001. Miscellaneous This ruling is premised on the assumption that the Company has completely and accurately disclosed all material facts. The department reserves the right, among others, to independently evaluate the Company’s representations. This ruling is null and void if any such representation is incorrect and has a material bearing on the conclusions reached in this ruling. This ruling is subject to modification or revocation in accordance to Department Regulation 24-35-103.5 Enclosed is a redacted version of this ruling. Pursuant to statute and regulation, this redacted version of the ruling will be made public within 60 days of the date of this letter. Please let me know in writing within that 60 day period whether you have any suggestions or concerns about this redacted version of the ruling.

Sincerely,

Office of Tax Policy
Colorado Department of Revenue

4