I'm no attorney, but here's the matter as I understand it.
The matter may not be entirely settled, either.
First off, Sales tax in the U.S. is a matter of state law, not federal law. Each state is different, and some states don't have sales tax (some don't have income tax).
Sales tax is charged on software sales in a standard 'brick and mortar' based retail store, just like any other taxable retail item.
In theory, if the retailer is 'mail order' or, as the modern version has it, 'Internet order', and if the retailer is selling to a customer in a different state, then the state where the retailer is based is not able to collect sales tax; the sale is said to have occurred in the state where the buyer resides. If there could ever be a declaration that the retailer's own state is owed that tax on the sale, the problem occurs in the buyer's location where THAT state would also claim taxation, leading to a double tax. Clearly that's not possible if someone is traveling over state lines with recent purchases.
The purchaser is said to have the burden of paying the sales tax in the state of their residence. In theory, that purchaser is supposed to pay the tax, but in practice it isn't practical for the states to track and enforce this requirement. The vendors aren't required to collect tax FOR states where they have no corporate presence, at least at the present time.
If the seller and buyer are in the same state, and if that state has a sales tax applicable to the item purchased (some exclude food, for example), then the seller is required to collect that state's sales tax on the sale.
This leaves the matter in an unsolved limbo. As Internet based sales climb, the notion of sales taxation for the states may have to change, at least in their view, because they are 'being denied' taxes on retail sales, in ever increasing volume. The sticky point, though, is that so far no one has been able to solve the problem raised when the buyer or retailer points to the 'crossing state lines' analogy - as in, what do you expect of the purchaser visited state A, made purchases, then returned home to state B. You can't expect state A to forfeit sales taxes simply because the purchaser resides in another state, and then what is really the difference between such a traveling purchaser and one who requests delivery of goods. What if the purchaser mailed the goods to himself from state A? He would have paid state A's sales tax, if any, because that transaction occurred within the retailer's state.
If I recall correctly, the supreme court had a case on this a few years ago. I don't think much was settled, except that when such a transaction occurs, it can't be said to have occurred in the seller's state, but in the purchaser's state, because, if I understood correctly, even though retailers collect the tax, this tax is actually levied upon the consumer. Sales tax is something charged to the purchaser. If it were a tax on the retailer, it might as well be levied as a special kind of income tax, and it's not.
Since the tax is levied on the purchaser, but there is no way to track, prove and collect taxes on what people purchase, at present, states can't enforce the collection.
This applies to all taxable goods sold over the Internet within the U.S. across state lines, not just software.
Trust me, though - they WANT to collect this tax. It's a strange state of affairs, though. Theoretically everyone who has purchased anything from an Internet sales source from another state, where they were not charged sales tax, owes the state on those sales - and are in default on those taxes. Proof in pressing a charge, from what I understand, can only come into the states hands in a manner similar to how they would discover illicit sexual practices performed in the home (or hotel) - and although that has happened once, it didn't turn out well for the state (Texas, who's law prohibiting a certain practice was struck down in that landmark case).
). I don't think this is enforced very strictly by PayPal though. Perhaps it is linked to your physical address you use when setting up your PayPal (customer) account, but I would argue it's not PayPal's responsibility to verify the whereabouts of their users.