What You Cannot Sell on Shopify — Prohibited Products and Why Stores Get Shut Down

This question reaches us in two very different tones of voice. The first comes before launch: I want to sell this category, will Shopify even allow it? The second arrives late at night, right after an email mentioning a review, a reserve, or a deactivation. Both are fundamentally the same question, and in both cases people go looking for the same document — the one big list of products banned on Shopify.

That list does not exist. This is not a technicality. It is the single most useful thing to understand about the entire topic. There are three independent layers of rules that all apply to you simultaneously, written by different companies, enforced with different levels of strictness, and carrying completely different consequences. Because almost nobody separates these layers cleanly, two mistakes happen with remarkable regularity. Some people abandon a perfectly viable business idea because a forum post told them their category was banned on Shopify, which simply was not true. Others carefully read the Shopify policies, find nothing alarming, launch, trade successfully for six months, and then get hit from a direction they never thought to watch.

This guide separates the layers. It shows you what Shopify itself actually prohibits, which is considerably less than most people assume. It shows you where the real danger sits, which is your payment processor. It explains a distinction that a large share of articles on this topic gets flatly wrong: prohibited versus restricted. And it describes how a shutdown actually unfolds, so you can recognise the warning signs while you still have options.

Important note: this article is not legal advice. We are a Shopify agency, not a law firm. The policies described here reflect their state at the time of publication, and Shopify, Stripe, Adyen and PayPal revise them regularly — sometimes several times a year and sometimes without announcement. Before making any decision with real commercial consequences, check the primary sources we link throughout this article, and get qualified legal advice for regulated products.

The three-layer model

Before the detail, here is the framework the rest of this article rests on. Pay particular attention to the right-hand column, because it answers the question you are actually asking: what specifically happens to me?

Layer	Who writes the rules	How strict	What happens if you breach it
1 — Acceptable Use Policy	Shopify itself	Short, general, principle-based	Your entire store is closed
2 — Payment processor	Stripe, Adyen, PayPal — not Shopify	Highly detailed, very long	Funds held, payouts stopped, payment account closed
3 — Sales channels	Shopify, per channel (Shop, Managed Markets)	Strictest, very specific item lists	You lose that channel only, the store keeps running

The key insight lives in that last column. These are not sequential tiers you work through from top to bottom. They are three parallel checks. You can be in perfect compliance with Layer 1 and still fail Layer 2. That is by far the most common real-world scenario: a store that violates no Shopify policy whatsoever, selling a product that is entirely legal in its market, losing its ability to accept payments.

Layer 1: what Shopify itself prohibits

The Shopify Acceptable Use Policy surprises most people the first time they actually open it. It is short. It is written in plain language. And it contains essentially no product list. Merchants who go looking for their category usually will not find it — and wrongly conclude that everything is fine.

The heart of the policy is a single principle: you cannot use Shopify to do anything that is illegal where you do business. That phrasing is deliberate. Shopify operates in well over a hundred countries and cannot write a globally valid product list, because something legal in one US state is a criminal offence in the next. So the policy pushes responsibility to where the legal knowledge actually sits, which is you.

Beyond that principle, the policy does name a handful of specific things. You cannot call for or threaten violence against specific people or groups. You cannot sell products that facilitate intentional self-harm. You cannot upload protected health information as defined under HIPAA. You cannot commit fraud against Shopify, other merchants, or buyers. No spam. And no gaming the system to get around constraints.

The conclusion should reassure a lot of merchants: the threshold for getting removed from the platform itself is high. Shopify does not remove people for selling supplements, knives or vape accessories. Shopify removes you for doing something illegal, defrauding people, or running a business that actively harms others. Shopify also describes its enforcement as graduated — notice and an opportunity to fix things first, then product-level action, with account-level termination as a last resort.

So if you are lying awake worrying that Shopify will pull your store tomorrow because your category feels edgy, that is usually the wrong worry. The right worry is Layer 2.

Layer 2: the payment processor, where it actually happens

This is the section this article exists for. If you take nothing else away, take this.

Shopify Payments sounds like a Shopify product. Technically it is an interface, behind which a different financial company handles the actual processing depending on your country. You can look up exactly which company that is — Shopify publishes the mapping in its payment processor list. And that company brings its own list of prohibited business types, which is far longer and far more specific than anything Shopify publishes.

Country	Who actually processes your payments	Whose list governs you
United States	Stripe, Inc., PayPal, Inc.	Stripe, PayPal
United Kingdom	Stripe Payments Europe Limited, PayPal, Adyen N.V.	Stripe, PayPal, Adyen
Germany	Stripe Payments Europe Limited, PayPal (Europe) S.a r.l., Adyen N.V.	Stripe, PayPal, Adyen
Austria	Stripe Payments Europe Limited, PayPal (Europe) S.a r.l., Adyen N.V.	Stripe, PayPal, Adyen
Switzerland	Stripe Payments Europe Limited, PayPal (Europe) S.a r.l., Adyen N.V.	Stripe, PayPal, Adyen
Netherlands	Stripe Payments Europe Limited, PayPal (Europe) S.a r.l., Adyen N.V.	Stripe, PayPal, Adyen
Turkey	Shopify Payments is not available there	iyzico, PayTR, PayU or your bank

The practical consequence is uncomfortable and rarely said out loud. If you run a Shopify store and use Shopify Payments, the policy that matters most for your catalogue is not Shopify policy. It is Stripe prohibited and restricted businesses list, or the equivalent list from Adyen. Most merchants have never read these documents. They are the ones stores actually fail.

Prohibited means prohibited — these categories are final

Stripe maintains categories where no approval, no conversation and no documentation will help. The ones most relevant to an online store:

• Illegal drugs, substances designed to mimic illegal drugs, and equipment intended for making or using drugs
• Cannabis products and dispensaries, plus CBD products with THC levels above the applicable local legal limit, explicitly including CBD edibles
• Counterfeit goods, unauthorised sale of brand-name or designer products, and anything infringing trademark, patent or copyright
• Fake IDs and services providing fake references or falsified documents
• Pornography and adult services, including escorts, and explicitly including AI-generated content meeting the same criteria
• Gambling in the broad sense — casino games, sweepstakes and contests with a monetary or material prize, lotteries, sports forecasting, and even skill-based tournaments with prizes
• Debt collection agencies, debt settlement and debt consolidation services
• Pyramid schemes and multi-level marketing services offering commission or recruitment-based sales
• Get-rich-quick schemes, unrealistic reward promises, fake testimonials and similar deceptive models
• Cryptocurrency mining and staking, initial coin offerings, and secondary NFT sales
• Telemarketing and door-to-door sales
• Nutraceuticals and pseudo-pharmaceuticals that are not safe or that make harmful claims — that wording matters enormously, and we will come back to it

Restricted is not prohibited — the distinction that decides your business

Here is the point a large share of articles on this topic gets simply wrong. Alongside the prohibited list, Stripe maintains a second list: restricted businesses. These categories are not banned. They require additional due diligence, usually proof of licences, age verification or details about your business model. Approval is possible. It is not guaranteed, and Stripe explicitly reserves the right to revoke it at any time.

The clearest example is tobacco. Countless blog posts state that tobacco and e-cigarettes are banned on Stripe. That is not accurate. Tobacco products including e-cigarettes, cigars and e-liquid, where they are sold in accordance with applicable law, appear under restricted businesses, not prohibited ones. For anyone working in this space the difference is existential: prohibited would mean the business model is impossible on this infrastructure. Restricted means it is an application and documentation process with an uncertain outcome.

Other categories that are restricted, and therefore approvable in principle:

• CBD products containing only negligible amounts of THC per local limits — the line between this and the prohibited list runs exactly along each jurisdiction legal threshold
• Legal firearms including regulated parts and accessories, and other weapons such as stun guns, pepper spray and machetes — but only in selected countries, and where the weapon is illegal it stays prohibited
• Online pharmacies, prescription-only products, regulated medical devices and telemedicine
• Financial products and services — investment and brokerage, lending, buy now pay later, money transmission, escrow, neobanks
• Cryptocurrency exchanges and wallets, plus first-party NFT minting and sales
• Precious metals, stones and other high-value goods
• Crowdfunding and fundraising, where several subcategories are supported only in specific countries and prohibited everywhere else
• Online dating and matchmaking services

Note the country clauses in that list. They are a recurring pattern: the same category can be approvable in one market and outright prohibited in another. If you sell internationally, you check the rule once per target market, not once in total.

Why PayPal and Adyen need checking separately

A detail that is easy to miss in the table above: in most European markets three providers sit side by side. They maintain different lists. A category can be approvable with one and excluded by the next. Two implications for you. First, if you work in a sensitive category, check every provider you intend to enable, not just the one that appears first at checkout. Second, a rejection from one provider is not a verdict on your business model. It is a statement about that provider.

Layer 3: channel rules — strict, but far less dangerous

The third layer is the one most often confused with the first two, even though it is the mildest. Sales channels inside Shopify apply their own, considerably stricter product rules. The important difference: breaching them does not close your store. It removes your product or your store from that one channel. Your own storefront keeps running and your payment processing is untouched.

The Shop channel

The Shop channel — the Shop app and its associated surfaces — is a curated consumer environment. The rules there look more like an app store than a payment policy. Categories typically excluded include age-restricted products such as alcohol, tobacco and gambling, cannabis and drugs, pharmaceuticals and medical devices, weapons, ammunition and explosives, human body parts and bodily fluids, adult content and nudity, endangered species products and items associated with animal cruelty, digital currency, securities and investment products, and hateful, violent or obscene content.

For most merchants this is a footnote. For merchants in age-restricted categories it is strategic information: part of Shopify distribution surface will be permanently unavailable to you, and your reach planning has to work without it.

Managed Markets — the list that genuinely surprises people

Managed Markets is Shopify cross-border service, where Shopify handles duties, import fees and shipping logistics. Because physical goods pass through customs and international freight networks, the exclusion list there is substantially longer and includes things nobody thinks of as sensitive. If you assumed this topic did not apply to you because you sell nothing edgy, you may well find yourself here:

• Perfume and alcohol-based spray cosmetics, nail polish, aerosols, hand sanitiser, eyelash glue — the common denominator is flammability in air freight
• Candles, essential oils and incense
• Knives, across a substantial number of destination markets
• Safety-critical products such as child car seats and helmets, which would require per-country certification
• Vitamins and dietary supplements, over-the-counter medicines and herbal preparations
• Pet food, live plants, soil and fertiliser — classic phytosanitary and veterinary control territory
• Batteries and a wide range of electronics, again for dangerous goods reasons
• Artwork above a threshold in the region of 2,000 USD, and jewellery and watches above roughly 5,000 USD
• Mystery boxes and surprise packages, because the contents cannot be declared
• Rental products, items sold on a subscription-only basis, and third-party gift cards

Treat that as directional rather than exhaustive. Channel lists change more often than Layers 1 and 2, because they are tied to logistics partners, dangerous goods classifications and customs rules. Check the current state in the Shopify Help Center before you build a catalogue decision on it. If you are working out how to structure international selling in the first place, our guide to Shopify Markets and international selling covers the structural side of that decision.

The grey zones — legal, but hard to sell

Between clearly allowed and clearly banned sits the territory where most of the difficult conversations happen. These categories are legally tradeable in most Western markets, but the payment infrastructure treats them with suspicion. For every one of them there is a route, and every route costs preparation.

Nicotine, vape and pouches

This is the category where the gap between legal status and payment reality is widest. A product can be entirely lawful in your market, fully compliant with registration, labelling, age restriction and excise requirements — and you will still struggle to find a processor willing to handle it. That is not a contradiction, it is a division of roles. Legislators decide what may be sold. Processors decide what risk they are willing to carry. The two are independent.

What helps: real age verification that deserves the name rather than a confirmation pop-up. Complete regulatory documentation, prepared and ready to send before anyone asks for it. Product descriptions with no health-related claims whatsoever. And realistically, lining up a high-risk merchant account as an alternative rather than depending on Shopify Payments alone.

CBD and hemp products

The line here runs exactly along the destination country THC threshold, and that threshold is not the same everywhere. Below the local limit, CBD is a restricted and therefore approvable category on Stripe. Above it, it is prohibited. CBD edibles are named explicitly as prohibited where they exceed the limit. Selling into several countries means you do not have one rule, you have one rule per destination market — and the most permissive market does not set your policy.

Supplements and nutraceuticals

The most underestimated category of all, precisely because it looks so harmless. Vitamins are not a banned product. But Stripe excludes nutraceuticals and pseudo-pharmaceuticals that are not safe or that make harmful claims. That second clause is the dangerous one. It is not the capsule that determines your risk, it is the copy on the product page. A magnesium supplement is unremarkable. A magnesium supplement whose description promises to cure, prevent or treat a condition is a different matter entirely — and in Europe it simultaneously breaches health claims regulation, while in the US it collides with FDA rules on unapproved drug claims. This is where things most often go wrong in this category, and it is entirely avoidable.

Weapon accessories and outdoor gear

A grey zone with fuzzy edges. Regulated firearm parts fall under Stripe restricted categories with limited country availability. But seemingly harmless items can be caught too: stun guns, pepper spray and machetes are named explicitly. For outdoor and survival stores this means a small slice of the catalogue can drive the risk classification of the entire account. And knives, as noted above, are their own problem in cross-border shipping.

Adult products

A precise distinction is needed here, because blanket statements do real damage. Pornographic content and adult services are prohibited on Stripe. Selling physical products in the intimacy category is a different thing from selling content or services. Provider practice varies noticeably, and the imagery and copy on your storefront feed into how you are assessed. If you work in this space, settle the question before you build, not after.

Crypto, NFTs and digital assets

One of the sharpest dividing lines in the entire Stripe list, and it surprises many people. Mining, staking, ICOs and secondary NFT sales are prohibited. First-party NFT minting and sales, along with crypto exchanges and wallets, are restricted and therefore subject to approval. So a marketplace where third parties resell NFTs lands in the prohibited bucket, while an artist releasing their own work for the first time lands in the approval bucket. Same technology, two completely different classifications.

Subscription boxes and mystery boxes

Two different problems that often get conflated. Mystery boxes are primarily a cross-border shipping issue, because undeclarable contents are incompatible with customs paperwork. Subscription models are not inherently problematic, but they drift toward the prohibited category of negative option marketing when pricing or cancellation terms are unclear, or when a cheap trial silently rolls into an expensive plan. Transparent pricing, an obvious cancellation path and clear communication before each charge are not just legally correct — they are what protects your payment account.

How a shutdown actually unfolds

A common misconception is that one morning everything is simply gone. It almost never works that way. There is usually a recognisable sequence, and every stage leaves room to act — room that many merchants waste because they treat the first message as a formality.

1. Flag and review. Triggers are usually automated: an unusual revenue spike, a rising chargeback rate, a keyword on a product page, a customer complaint, or a routine periodic review. You receive an email requesting information. This is the moment with the most leverage in the entire process.
2. Reserve. The provider holds back a portion of incoming payments for a defined period to cover potential chargebacks. Your store keeps running, but your cash flow does not. For merchants with thin working capital, this stage often hurts more than the eventual closure.
3. Payouts paused. Payments are still accepted but no longer paid out. At this point the question is no longer whether you respond but how fast. Continuing to sell here means tying up more money in an account you cannot access.
4. Payment account closed. The provider ends the relationship. Held funds are typically released after a waiting period tied to chargeback exposure, which can run to several months. Your Shopify store still exists — you simply cannot take money through that provider.
5. Store closed. This step comes from Shopify itself and only for Layer 1 breaches. It is the rarest outcome, and it generally does not hit merchants working in a grey area — it hits merchants doing something illegal or fraudulent.

The practical lesson is unglamorous and constantly ignored: the first email is the most important one. A merchant who replies within hours, factually, with documents attached, is in a far better position than one who responds after the second reminder or who argues in general terms without answering the question that was actually asked.

What to do if it happens to you

Assume the message has arrived. This order has proven itself.

Export your data immediately. Before anything else. Products, customers, orders, invoices. While your access works this takes minutes. Once access is restricted it becomes a matter of weeks and lawyer letters. This point is deliberately first because it is the only one that cannot be done retroactively.

Read carefully who wrote to you. Is the message from Shopify or from the payment processor? Everything else follows from that. A payment problem is solved with a different payment provider and without touching your store. An AUP problem is not solved by switching providers.

Answer the question that was asked. Providers ask specific things: what exactly do you sell, what licences do you hold, how does your age verification work, who are your suppliers. A factual reply with documents attached works. An emotional complaint about the unfairness of the decision does not, because it is usually read by someone working through a checklist.

Pursue alternatives in parallel rather than waiting. Do not sit idle waiting for an appeal outcome. If one provider drops you, others can be enabled in Shopify — each with its own list and its own risk assessment. For permanently sensitive categories the road often leads to a high-risk merchant account. Those providers cost more, demand more documentation and frequently work with rolling reserves — but they will not drop you because your category came as a surprise.

Separate store and payments in your thinking. The most important strategic point in this section. A payment account closure is not a reason to change platforms — the next provider on the next platform holds the same lists, because the rules come from card network requirements and financial regulation, not from your store software. Migrating platforms does not solve a payments problem, but it does cost you months.

Reducing your risk before it becomes a problem

The cheapest moment to handle all of this is before you list your first product. This checklist costs half a day and saves a lot of unpleasant evenings.

• Decide your target markets before you decide your catalogue. The question is never whether a product is allowed, but where. A catalogue built for one country can become a problem the moment you add a single new destination.
• Find out who actually processes your payments. Open the processor list and note the companies for your country. Those are your real rule-makers.
• Read their lists, not just Shopify policy. All the way through, with particular attention to the restricted businesses section, because that is where you find out what is possible with preparation.
• Strip every health claim from your product copy. Cures, treats, prevents, relieves, fights. This is the most common avoidable trigger there is, and it affects cosmetics and supplements equally.
• Implement real age verification if your catalogue requires it. A pop-up asking whether the visitor is over eighteen is not an argument in front of a reviewer.
• Classify your products correctly. Inaccurate or euphemistic categories and tariff codes surface eventually, and the impression of concealment does more damage than the original classification would have.
• Keep your chargeback rate low. Clear product information, honest delivery times, reachable support, a recognisable name on the card statement. Chargebacks are among the most common triggers for review regardless of your category.
• Set up a second payment route before you need it. A second enabled provider is the difference between a bad day and a business at a standstill.
• Keep your compliance documentation in one place. Licences, registrations, safety data sheets, declarations of conformity, supplier records. When a reviewer asks, response time is part of the assessment.

Selling internationally makes every layer harder

One dimension that deserves its own section, because it catches out merchants who did everything right domestically. Every one of the three layers is jurisdiction-dependent, and adding a destination market means re-running all three.

Layer 1 explicitly references where you do business — and if you target customers in another country, that country law enters the picture. Layer 2 carries country clauses throughout: firearms are approvable only in selected markets, crowdfunding subcategories are supported in a handful of countries and prohibited everywhere else, and CBD limits vary by jurisdiction. Layer 3 is where cross-border reality bites hardest, because customs, dangerous goods rules and product certification requirements differ per destination.

The categories that most often catch international sellers off guard are the mundane ones: supplements that are freely sold at home but classed as medicine elsewhere, cosmetics requiring local notification and a responsible person in the destination region, herbal preparations subject to import controls, and anything containing alcohol or lithium batteries running into air freight restrictions. The practical rule is simple. Your catalogue is not compliant or non-compliant in the abstract. It is compliant per market, and each new market is a fresh check.

Frequently asked questions

Does Shopify have an official list of prohibited products?

No, not in the form most people are looking for. The Acceptable Use Policy works through principles rather than a product list — its central rule is that you cannot use Shopify for anything illegal where you do business. Specific item lists exist only at the individual sales channel level and with the payment processors. Anyone who reads only the Shopify policy has checked the smaller part of their risk.

Can Shopify close my store without warning?

Shopify describes its enforcement as graduated: notice and an opportunity to remediate first, then product-level action, with account closure as a last resort. Clear illegality or fraud can move faster. More importantly for practical purposes: most events merchants experience as a shutdown are not a Shopify action at all, they are a payment processor decision.

Can I sell vape products or nicotine pouches on Shopify?

The platform itself does not prohibit it, provided the sale is legal in your market and you meet age restriction and labelling requirements. The real hurdle is payment processing. On Stripe, tobacco products including e-cigarettes and e-liquid sold in accordance with applicable law fall under restricted businesses, meaning approval is required — possible, but reviewed and not guaranteed. Plan from day one with solid age verification, complete documentation and an alternative to Shopify Payments.

Why was my account shut down even though my product is legal?

Because legality and payment processor acceptance are two different things. Legislators determine what may be sold. The processor decides what risk it is prepared to carry, factoring in card network rules, chargeback exposure and its own compliance obligations. A perfectly legal product can be too risky for one provider and acceptable to the next.

What is the difference between prohibited and restricted?

Prohibited is final: no approval, no process, no exception. Restricted means the category is possible in principle but requires additional due diligence — usually licence evidence, business model details or proof of age verification. Approval is not guaranteed and can be revoked. This distinction decides whether a business model is impossible or merely demanding, and articles on this topic routinely blur it.

Do the same rules apply to merchants in Turkey?

No, and the difference is larger than most people expect. Shopify Payments is not available in Turkey — the country does not appear in the processor list at all. That means the Stripe and Adyen lists do not govern domestic Turkish sales. What governs instead are the rules of iyzico, PayTR, PayU or the bank behind the virtual POS, plus Turkish financial regulation. Turkish merchants selling into Europe additionally have to comply with destination country law.

Can I just switch platforms if my payment account is closed?

That usually does not solve the problem. The rules you fell foul of come from the payment processor, the card networks and financial regulation — not from your store software. On another platform you will generally meet the same providers with the same lists. Changing your payment provider makes sense. Changing your store platform does not.

How often do these policies change?

Often enough that you should not rely on a version you read once. Stripe flags changes to its list prominently at the top of the document; channel lists change faster still, because they depend on logistics and customs requirements. For merchants in sensitive categories, checking the primary documents once or twice a year is very cheap insurance.

Conclusion

The most useful conclusion here is also the least dramatic: most people are afraid of the wrong layer. They search Shopify policy for their product category, find nothing, feel safe — and in doing so skip the one document that actually governs their business. The list that matters does not belong to Shopify. It belongs to the company that moves your money.

If you close this article and do only two things, do these. First, look up which company actually processes payments in your country and read its list, paying particular attention to the restricted businesses section, because that is where you learn what is achievable with preparation. Second, go through your product copy and delete every statement promising a health outcome. Those two steps take an afternoon and remove a meaningful share of your avoidable risk.

One more thing worth saying. A sensitive category is not a disqualification. It is a planning requirement. Merchants who build in age verification, documentation, clean product copy and a second payment route from the start succeed in categories where others give up after three months. The difference is not the product. It is the preparation.

If you are unsure how your catalogue should be classified, or how to set your store up technically so that age verification, product data and payment routes actually fit together, take a look at how we work as a Shopify agency or contact us directly through our contact form. If you sell abroad, our guide to Shopify Markets is the right next step, since it covers exactly the channel and market questions that show up in Layer 3. You can run a free SEO and performance check on your store at any time, and if you are still assembling your setup, our guides to the Shopify apps you actually need and store speed optimisation will help. If you plan to advertise a sensitive category, read our e-commerce advertising guide first, because ad platforms maintain their own category rules on top of everything described here. We are 34Devs, based in Korschenbroich, about 20 minutes from Duesseldorf.