The pattern shows up across regulated and gray-area categories. A retailer sells a hemp product that federal law permits, or a knife that is legal in their state, or a supplement with compliant labeling. The store runs for months, sometimes years. Then an email arrives: the store violates policy, and the merchant has a fixed window to act before checkout closes.

Merchants in this position often type “why was my shopify store suspended” into a search bar and find forum threads full of people asking the same thing. The confusion is genuine, because the merchant usually did check the law. What they did not check, or did not know to check, was the platform’s own list of what it will and will not host, a list that operates independently of any statute.

The point here is not that hosted platforms behave badly. A platform enforcing its own terms is acting within the agreement both sides signed. The point is that “can I legally sell this?” is a question for a lawyer, while “will my platform let me sell this?” is a question for the platform’s documents, and answering the first tells you nothing reliable about the second.

A Shopify merchant selling anything near a regulated category is subject to at least four separate policy documents, each maintained separately and each carrying its own consequences.

The first is the Shopify Acceptable Use Policy, the platform-wide list of what may not be sold on Shopify at all. This is the document people usually mean when they talk about Shopify prohibited items. Violating it risks the store itself.

The second is the Shopify Payments Terms of Service. Shopify’s built-in payment processing carries its own restricted business categories, and this list is longer than the platform-wide one. A product category can be permitted on the platform while being ineligible for Shopify Payments, which forces the merchant onto a third-party gateway and into additional transaction fees, at a rate that varies by plan.

The third is eligibility for the Shop app and Shop Pay. Shopify’s consumer-facing channels apply their own merchandising standards, so a store can operate normally while its products are excluded from those surfaces. The merchant loses distribution rather than the store.

The fourth is Managed Markets, Shopify’s cross-border selling program, which layers on import and export restrictions by destination country. A product with no issues domestically can be barred from international checkout entirely.

Four documents, four different owners inside one company, four different penalties: the store, the processing, the distribution, the borders.

These lists differ because they exist for different reasons. The acceptable use policy protects the platform’s legal position and brand. The payments terms reflect what card networks and banking partners will underwrite, which is typically the strictest standard in the stack. The Shop app standards reflect what a consumer marketplace wants next to its own brand. The Managed Markets rules reflect customs law in dozens of countries.

Because the reasons differ, the boundaries differ. Hemp-derived products are a common example: a category can be lawful federally, permitted on the platform under specific conditions, and still restricted by the payments terms, all at once. Certain knives, firearm accessories, and supplements sit in similar positions, allowed by one document and excluded by another.

The practical consequence is that checking “shopify restricted products” against a single list produces false confidence. A merchant who reads only the acceptable use policy can conclude they are fine, build the store, and discover the payments restriction at their first payout review. Each of the four rulebooks has to be checked against the specific product, and the strictest one governs the merchant’s real position.

Everything above describes the rules as they stand on a given day. The harder problem is that hosted platform rules are amendable. The Shopify acceptable use policy is not a statute; it is a term of a service agreement, and service agreements typically reserve the right to change terms with notice defined by the contract, not by the merchant’s inventory cycle.

This is standard practice across hosted software, not a Shopify quirk. But the implication for a regulated-category merchant is specific: the list you checked at signup is not guaranteed to be the list you are judged by at renewal. A category that is permitted today can be restricted later, and when that happens the merchant’s remaining decisions, how long to keep selling, where to move, how to migrate data, all run on the platform’s timeline.

For a business whose whole catalog sits in an unrestricted category, this risk is mostly theoretical. For a business whose margin depends on one regulated product line, it is a structural exposure that deserves a line in the risk register next to supplier concentration and key-person dependency.

WooCommerce is open-source software that runs on hosting the merchant chooses. That difference restructures the question. On a hosted platform, three layers of permission stand between a product and a sale: the law, the payment processor, and the platform. On WooCommerce, the platform layer drops out. There is no WooCommerce acceptable use policy deciding what the software will sell, because nobody’s servers but yours are hosting the store.

Two layers remain, and they are not small. The law still applies in full: licensing, age gates, labeling, shipping restrictions, state-by-state variation. And payment processing still carries terms, because every processor, from Stripe to a specialist high-risk gateway, maintains its own restricted business list. A merchant who moves a prohibited category to WooCommerce and then connects a mainstream processor has moved the problem, not solved it.

What the merchant gains is narrower and more valuable than “no rules.” They gain a fixed set of counterparties. The hosting provider’s terms and the processor’s terms are the whole permission surface, both are chosen by the merchant, and both can be selected specifically for tolerance of the category in question. When a processor’s policy changes, the merchant can replace the processor without rebuilding the store. The rules still exist; they are just attached to replaceable parts.

A merchant weighing this decision can answer most of it with an afternoon of document reading, in a specific order.

First, the law, with a professional if the category warrants it: federal status, state restrictions where customers live, shipping carrier policies for the product type. Nothing downstream matters if this layer fails.

Second, if a hosted platform is under consideration, all four rulebooks against the specific product, not the general category: the acceptable use policy, the payments terms, the sales channel standards, and any cross-border program rules. The strictest answer is the real answer.

Third, the processor question independently of the platform question: which gateways accept the category in writing, what they charge, and what their approval process requires. If the honest answer is that only specialist processors will underwrite the product, that answer usually decides the architecture, because it points away from bundled platform payments regardless of which storefront wins.

Fourth, the change scenario: if the platform restricted this category next year, what would the business lose and how fast could it move? A merchant who cannot tolerate that scenario has learned something important about where the store should live.

Boston Web Group builds and supports stores on both sides of this decision, and the pattern we see is consistent: the merchants who get burned are almost never the ones who broke rules, they are the ones who checked one rulebook out of four. Ask us to review where your product category stands across all four before you build. It is a short exercise, and it is far cheaper than reading a suspension notice with inventory on the shelves.