Your Shopify Store Didn't Break a Law.

On June 24, Shopify began sending notices to merchants selling vape products. The instruction: remove every electronic nicotine delivery system from your store by July 8. E-cigarettes, e-liquids, vaporizers, parts, refills. Merchants who didn’t comply faced account suspension or termination. Reuters confirmed the notices on July 10, and trade coverage filled in the details.

The ban covered FDA-authorized products too. Not just the illegal gray-market vapes that triggered the crackdown. Products the federal government has explicitly authorized for sale in the United States had to come down with everything else, because separating compliant inventory from non-compliant inventory at scale created too much legal exposure for Shopify.

Those merchants weren’t breaking the law. They were selling federally authorized products, and they lost their storefronts anyway, on two weeks’ notice, because sorting the legal from the illegal was too expensive for the platform.

To be fair to Shopify

They were under real pressure. A coalition of US state and city law enforcement authorities had been pushing hard on the volume of illegal vape sales running through Shopify-hosted stores, and that’s a genuine problem that deserved a response. I don’t fault them for acting. If I ran a platform with millions of merchants, I might have made the same call.

That’s actually the point. The decision was reasonable from where Shopify sits. It was catastrophic from where a compliant vape merchant sits. Both of those things are true at once.

Read the sentence twice

Shopify’s position, in its own words, is that it has always prohibited “illegal activity” and takes action when merchants are “violating our policies.”

“Illegal activity” is defined by legislatures and courts. It changes slowly, in public, with notice, and you get to participate in the process, or at least watch it happen.

“Violating our policies” is defined by the platform. It can change on any Tuesday, for reasons you’ll never see, with whatever notice the platform decides to give. In this case the notice was two weeks, and it arrived after the decision was already made. No law changed in June.

When you rent your storefront, you run your business inside someone else’s risk calculation. The day the calculation changes, it’s the only thing that matters.

This isn’t really about vapes

The mechanism is category-neutral. Any product that creates legal or reputational exposure for the platform, or that becomes expensive to police, can land inside the same calculation. Vape merchants found out in June. Merchants in other regulated or contested categories, CBD, supplements, anything age-gated, are running the same structural risk whether they think about it or not.

Owning your platform doesn’t make that risk disappear, and I want to be honest about the limits here. The law still applies to you. Your payment processor has policies of its own. Your hosting provider has an acceptable use policy. Ownership doesn’t shrink your obligations.

What it shrinks is the list of parties who can shut off your storefront without a law changing. On a platform you own, the software cannot be repriced, repoliced, or revoked from above. The parts of your stack that answer to someone else’s risk tolerance get smaller and more replaceable: a processor can be swapped, a host can be changed over a weekend. The storefront itself, the catalog, the customer relationships, the code, stays yours.

Rented platforms concentrate the revocation risk in one party with absolute discretion. Owned platforms distribute it across parties you can replace.

The question worth asking

Earlier this summer we let our Adobe partner badge lapse on purpose, and the question that drove the decision was one we’d started asking on behalf of our clients: if we stopped paying, what would we keep? I keep coming back to that question because it works on every platform decision, including this one.

If your store runs on a rented platform, here’s the version worth asking this week: what happens to my business if my category gets reclassified in someone else’s risk model? Not “is my product legal.” The vape merchants had that one answered. The question is who besides a court gets to decide you’re done, and how much notice they owe you.

If the answer makes you comfortable, you’re in the right place. If it doesn’t, the alternative isn’t exotic. It’s the same open-source commerce stack that has been running serious stores for nearly twenty years, and it’s never been cheaper to own.

Your store should outlive anyone’s policy but your own.