Selling care packages to the families of incarcerated people is a real, useful business — and it comes with one hard rule that ordinary stores never face: a person can only send so many packages, of so much weight and value, per period. Send a fourth package in a month where the limit is three and it doesn't just get returned — it's rejected at the facility, the customer is out their money, and your store wears the complaint. The whole product is the limit. So the store has to enforce it, not hope customers keep count.
This guide walks the setup on Shopify and, just as importantly, is honest about the parts a Shopify app can enforce (how many packages, and how much spend, per customer per month) and the parts it can't (combined parcel weight, and a true per-inmate cap across different buyers). Get the split right and you have a compliant, commission-free ordering channel; get it wrong and you're refunding rejected packages.
This is a setup guide, not legal advice. Package rules vary by state and facility and change often. Confirm the current rules directly with the relevant department of corrections and the specific facility before you rely on any limit.
Quick answer: how to enforce package limits on Shopify
Model each care package as a Shopify product, require customers to log in, then add a per-customer limit with a monthly reset that matches the facility's allowance — for example three packages per customer per month — enforced at checkout via Shopify Functions. Add a per-customer monthly spend cap if the facility also caps dollar value. What an app can't do is weigh parcels or track a single inmate across different buyers, so handle weight through fixed per-package weights and Shopify's shipping settings, and be explicit with customers about the per-recipient limit.
The rules you're enforcing (and why they're strict)
Corrections systems limit what an incarcerated person can receive. The specifics differ everywhere, but the shape is consistent — for example:
- New York (DOCCS): up to 3 packages per inmate per month, a combined weight cap around 40 lb, and packages must come from an approved vendor — personal packages from individuals aren't accepted.
- Washington State: no more than 2 packages per month, within an annual cap on total property/vendor packages.
Common across systems: a monthly package count, a combined weight ceiling, often a dollar-value ceiling, a banned-items list (tobacco, alcohol, glass, metal, electronics), and — in many states — a requirement to be an approved vendor shipping directly to the facility. Always check the live rules; the Washington DOC package page is an example of how a state publishes them, and every state's differ.
Two things make this different from a normal store. The caps are per person per period, not per cart — so a customer can slip past a cart-level rule by placing three orders in a row. And the penalty for going over isn't a bad review; it's a rejected shipment and a refund. That's exactly the gap a checkout-enforced per-customer limit closes.
Step 1 — Confirm the facility's rules first
Before building anything, gather, for every state and facility you'll serve: packages allowed per inmate per month, the weight ceiling, any dollar-value ceiling, the banned-items list, and whether you must be an approved vendor. Becoming an approved vendor is a separate application with the corrections department — start it early, because in states like New York it's a prerequisite to shipping at all.
Write these numbers down. They become the exact values you'll configure in Steps 3–5.
Step 2 — Build each package as a Shopify product
On Shopify, each care package is a product:
- Model each package or bundle as a product with a clear item list and a fixed, known weight (you'll lean on that weight in Step 6).
- Group all regulated packages in a collection (or tag), so your rules target just this catalog and the rest of your store — if you sell anything else — stays unrestricted.
- List only compliant items. The reliable way to keep banned goods out of orders is to never list them; no purchase-limit app inspects contents.
Step 3 — Require login so limits count across orders
A per-customer cap can only work if every order is tied to a customer account. Turn on strict login enforcement so shoppers can't check out as anonymous guests — otherwise someone can place order after order and each looks like a brand-new customer. This is the single setting that makes "three per customer per month" actually hold. (See strict login enforcement.)
Step 4 — Set the per-customer monthly package cap
This is the core rule. Add a per-customer limit — order count or total quantity — with a monthly reset, set to the facility's allowance (e.g. 3 per customer per month). OrderRules counts every order the customer places during the calendar month, across separate checkouts, and blocks the one that would exceed the cap. The counter resets on the 1st in your store's timezone. It's enforced at checkout by a Shopify Function, so it holds through Shop Pay and express wallets — not just on the cart page.
The mechanics are the same per-customer-per-period pattern covered in the per-customer order limits guide and, for regulated catalogs generally, in Selling Regulated Products on Shopify — this post is the prison-vertical application of it. For the reset behaviour, see limit periods.
Step 5 — Add a monthly spend cap if the facility caps dollar value
Where a facility limits the dollar value an inmate may receive per month, layer a per-customer monthly spend cap on top of the package count. OrderRules totals the customer's spend over the month and blocks the checkout that would push them past the ceiling, so you can enforce both "no more than 3 packages" and "no more than $X" at once. (Spend caps are covered in the spending-caps guide.)
Step 6 — Handle weight and banned items outside the app (the honest carve-out)
Here's where you have to be precise, because over-promising is a compliance risk.
OrderRules does not enforce weight. It counts orders, quantities, and spend — it does not weigh parcels or enforce a pound limit. Handle the weight ceiling by:
- Giving each package product a fixed, known weight, so "3 packages" maps to a predictable combined weight that stays under the cap by design.
- Using Shopify's own weight and shipping settings for parcel weight at fulfillment.
And note the honest ceiling: if a facility's 40-lb cap is the combined weight across everything an inmate receives that month — including packages other vendors sent — no Shopify store can see those other parcels. That total ultimately lives with the facility's intake screening, not your checkout.
Banned items are handled the same way: keep them out of your catalog entirely. The app doesn't inspect contents.
The per-inmate vs per-buyer gap (say it plainly)
The most important honest limitation: the legal cap is per inmate (the recipient), but a per-customer app cap is per buyer (the account). Those line up when one family member is the sole sender for one inmate. They don't when:
- Several relatives each send to the same inmate — three separate accounts, each under its own cap, can still add up to more than the inmate is allowed.
- One buyer sends to several inmates — a single per-buyer cap would wrongly block legitimate orders to different recipients.
There's no Shopify app that fully closes this, because it requires coordinating limits across different customer accounts by recipient. Practical mitigations:
- Require login (Step 3) so at least each buyer is tracked.
- Capture the recipient per order (inmate name/ID as a required field or a per-recipient product structure) so your team — and the facility — can reconcile.
- Treat the facility's per-inmate screening as the real backstop, and tell customers clearly that the store enforces a per-buyer cap, not a per-inmate one.
Being upfront about this is better for customers and for you than implying an app enforces something it can't.
What OrderRules does and doesn't do here
| The rule | Can the app enforce it at checkout? |
|---|---|
| Packages per customer per month (e.g. 3) | Yes — per-customer count/quantity limit, monthly reset |
| Dollar value per customer per month | Yes — per-customer monthly spend cap |
| Combined weight ceiling (e.g. 40 lb) | No — design with fixed per-package weight + Shopify shipping; facility screens the true total |
| True per-inmate cap across different buyers | No — cap is per buyer account; facility screening is the backstop |
| Banned items / approved-vendor status | No — keep the catalog compliant; approval is a separate DOC process |
The bottom line
A prison care-package store lives or dies on staying inside the facility's limits. Shopify gives you the storefront and the approved-vendor sales channel; OrderRules enforces the two caps an app genuinely can — packages per customer per month and dollar value per customer per month — at checkout, so a customer can't quietly place a fourth order that gets rejected on arrival. Weight, banned items, and the true per-inmate total sit with product design and the facility's own screening. Build it that way and you're honest with customers and compliant by design.
Start OrderRules free and add a per-customer monthly package cap to your Shopify care-package store — and confirm the current rules with the facility before you launch.