Selling a regulated product on Shopify means enforcing its legal purchase limit — the maximum quantity, volume, or frequency one person may buy in a set period — at the checkout, not just printing it on the page. Shopify has no native way to cap purchases per customer, so you enforce the limit with a Shopify Functions app like OrderRules that tracks each customer across orders and blocks checkout when they exceed the cap.
This is the enforcement layer, not the whole compliance stack. OrderRules controls how much a customer can buy. It does not verify age or ID, check licenses, or file shipping and tax reports. For age-restricted goods, pair it with a dedicated age-verification app. And read the conceptual explainer on per-checkout vs per-customer limits first — legal caps are almost always per person per period, which is exactly the rule type Shopify can't enforce on its own.
What counts as a regulated purchase limit?
A regulated purchase limit is a legal cap on how much of a controlled product a single buyer may purchase in a defined window — expressed as a quantity, a volume, or a frequency, and tied to the person rather than the transaction. Here are real, statutory examples of the shape these limits take:
| Product (example) | Legal purchase limit | Limit shape | Source |
|---|---|---|---|
| OTC pseudoephedrine (US) | 3.6 g/day and 9 g per 30 days per purchaser (7.5 g/30 days for mail order) | Quantity per customer per period | DEA — CMEA 2005 |
| Wine, direct-to-consumer (US) | Varies by state — e.g. 2 cases/month (Missouri), 6–12 nine-litre cases/year in many states | Volume per customer per period | Wine Institute |
| Paracetamol / acetaminophen (UK) | 16 tablets general sale, 32 at a pharmacy; retailers cap two packs per sale | Quantity per transaction / customer | Human Medicines Regulations 2012 |
| Nicotine & vaping products (US) | Minimum age 21, adult (21+) signature on delivery, USPS won't mail them | Age + shipping controls | PACT Act |
Two things stand out. First, every one of these caps is per person over a period — 9 grams per 30 days, two cases per month, 21-and-over per delivery — not per shopping cart. Second, most were written to save lives: the UK's 1998 paracetamol pack-size law was followed by roughly a 43% drop in paracetamol-overdose deaths over the next 11 years, according to research summarised by the NIHR. The limit is the point of the product, which is why "we'll just ask people to be reasonable" is never enough.
Whether you can sell a given item on Shopify at all is a separate question — Shopify prohibits some categories outright (tobacco, e-cigarettes and vaping products among them) and restricts alcohol and tobacco from Shopify Payments — so confirm the product against Shopify's Acceptable Use Policy before you build anything.
Can Shopify limit purchases per customer natively?
No. Shopify's only built-in quantity control is the per-item add-to-cart limit under Settings → Checkout, and it's per-item and per-checkout only. It can't track a customer across separate orders, can't set a per-month or per-year allowance, and resets completely the moment a shopper starts a new cart. Native B2B quantity rules are Plus-only and still operate per order.
That gap is the whole problem for regulated goods. A "limit 2 per order" rule does nothing to stop the same buyer placing five back-to-back orders — the exact behaviour a legal per-person cap exists to prevent. Closing it requires enforcement that counts a customer's history and runs inside checkout, which is what per-customer order limits do through Shopify Functions. (If your only concern is a floor rather than a ceiling — a case minimum, say — that's the sibling problem covered in the minimum order quantity guide.)
How do you enforce a legal purchase limit on Shopify?
To enforce a legal purchase limit, restate the law as a per-customer rule, scope it to your regulated products, and let a checkout Function block orders that exceed it. The setup takes a few minutes:
Step 1 — Confirm the product is sellable and payable
Before anything else, check the item against Shopify's prohibited-products policy and your local licensing rules, and confirm your payment gateway allows the category — alcohol and tobacco are typically blocked from Shopify Payments, so you may need a compliant third-party processor.
Step 2 — Translate the legal cap into units
Rewrite the statute as a number OrderRules can enforce: a count (orders per customer), a quantity (units per customer), or a spend ceiling, over a daily, weekly, monthly, yearly, or lifetime period. Most legal caps are per person per month or per year.
Step 3 — Create the per-customer rule
In the OrderRules dashboard, create a per-customer limit, choose the limit type and value, and set the reset period to match the law. See the docs on per-customer quantity limits and limit periods for the exact fields.
Step 4 — Scope it to the regulated collection
Apply the rule to the collection or tag that holds your controlled items using collection and tag limits, so the cap covers exactly the regulated products and nothing else.
Step 5 — Require login
Enable strict login enforcement (guest-checkout blocking) so the limit attaches to a real customer identity. Without it, a determined buyer can reset the counter with a new email on every guest checkout — the single biggest hole in any "per-customer" rule.
Step 6 — Write the message and test
Explain the cap and its legal reason in the checkout block message, then place test orders that exceed it — including a second, separate order — and confirm each is blocked at checkout, not merely flagged.
How do you turn a gram or volume limit into a Shopify rule?
Convert the legal ceiling into whole units and round down so you always stay under it. Take the US pseudoephedrine cap of 9 grams per 30 days: if a package you sell contains about 2.4 grams of the active ingredient, 9 ÷ 2.4 = 3.75, so you round down to a per-customer monthly limit of 3 packages. A wine state that allows two nine-litre cases per month becomes a limit of 2 case-products — or 24 bottles — per customer per month.
The arithmetic matters because OrderRules enforces unit counts, not grams or litres. It doesn't read the milligrams on a label or the ABV in a bottle; it counts the items and orders a customer accumulates. So the compliance work is yours: compute the allowed number of units from your specific product's labelled content, round down for a safety margin, and set the per-customer quantity cap to that number. For spend-based rules — an employee store with a monthly allowance, for instance — the same logic applies with a dollar ceiling, as covered in customer spending caps.
What OrderRules does not do
Being honest about the boundary is what keeps a compliance setup safe. OrderRules is the purchase-limit enforcement layer — it is not a complete compliance solution, and it deliberately does not:
- Verify age or identity. It caps quantity and frequency, not the buyer's age. Pair it with a dedicated age-verification / ID app, and use an adult-signature delivery service where the law requires one (all US nicotine shipments require 21+ signature confirmation under the PACT Act).
- Enforce grams, volume, or ABV directly. You translate those into unit counts (see above).
- Keep a regulatory logbook or file reports. The electronic logbook behind pharmacy pseudoephedrine sales, PACT Act monthly state reports, and direct-to-consumer alcohol tax filings are handled by point-of-sale, ID, and tax-compliance systems — not by an order-limits app.
- Handle shipping restrictions or destination rules. Which states you may ship to, and by which carrier, is a shipping-compliance problem (specialist tools like ShipCompliant exist for exactly this).
Position OrderRules as one control in a stack: an age-gate app for who, a compliant payment gateway and shipping-compliance tooling for where and how, and OrderRules for how much. That division of labour is also better for your buyers, because the quantity rule is enforced server-side and can't be quietly bypassed.
Which regulated categories does this cover?
The per-customer mechanism is the same across categories; only the number and period change.
- OTC and pharmacy-adjacent products. Where you're permitted to sell them, methamphetamine-precursor decongestants and analgesics carry hard per-person caps — the clearest example of a quantity-per-period limit.
- Alcohol. Direct-to-consumer wine and spirits face per-customer volume caps that vary widely by state (from a couple of cases a month to a dozen or more a year). Pair the volume cap with store hours enforcement where local law restricts the hours alcohol may be sold or delivered.
- Nicotine and tobacco. Age-21 and adult-signature delivery dominate here; the quantity cap is a secondary control layered on top of age verification.
- Supplements, collectibles, and other rationed goods. Retailer- or label-imposed "N per customer" caps — common on high-demand supplements and limited collectibles — map directly onto a per-customer lifetime or monthly limit, the same pattern used to beat scalpers on limited drops.
For the full menu of rule types and how they combine, see the complete guide to Shopify order rules and the features page.
Enforce the limit, not just the label
For a regulated product, the purchase limit isn't a suggestion — it's the reason the rule exists. Shopify can display a limit, but it can't enforce one per customer, and a displayed limit that a determined buyer can click straight past is a compliance gap waiting to be found. Enforce the quantity, frequency, and spend side of the rule at checkout with OrderRules, pair it with age verification and a compliant payment and shipping setup, and you have a store that actually holds the line the law draws.
Start your free plan — install in one click, scope a per-customer limit to your regulated collection, and enforce it at checkout in under five minutes.