---
title: "Selling Regulated Products on Shopify: How to Enforce Legal Purchase Limits at Checkout"
description: "Regulated products come with legal purchase limits: how much one person may buy in a period. Shopify can't cap purchases per customer on its own. Here's how to enforce quantity, volume and frequency limits at checkout — and the compliance line an order-limits app can't cross."
contentType: "blog"
locale: "en"
localized: true
source: "https://orderrules.com/blog/shopify-regulated-product-purchase-limits"
slug: "shopify-regulated-product-purchase-limits"
date: "2026-08-12"
tags:
  - "shopify"
  - "regulated products"
  - "purchase limits"
  - "per customer limit"
  - "compliance"
  - "age-restricted"
  - "shopify functions"
---
Selling a regulated product on Shopify means enforcing its legal purchase limit — the maximum quantity, volume, or frequency one person may buy in a set period — at the checkout, not just printing it on the page. Shopify has no native way to cap purchases per customer, so you enforce the limit with a Shopify Functions app like OrderRules that tracks each customer across orders and blocks checkout when they exceed the cap.

> **This is the enforcement layer, not the whole compliance stack.** OrderRules controls *how much* a customer can buy. It does **not** verify age or ID, check licenses, or file shipping and tax reports. For age-restricted goods, pair it with a dedicated age-verification app. And read the conceptual explainer on [per-checkout vs per-customer limits](/blog/per-checkout-vs-per-customer-limits-shopify) first — legal caps are almost always *per person per period*, which is exactly the rule type Shopify can't enforce on its own.

## What counts as a regulated purchase limit?

A regulated purchase limit is a legal cap on how much of a controlled product a single buyer may purchase in a defined window — expressed as a quantity, a volume, or a frequency, and tied to the person rather than the transaction. Here are real, statutory examples of the shape these limits take:

| Product (example) | Legal purchase limit | Limit shape | Source |
|---|---|---|---|
| OTC pseudoephedrine (US) | 3.6 g/day and 9 g per 30 days per purchaser (7.5 g/30 days for mail order) | Quantity per customer per period | [DEA — CMEA 2005](https://www.deadiversion.usdoj.gov/meth/cma2005.html) |
| Wine, direct-to-consumer (US) | Varies by state — e.g. 2 cases/month (Missouri), 6–12 nine-litre cases/year in many states | Volume per customer per period | [Wine Institute](https://wineinstitute.org/our-work/compliance/direct-shipping-table/) |
| Paracetamol / acetaminophen (UK) | 16 tablets general sale, 32 at a pharmacy; retailers cap two packs per sale | Quantity per transaction / customer | [Human Medicines Regulations 2012](https://www.legislation.gov.uk/uksi/2012/1916/contents/made) |
| Nicotine & vaping products (US) | Minimum age 21, adult (21+) signature on delivery, USPS won't mail them | Age + shipping controls | [PACT Act](https://www.atf.gov/alcohol-tobacco/prevent-all-cigarette-trafficking-pact-act) |

Two things stand out. First, every one of these caps is **per person over a period** — 9 grams per 30 days, two cases per month, 21-and-over per delivery — not per shopping cart. Second, most were written to save lives: the UK's 1998 paracetamol pack-size law was followed by roughly a **43% drop in paracetamol-overdose deaths** over the next 11 years, according to research summarised by the [NIHR](https://www.ncbi.nlm.nih.gov/books/NBK374099/). The limit is the point of the product, which is why "we'll just ask people to be reasonable" is never enough.

Whether you can sell a given item on Shopify at all is a separate question — Shopify prohibits some categories outright (tobacco, e-cigarettes and vaping products among them) and restricts alcohol and tobacco from Shopify Payments — so confirm the product against [Shopify's Acceptable Use Policy](https://www.shopify.com/legal/aup) before you build anything.

## Can Shopify limit purchases per customer natively?

No. Shopify's only built-in quantity control is the **per-item add-to-cart limit** under Settings → Checkout, and it's per-item and per-checkout only. It can't track a customer across separate orders, can't set a per-month or per-year allowance, and resets completely the moment a shopper starts a new cart. Native B2B quantity rules are Plus-only and still operate per order.

That gap is the whole problem for regulated goods. A "limit 2 per order" rule does nothing to stop the same buyer placing five back-to-back orders — the exact behaviour a legal per-person cap exists to prevent. Closing it requires enforcement that counts a customer's history and runs inside checkout, which is what [per-customer order limits](/blog/per-customer-order-limits-shopify-guide) do through Shopify Functions. (If your only concern is a floor rather than a ceiling — a case minimum, say — that's the sibling problem covered in the [minimum order quantity guide](/blog/shopify-minimum-order-quantity-guide).)

## How do you enforce a legal purchase limit on Shopify?

To enforce a legal purchase limit, restate the law as a per-customer rule, scope it to your regulated products, and let a checkout Function block orders that exceed it. The setup takes a few minutes:

### Step 1 — Confirm the product is sellable and payable

Before anything else, check the item against Shopify's prohibited-products policy and your local licensing rules, and confirm your payment gateway allows the category — alcohol and tobacco are typically blocked from Shopify Payments, so you may need a compliant third-party processor.

### Step 2 — Translate the legal cap into units

Rewrite the statute as a number OrderRules can enforce: a **count** (orders per customer), a **quantity** (units per customer), or a **spend** ceiling, over a **daily, weekly, monthly, yearly, or lifetime** period. Most legal caps are per person per month or per year.

### Step 3 — Create the per-customer rule

In the OrderRules dashboard, create a per-customer limit, choose the limit type and value, and set the reset period to match the law. See the docs on [per-customer quantity limits](/docs/customer-rules/per-customer-quantity-limits) and [limit periods](/docs/customer-rules/limit-periods) for the exact fields.

### Step 4 — Scope it to the regulated collection

Apply the rule to the collection or tag that holds your controlled items using [collection and tag limits](/docs/product-limits/collection-tag-limits), so the cap covers exactly the regulated products and nothing else.

### Step 5 — Require login

Enable strict login enforcement ([guest-checkout blocking](/docs/guides/guest-checkout-blocking)) so the limit attaches to a real customer identity. Without it, a determined buyer can reset the counter with a new email on every guest checkout — the single biggest hole in any "per-customer" rule.

### Step 6 — Write the message and test

Explain the cap and its legal reason in the checkout block message, then place test orders that exceed it — including a *second, separate* order — and confirm each is blocked at checkout, not merely flagged.

## How do you turn a gram or volume limit into a Shopify rule?

Convert the legal ceiling into whole units and **round down** so you always stay under it. Take the US pseudoephedrine cap of 9 grams per 30 days: if a package you sell contains about 2.4 grams of the active ingredient, 9 ÷ 2.4 = 3.75, so you round down to a **per-customer monthly limit of 3 packages**. A wine state that allows two nine-litre cases per month becomes a limit of 2 case-products — or 24 bottles — per customer per month.

The arithmetic matters because OrderRules enforces **unit counts, not grams or litres**. It doesn't read the milligrams on a label or the ABV in a bottle; it counts the items and orders a customer accumulates. So the compliance work is yours: compute the allowed number of units from your specific product's labelled content, round down for a safety margin, and set the per-customer quantity cap to that number. For spend-based rules — an employee store with a monthly allowance, for instance — the same logic applies with a dollar ceiling, as covered in [customer spending caps](/blog/shopify-customer-spending-caps-employee-b2b).

## What OrderRules does not do

Being honest about the boundary is what keeps a compliance setup safe. OrderRules is the purchase-limit enforcement layer — it is **not** a complete compliance solution, and it deliberately does not:

- **Verify age or identity.** It caps quantity and frequency, not the buyer's age. Pair it with a dedicated age-verification / ID app, and use an adult-signature delivery service where the law requires one (all US nicotine shipments require 21+ signature confirmation under the [PACT Act](https://www.atf.gov/alcohol-tobacco/prevent-all-cigarette-trafficking-pact-act)).
- **Enforce grams, volume, or ABV directly.** You translate those into unit counts (see above).
- **Keep a regulatory logbook or file reports.** The electronic logbook behind pharmacy pseudoephedrine sales, PACT Act monthly state reports, and direct-to-consumer alcohol tax filings are handled by point-of-sale, ID, and tax-compliance systems — not by an order-limits app.
- **Handle shipping restrictions or destination rules.** Which states you may ship to, and by which carrier, is a shipping-compliance problem (specialist tools like ShipCompliant exist for exactly this).

Position OrderRules as one control in a stack: an age-gate app for *who*, a compliant payment gateway and shipping-compliance tooling for *where and how*, and OrderRules for *how much*. That division of labour is also better for your buyers, because the quantity rule is enforced server-side and can't be quietly bypassed.

## Which regulated categories does this cover?

The per-customer mechanism is the same across categories; only the number and period change.

- **OTC and pharmacy-adjacent products.** Where you're permitted to sell them, methamphetamine-precursor decongestants and analgesics carry hard per-person caps — the clearest example of a quantity-per-period limit.
- **Alcohol.** Direct-to-consumer wine and spirits face per-customer volume caps that vary widely by state (from a couple of cases a month to a dozen or more a year). Pair the volume cap with [store hours enforcement](/blog/restrict-shopify-checkout-physical-store-business-hours) where local law restricts the hours alcohol may be sold or delivered.
- **Nicotine and tobacco.** Age-21 and adult-signature delivery dominate here; the quantity cap is a secondary control layered on top of age verification.
- **Supplements, collectibles, and other rationed goods.** Retailer- or label-imposed "N per customer" caps — common on high-demand supplements and limited collectibles — map directly onto a per-customer lifetime or monthly limit, the same pattern used to [beat scalpers on limited drops](/blog/anti-scalping-shopify-per-customer-purchase-limits).

For the full menu of rule types and how they combine, see the [complete guide to Shopify order rules](/blog/complete-guide-shopify-order-rules) and the [features page](/features).

## Enforce the limit, not just the label

For a regulated product, the purchase limit isn't a suggestion — it's the reason the rule exists. Shopify can display a limit, but it can't enforce one per customer, and a displayed limit that a determined buyer can click straight past is a compliance gap waiting to be found. Enforce the quantity, frequency, and spend side of the rule at checkout with OrderRules, pair it with age verification and a compliant payment and shipping setup, and you have a store that actually holds the line the law draws.

**[Start your free plan](https://apps.shopify.com/orderrules-limit-sales?utm_source=blog&utm_medium=inline_cta&utm_campaign=shopify-regulated-product-purchase-limits)** — install in one click, scope a per-customer limit to your regulated collection, and enforce it at checkout in under five minutes.