Shopify banned an entire
category in a fortnight.
Yours could be next.

A fortnight between the
notice and the end of
the business.

In June 2026, following action by a coalition of 25 state attorneys general, Shopify banned vape and e-cigarette sales across the platform. Merchant notices went out around 23 to 24 June with a compliance deadline of 7 to 8 July. Several state attorneys general published confirmations, which is how most of the affected merchants learned the detail.

The scope was categorical. Hardware, e-liquids, pods, disposables, coils and accessories, regardless of whether a given product held FDA authorisation. A merchant selling only compliant, authorised products was in the same position as one who was not, because the ban was drawn at the category rather than at the regulatory status.

That last point is the one worth internalising, because it is the part merchants consistently expect to protect them and it does not. Being the compliant operator in a category under pressure is a good position with a regulator and an irrelevant one with a platform drawing a categorical line.

It is worth being fair to Shopify about the decision itself. A coalition of state attorneys general applying pressure is not a negotiation a platform wins, and the alternative to a categorical ban was probably a slower, messier version of the same outcome with legal exposure attached. Drawn narrowly, a ban invites argument at every edge about which specific products qualify, and that argument is expensive to run at platform scale across thousands of merchants. The categorical line is the defensible one from where Shopify sits.

That is exactly why the communication gap is the part worth criticising rather than the ban. The decision was constrained. Publishing a clear, dated, first-party policy page on the day the notices went out was not, and it would have cost the company nothing while saving the affected merchants a fortnight of reconstructing their own situation from news coverage.

They reconstructed the
policy from government
press releases.

The most instructive part of the episode is not the ban, which was a defensible commercial decision under real legal pressure. It is what the affected merchants were reduced to doing.

In the community thread that ran from 24 June, merchants pushed back on secondhand reporting because they could not find a first-party source. One wrote that the links being shared all said Shopify was set to, agreed to or was expected to act, with no published date and no article confirming it had happened. Weeks later, another noted they still could not find an official link on Shopify's own site.

So merchants running a business on the platform were assembling the scope and timing of a policy that ended that business from Reuters and from state attorney general announcements. Meanwhile a specific and commercially important question, whether the ban covered empty hardware and batteries sold wholesale, sat unanswered in the thread while the compliance clock ran.

That gap is the part you can do something about, because it generalises. Whatever category you sell in, the question is whether a ban is plausible and, separately, whether you could establish the scope quickly enough to act on it. For most merchants in most categories the honest answer is no, and the fix is knowing where first-party policy lives before you need it.

The category that goes
next is the one under
the same pressure.

Vape had a specific combination that made it a candidate: an active multi-state legal action, a well-organised public health lobby, a youth-access narrative, and a product whose regulatory status was contested rather than settled. That combination is not unique to it.

The last row points at the mechanism that arrives before a platform ban and is easier to miss. Payment networks and processors move first in several of these categories, and the symptom is not a policy email, it is reserves, holds and settlement delays appearing without explanation. The reserves breakdown covers how that mechanism works, and it is worth reading as an early warning rather than a billing topic.

None of this is a prediction about any specific category. It is a description of the shape, and the useful response to a shape is preparation rather than forecasting.

Ambiguous is the state
worth worrying about,
not prohibited.

If the lesson to act on is knowing where first-party policy lives, it is worth being specific about how to read one, because merchants tend to check for their category on a prohibited list, not find it, and stop.

There are three states a category can be in, and the middle one is where the risk concentrates. Explicitly permitted is safe and rare. A published prohibition is at least honest, and you knew before you built. Unaddressed is the dangerous state, because it means no commitment has been made and the position can be established at any time, in response to pressure, with whatever notice suits the platform.

1. Find the actual acceptable use and prohibited items pages, not a help article summarising them. Note the URL and check it quarterly.
2. Search for your category and its adjacent terms. Vape merchants who searched only for vape missed language covering accessories.
3. Check the payment terms separately. Processor restrictions are a different document and frequently narrower than platform policy.
4. Note what the policy says about notice. Most reserve the right to change terms with minimal notice, which is the clause that decides how bad a bad day gets.

None of this prevents anything. It converts an unknown into a known, which is the only move available to the merchant side of this relationship, and it takes about twenty minutes per platform.

Five things worth doing
while nothing is
currently on fire.

You cannot make a platform ban unlikely. You can make a fortnight's notice survivable, and the difference between those two outcomes is almost entirely work done in advance.

1. Keep a current export of customers, orders and product data. Monthly, automated, stored somewhere you control. This is the single highest-value item and almost nobody does it until they need it.
2. Know where first-party policy lives. Find your platform's acceptable use and prohibited items pages now, and check whether your category is named, ambiguous or absent. Ambiguous is the state worth worrying about.
3. Hold a second processor relationship. Not necessarily live, but established, with the account approved. Standing one up under pressure is materially harder than standing one up in advance.
4. Own the audience off-platform. Email and SMS lists survive a platform decision. Followers and store sessions do not. This is the difference between relaunching to a customer base and starting again.
5. Write the fortnight plan down. Who does what if notice arrives on a Monday. Two pages. It will be wrong in the details and it will save a week of arguing about sequence.

The fourth of those is the one with returns entirely independent of any ban, which is why it is the easiest to justify. An owned audience improves acquisition economics, retention and margin in normal conditions and is the only asset that reliably survives abnormal ones. The owned versus rented analysis makes the fuller commercial case.

A note on the export, since it is the item most often nodded at and least often done. It needs to be automated, because a manual monthly task survives about four months. It needs to include customers with contact details and consent status, orders with line items, and products with images and copy. And it needs to live somewhere that is not the platform being exported from, which sounds obvious and is the step people skip when the export is scheduled to cloud storage owned by the same account.

Test the restore once. An export nobody has ever imported anywhere is a file, not a backup, and the difference only becomes visible on the worst possible day.

The damage is set by
inventory position, not
by the ban itself.

It is worth being concrete about where the loss actually falls when a category ban lands, because it is not evenly distributed and the biggest number is usually not the one merchants expect.

Lost future revenue is the obvious line and the least urgent, because it is a going-concern problem you now have months to work on. The acute problem is working capital: inventory bought for a channel that closes in a fortnight, purchase orders already placed, and payment terms that do not care about your platform's policy decision. A physical-goods business with three months of stock on hand and two weeks of notice has a liquidity event, not a strategy problem.

That reframes the preparation list in a useful way. The exports and the second processor matter, and for a merchant in a genuinely contested category, inventory position matters more. Carrying less stock costs margin every month and buys optionality that is worthless until the day it is the only thing that matters. Whether that trade is worth making is a real question with no general answer, and it should be answered deliberately rather than by default.

The other route out is a channel that does not depend on the same decision. Wholesale, marketplace and retail relationships are slower and lower margin, and they are not subject to your ecommerce platform's acceptable use policy. For a merchant in a category with this shape, a small wholesale channel is insurance with a positive carry rather than a distraction.

This is the same shape
as most platform risk,
with the volume turned up.

A ban is the loud version. The quiet versions run continuously and have the same structure: a platform makes a decision that is reasonable from where it sits, the cost lands on merchants, and the merchants have limited visibility and no vote.

The same year produced several. Bot protection classifying real shoppers as automated traffic. App billing moving onto platform rails. Revenue share terms changing. A free inventory tool reaching end of life with data that did not export cleanly. None of those were bad-faith decisions and all of them transferred cost or control to merchants who found out afterwards.

The strategic response is not to leave the platform, which is usually a worse trade than the risk it avoids. It is to be clear-eyed in planning about which parts of the business sit on someone else's decision, and to make sure the parts that do not, the customer relationship above all, are genuinely yours. The platform dependency analysis covers how to hold that deliberately, and the Scripts sunset is the same structure in a purely technical register.

For merchants in genuinely contested categories there is one further step, which is to price the risk rather than carry it invisibly. If a categorical ban would end the business, that is not a tail risk to be noted and forgotten, it is a fact about the enterprise value of what you are building, and it belongs in the same conversation as growth. The read on channel dependency risk works through the same calculation for a different platform.

The affected vape merchants did most things right and lost the category anyway, which is the uncomfortable part and the reason this is worth writing about rather than moralising over. Compliance did not protect them, size did not protect them, and notice was a fortnight. The only things that transferred to whatever came next were the customer list and the speed of the response, which is the entire argument for building both before you need them.

Questions merchants ask
about platform category
risk.