Open an online store selling CBD tinctures, disposable vapes, a crypto payments plugin, or credit repair templates on Shopify and you hit two walls fast. The first is Shopify Payments, which will not process the charge. The second, less advertised, shows up when you try to turn on order confirmation texts or an SMS marketing campaign: Shopify wants you to register a toll-free sending number, and that registration can sit in review or come back rejected with no clear next step.
This is not a Shopify quirk. It is the same carrier-side gatekeeping that blocks these industries from Twilio, Bandwidth, and every other aggregator, just wearing a different acronym. Here is what Shopify actually requires to text a customer, why certain stores get stuck at that step, and how to get order and restock notifications out anyway.
What Shopify's Built-In SMS Actually Requires
Shopify's native SMS marketing lives under Apps, Messaging, then SMS in the admin. Turn it on and, for merchants sending to US or Canadian numbers, Shopify requires toll-free registration before a single message goes out. Verification takes two to five business days. If it is rejected, a banner appears in the admin along with an emailed reason, and you resubmit.
Two details matter more than the wait time. First, the number you get assigned is for delivery only. Customers cannot reply to it. Second, you can only message customers who opted in to SMS marketing specifically, tracked separately from email opt-in.
So even a fully approved store ends up with a one-way broadcast number that cannot hold a conversation, layered behind a verification queue that can reject the application before any of that matters.
Why Toll-Free Verification Rejects These Stores
Shopify's own eligibility rules explain part of the problem before you ever reach the SMS settings. Shopify Payments eligibility lists prohibited categories including cannabis and related products, tobacco and related products, products or services related to virtual currencies and cryptocurrencies, credit repair services, and gambling products such as sports forecasting or sweepstakes. A store selling any of these already needs a payment processor other than Shopify Payments to take money at all.
Toll-free verification is a separate check, run against the sender and the use case rather than the payment method, but it draws from the same pool of red flags. Age-restricted and regulated products trigger closer review during verification, and Shopify is not the one writing that rule. Toll-free numbers are governed by an industry-wide framework that carriers enforce the same way regardless of which platform provisions the number. Twilio, which documents the process in detail, is explicit that some categories are not eligible for resubmission at all once flagged, and that unverified toll-free numbers have been blocked from sending in the US and Canada outright since January 2024.
The practical result: a store can be fully legal, fully licensed where licensing applies, and still find its toll-free SMS application denied on the same basis its payment processor was denied, because both checks are built to screen out the same list of industries.
The Same Gate, Wearing a Different Number Format
If you have run into A2P 10DLC rejection on a standard 10-digit business number, this will look familiar. Both toll-free verification and A2P 10DLC exist to vet business SMS senders before carriers deliver their traffic, and both apply their own industry restrictions on top of whatever the law actually says about the product. Neither is a TCPA rule. Both are carrier and platform policy, enforced at the point a business tries to register as a business.
That distinction matters because it points to the way around it. Person-to-person SMS, sent from a real handset on a real consumer line, is not routed through either gate. It is not a business sender applying for a campaign or a toll-free number at all. Android Texter routes messages this way, through a phone you own, the same channel you would use to text a friend. There is no brand registration and no toll-free application to reject.
Getting Order and Restock Texts Out of Shopify Anyway
Shopify still generates the events you want to text about. The platform fires webhooks on real order activity, including orders/create, orders/paid, and orders/fulfilled, whether or not its own SMS tool will touch your account.
The bridge is a middleware step: catch the Shopify webhook in Zapier or Make, format the order detail into a message, and send it through Android Texter's REST API with a POST to /api/v1/messages/send, authenticated with a per-account atx_ key in the X-API-Key header. An order-fulfilled webhook becomes a text that says the package shipped. A low-stock trigger from your inventory app becomes a restock alert to whoever asked for one.
Because the message actually originates from a phone, customers can reply to it, unlike Shopify's toll-free sender. A question about an order lands back in the same Android Texter inbox as a normal reply, not a dead end.
Scheduled sends work the same way for anything time-based, like a pickup-ready reminder queued for a specific hour rather than fired the instant a webhook lands. The API accepts a scheduled timestamp on the send call, so the middleware step can queue a message for later instead of sending immediately.
What This Does Not Solve
None of this changes what the law requires. The TCPA governs consent for marketing texts to a wireless number regardless of which channel carries them, and that has nothing to do with A2P 10DLC or toll-free verification. Collect opt-in at checkout the same way Shopify's own SMS marketing requires it, keep a record of it, and honor STOP the same way you would on any line. Routing around a carrier gate is not routing around the TCPA, and nothing here should be read as legal advice about your specific consent posture.
It also does not solve payment processing. If Shopify Payments will not take your business, you still need a separate gateway for that. The SMS gate and the payment gate are enforced by different teams inside Shopify for different reasons, and clearing one does not clear the other.
Frequently Asked Questions
Does Shopify ban CBD and vape products outright?
Not always, but restrictions are heavy. CBD is restricted and may require an attestation depending on region and THC content. Tobacco and vape products are listed as prohibited or restricted under Shopify's policies in most markets. Even where the product listing is allowed, Shopify Payments will not process the transaction, so a separate payment gateway is required regardless.
If I am approved to sell CBD on Shopify, will my SMS registration also be approved?
Not automatically. Product listing approval and toll-free number verification are separate reviews run for different reasons. A store can be cleared to sell a product and still have its toll-free SMS application rejected, because the verification looks at the sender and use case, not just whether the product is allowed on the storefront.
Is sending SMS from my own Android phone through Android Texter legal?
Yes. Person-to-person SMS from a phone you own is not subject to A2P 10DLC or toll-free verification, which are carrier and platform policies, not law. The TCPA still applies to what you send and to whom, exactly as it would through any other channel, and consent remains the operator's responsibility.
Can customers reply to texts sent this way?
Yes. Because the message routes through a real handset number, replies land in the same conversation thread in the Android Texter inbox. That is different from Shopify's toll-free sender, which is delivery-only and cannot receive customer replies at all.
Do I still need to collect opt-in if I am not using Shopify's SMS tool?
Yes. Opt-in and consent requirements come from the TCPA, not from Shopify's SMS feature. Bypassing Shopify's toll-free registration does not change what you owe the recipient under federal law. Collect and keep a record of consent the same way you would for any SMS program.
Send the Text Anyway
Shopify's toll-free gate and its payment eligibility list are both built around the same short list of industries, which means the store that gets rejected for one is usually the one restricted by the other. If your order and restock texts are stuck behind a verification queue that was never going to approve you, Android Texter routes those messages through a phone you own instead of a business sender ID, so the webhook from Shopify still reaches the customer even when Shopify's own tool will not send it.