You cannot send spam, spread malware, or run phishing scams through Shopify's platform.
This provision protects end consumers — shoppers — from being targeted by spam, phishing, and malware distributed through Shopify-hosted stores, giving Shopify contractual authority to remove bad actors quickly.
Cross-platform context
See how other platforms handle Prohibition on Spam, Unsolicited Messages, and Malicious Code and similar clauses.
Compare across platforms →This provision protects Shopify's infrastructure and end consumers from fraud and malicious activity, and violations can result in immediate account termination.
REGULATORY FRAMEWORK: This provision engages the CAN-SPAM Act (15 U.S.C. § 7701) for unsolicited commercial email, the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030) for malware and unauthorized computer access, the EU's ePrivacy Directive (2002/58/EC) and GDPR Article 6 for unsolicited electronic marketing in Europe, and Canada's Anti-Spam Legislation (CASL) for Canadian merchants. The FTC enforces CAN-SPAM; the DOJ enforces CFAA; EU data protection authorities enforce ePrivacy and GDPR.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.