TCPA Compliance for Shopify Stores: A Practical Guide to Calling Abandoned Cart Customers

Why abandoned-checkout calls scare Shopify stores

A customer who typed in their phone number and shipping address, then stopped one step short of paying, is about as warm a lead as ecommerce gets. A short, human phone call — “Hi, I noticed you didn’t finish checking out, is there anything I can help with?” — can recover orders that email reminders never touch.

So why do so few stores do it? One acronym: TCPA. The Telephone Consumer Protection Act of 1991 is the U.S. federal law that restricts telemarketing calls and texts, and its penalties — up to $1,500 per violation — have fueled a steady stream of class-action lawsuits. For a small team, that number alone is enough to kill the idea.

But the TCPA is narrower than its reputation suggests. Much of what it restricts involves autodialers and prerecorded voices — not a real person manually dialing a phone. If your team calls customers one by one, with live humans, the compliance picture is far more manageable than most store owners assume. This guide walks through exactly where the lines are.

What the TCPA actually requires

The TCPA’s core restriction (47 U.S.C. § 227) prohibits making calls to cell phones using an automatic telephone dialing system (ATDS) — an “autodialer” — or an artificial or prerecorded voice, without the recipient’s prior express consent. Three distinctions matter most for a Shopify store:

1. Autodialer vs. manual dialing

After the Supreme Court’s 2021 decision in Facebook v. Duguid, an autodialer is equipment that can store or produce numbers using a random or sequential number generator and dial them. The FCC clarified in a 2020 declaratory ruling that a calling platform which cannot place a call unless a person actively and affirmatively manually dials each number is not an autodialer — and calls made with it are not subject to the TCPA’s restrictions on calls to wireless phones.

In plain terms: if your rep clicks or dials each customer’s number individually and speaks live, you are not in autodialer territory. If software blasts through a list automatically, you are. Note that some courts interpret the definition differently, so this is an area to confirm with counsel — but the direction of the law favors genuine manual dialing.

2. Prerecorded and AI voices always need consent

Using a prerecorded message — or, under a 2024 FCC ruling, an AI-generated voice — to call a cell phone requires the recipient’s prior express consent, no matter how you dialed. If your “call program” is actually robocalls or AI voice agents, the manual-dialing discussion above doesn’t help you.

3. Marketing calls and texts need prior express written consent

For telemarketing calls or texts to wireless numbers made with an autodialer or prerecorded voice, the FCC requires prior express written consent — a clear, conspicuous agreement that identifies your business, describes what the customer agrees to receive, and states that consent is not a condition of purchase. A pre-checked box doesn’t count.

Why abandoned checkout calls are a gray area

Here’s where it gets interesting for Shopify stores. The FCC has long held that people who knowingly give you their phone number have, in effect, invited you to call that number for that purpose — unless they tell you otherwise. A customer who typed their number into your checkout arguably consented to be contacted about that transaction.

That means a manual, live-voice call that is genuinely about completing their order — not a disguised sales pitch for something else — sits in a relatively defensible zone. But three things push you toward risk:

• Scope creep: “Your cart is waiting” is transactional. “While I have you, let me tell you about our new line” is marketing — and marketing raises the consent bar.
• Automation: the moment you switch from human dialing to an autodialer, texts, or prerecorded messages, you need written consent.
• Time passing: a call two days after abandonment reads as order follow-up. A call six months later reads as cold telemarketing.

The safest posture: treat every abandoned-checkout number as permission for a prompt, human, order-related call — and collect explicit written consent at checkout if you want to do anything broader.

Practical compliance checklist

Seven things to put in place before your team starts dialing:

1. Get clear consent at checkout

   Add an unchecked opt-in checkbox near the phone field with plain language naming your store and what the customer agrees to. Store the exact wording, timestamp, and phone number for every opt-in.

2. Know which kind of dialing you’re doing

   Human reps dialing numbers one at a time is the lowest-risk setup under the TCPA. Autodialers, click-to-call systems that dial automatically, prerecorded messages, and AI voices each trigger stricter consent requirements. Document how your calls are placed.

3. Respect calling hours: 8 a.m. to 9 p.m.

   FCC rules prohibit telephone solicitations to a residential subscriber before 8 a.m. or after 9 p.m. local time at the called party’s location (47 C.F.R. § 64.1200). Area codes lie — customers keep numbers when they move — so many teams use a narrower 9 a.m.–8 p.m. window in the customer’s likely time zone.

4. Scrub against do-not-call lists

   Check numbers against the National Do Not Call Registry before telemarketing calls, and maintain your own company-specific do-not-call list. An existing customer relationship is an exemption for voice calls in many cases — but it is not a free pass, and it doesn’t cover marketing texts.

5. Honor opt-outs fast — within 10 business days at most

   Under the FCC’s 2024 revocation order, consumers can revoke consent through any reasonable means — a “STOP” reply, a voicemail, an email — and you must honor it as soon as practicable, no later than 10 business days after receiving it. One short confirmation message (no marketing content) is allowed.

6. Keep records of everything

   Consent is your defense. Log the consent text shown, when it was accepted, the phone number, every call attempt with timestamps, and every opt-out. If a dispute ever arises, these logs are what you’ll produce.

7. Identify yourself on every call

   Reps should state their name, your business name, and why they’re calling at the start of the conversation. It’s required in many contexts — and it’s just good manners that keeps calls from feeling like spam.

Texting vs. calling: different rules

This is the distinction that trips up most stores. The rules for text messages are stricter than for manual voice calls:

• Marketing texts to cell phones always need prior express written consent — even if the customer bought from you before. An existing business relationship does not substitute for consent when it comes to marketing texts.
• Every texting program needs a clear opt-out mechanism, typically “Reply STOP to unsubscribe,” and keywords like STOP, QUIT, END, CANCEL, and UNSUBSCRIBE are legally recognized as revoking consent.
• Informational texts (like “your order shipped”) sit under a lower bar — prior express consent rather than written consent — but the line between informational and marketing is thin. A shipping update with a 20%-off coupon inside is marketing.
• Calling-hour caution applies to texts too. Plaintiffs have argued that texts sent outside 8 a.m.–9 p.m. violate the rules; with valid consent you’re exempt, but late-night texts are asking for complaints either way.

Bottom line: if you want an abandoned-cart text program, get written consent at checkout. If you want an abandoned-cart call program with human reps, a checkout phone number plus prompt, order-related outreach is a far more comfortable starting point.

What happens if you violate the TCPA

The numbers are what make the TCPA famous in legal circles:

• $500 per violation in statutory damages — or the plaintiff’s actual damages, whichever is greater.
• Up to $1,500 per violation if the court finds the violation was willful or knowing.
• Each call or text counts as a separate violation. Ten calls to one person is ten violations.

Multiply that by a class action and the exposure gets enormous — one case against Dish Network produced a $61 million judgment, and nine-figure settlements are not unheard of. That’s why TCPA compliance is worth getting right before you scale a calling program, not after.

Also note: the TCPA is federal, but many states have their own telemarketing laws — Florida and Oklahoma are famously strict — that can add requirements on top. If your customers are nationwide, federal compliance is the floor, not the ceiling.

How a call-workflow tool helps

Most TCPA violations aren’t malicious — they’re operational. A rep calls outside the window because nobody checked the time zone. An opt-out lives in someone’s inbox instead of the dial list. Nobody can prove what consent language was shown at checkout.

A purpose-built call workflow helps with the unglamorous parts: consent flags on every customer record, calling windows enforced by the customer’s time zone, suppression lists that automatically exclude do-not-call and opted-out numbers, and per-rep call logs that double as your compliance paper trail. That’s the boring infrastructure that keeps a calling program defensible.

Dialo is built around exactly this workflow — human reps calling Shopify customers about real orders, with the consent tracking and call discipline baked in. If you’re thinking about adding phone outreach to your recovery strategy, it’s worth a look.

Frequently asked questions