Every store owner running SMS asks some version of this question eventually, usually right after a shopper replies "STOP" in all caps with three exclamation points. The honest answer involves three parties, not two, and most explanations skip one of them.
Marketing pages love to frame SMS compliance as a simple handoff: the platform handles the legal stuff, you just send texts. That's not quite true, and the gap between "not quite true" and "true" is where liability actually sits.
Shopify captures and stores the consent. When a shopper checks a box at checkout or opts in through a pop-up, that consent record lives in Shopify, not in your SMS vendor's system and not in some separate database CART or any other tool maintains. This is the same model every SMS app on Shopify uses, Postscript, Attentive, Klaviyo included. There's no workaround version where a vendor operates outside it.
You configure where and how that consent gets captured. Checkout box or earlier pop-up, the wording shoppers see, whether it's opt-in or pre-checked, that's your call and your responsibility. You're also on the hook for complying with state-specific communications laws that apply beyond the federal baseline.
Your SMS vendor handles the sending infrastructure. A2P 10DLC carrier registration, automatic STOP and HELP enforcement, message frequency limits, AI disclosure the moment a shopper asks. This is the part that runs the same regardless of how clean or messy your consent setup is underneath it.
If a shopper files a TCPA complaint, the question that gets asked first is where consent broke down. Did the opt-in flow itself fail to capture it properly, or did the vendor message someone who never opted in at all?
Those are different problems with different owners. A vendor's infrastructure can be flawless, carrier-registered numbers, instant opt-out handling, and still send a message to someone whose consent was never actually captured because the checkout flow had a bug. That failure sits with the store's configuration, not the vendor's sending infrastructure. The reverse is true too: a store can have a spotless opt-in flow and still get flagged if the vendor's carrier registration lapsed or STOP handling was slow.
Knowing which bucket a problem falls into before it happens saves a lot of finger-pointing after.
Consent answers who can be messaged. Content policy answers what can be sent to them. Every message that goes out gets checked against categories carriers enforce across the entire A2P network: regulated products, hate and harassment, sensitive data like SSNs or financial account numbers, high-risk financial offers, fraud and impersonation.
This isn't a CART-specific list. It's the same content policy every carrier applies to every A2P sender, and it exists because carriers throttle or block entire number ranges when they see enough violations coming through, regardless of which store or vendor sent them. A clean content policy protects deliverability for everyone sending through that infrastructure, not just the one message that got flagged.
None of this is legal advice, and no vendor is in a position to review your specific opt-in flow and tell you it's compliant. What a good vendor can tell you is what the infrastructure guarantees regardless of your consent setup: carrier registration is current, opt-out handling is instant, frequency limits hold. What they can't tell you is whether your checkout pop-up wording satisfies your state's specific disclosure requirements. That question goes to your own counsel, ideally before you turn SMS on, not after a complaint shows up.
Three things worth confirming, whether you're on CART or any other SMS tool:
The full terms, MSA, and content policy behind CART are public, worth a read before you sign anything, not just after a question comes up.
Run your next 250 abandoned carts through CART, $0 charged, and see what it recovers before you commit to anything.
Book a Revenue Proof Call →