Abandoned cart, email and SMS rules in Singapore

Information checked as of 14 October 2026

Many shoppers who start checking out on a Shopify store never finish, and a reminder can bring some of them back. Email and SMS campaigns do the same for past customers. In Singapore, three sets of rules shape how you do this: consent under the PDPA, the Do Not Call (DNC) rules for messages to Singapore phone numbers, and the Spam Control Act for bulk unsolicited messages. This guide covers Shopify's tools and how to use them within those rules.

This is general information, not legal advice. It summarises Shopify, Singapore Statutes Online and PDPC pages as of the date above. Check PDPC's guidelines or a lawyer for your own campaigns.

Shopify's abandoned checkout and marketing automations

Shopify runs marketing emails and automations through the Shopify Messaging app. Shopify's automations page lists three recovery templates, each available by email and SMS:

• Recover abandoned checkout: customers who start checkout but don't order. Shopify says these emails don't count towards your Shopify Messaging email allowance.
• Recover abandoned cart: customers who add to cart but don't start checkout.
• Convert abandoned product browse: customers who view a product but don't add it to their cart.

Shopify's abandoned checkout page adds some details:

• By default the automation sends only to customers subscribed to email marketing. You can switch it to all customers.
• Each email links to the customer's checkout. Anyone with the link can continue it, and you can't expire a link once sent, so only send it to the right person.
• You can also send a reminder manually from the abandoned checkout.

Shopify's contact information page says to send promotional content only to customers who agreed to receive marketing. For Singapore, the cautious choice is to keep the default audience. If you do send to everyone, keep the message to a plain reminder about the unfinished checkout rather than a fresh promotion, and take advice first.

Collecting consent at checkout

In Settings > Checkout > Marketing opt-in, Shopify's checkout settings page lets you show email, SMS and WhatsApp opt-in boxes:

• Email: you choose whether the box appears at checkout, sign-in or both, and which regions see it pre-ticked. You can choose no regions, so everyone must tick it themselves.
• SMS: the box can't be pre-ticked, so customers give clear consent.
• WhatsApp: a separate opt-in for WhatsApp marketing.

Shopify records consent when the customer ticks the box and continues. It also says that if you send abandoned cart reminders, you should change the default "news and offers" text next to the checkbox so it covers them. Leaving the email box unticked for Singapore gives you better evidence of consent, which matters for both the PDPA and the DNC rules. Stripe's guidance on compliant promotional emails makes similar points: disclose recovery emails in your privacy policy and honour unsubscribes promptly.

PDPA consent for marketing

Under the PDPA you need consent to use personal data for marketing, separate from what you need to fulfil an order. In practice: say what you'll send, record when and how each person opted in, make unsubscribing easy, and act on withdrawals. Our PDPA guide covers the Shopify privacy settings.

The Do Not Call rules for SMS, calls and WhatsApp

The DNC provisions in the PDPA apply to marketing messages ("specified messages") sent to Singapore phone numbers. PDPC's DNC advisory guidelines and key concepts guidelines set out the main duties:

• Check the register first: before sending, check the relevant DNC register, unless the person has given clear and unambiguous consent in written or other accessible form.
• Identify yourself: include information about who sent or authorised the message.
• Don't hide your number on marketing calls.

The DNC Registry's business rules say there are three registers: voice calls, text messages and faxes. Check results are valid for 30 days, after which you must check again. PDPC's guide for individuals says the No Text Message Register covers promotional SMS and MMS and app messages that use your number, such as WhatsApp.

The ongoing relationship exemption

The exemption order lets you send text or fax messages, but not voice calls, without checking the register if you have an ongoing relationship with the person and the message relates to it. Each message must include a clear opt-out notice in English, and you must stop once someone opts out or withdraws consent. Whether a one-off past purchase counts as an "ongoing relationship" depends on the facts, so collecting clear SMS consent at checkout is the simpler route.

The Spam Control Act for bulk messages

The Spam Control Act targets unsolicited commercial electronic messages sent in bulk. Section 6 defines bulk as more than 100 messages with the same or similar content in 24 hours, 1,000 in 30 days, or 10,000 in a year (s6). Under section 11, senders of such messages must follow the Second Schedule:

• Unsubscribe facility: an email address (for emails) or mobile number (for SMS) for unsubscribing, plus a clear statement in English saying so. It must work for at least 30 days, cost no more than normal, and you must stop sending within 10 business days of a request.
• <ADV> label: the letters <ADV> with a space before the subject line, or at the start of the message if there's no subject.
• Honest details: a subject line and header information that aren't misleading, and a working email address or phone number to contact the sender.

The labelling rules don't apply to messages sent to instant messaging accounts, but the unsubscribe rules still do. Messages to people who opted in aren't "unsolicited", which is another reason to collect consent properly.

WhatsApp marketing

• Treat WhatsApp marketing to Singapore numbers like SMS: check the DNC register or have clear consent, identify yourself, and offer an opt-out.
• Use Shopify's WhatsApp opt-in at checkout, or an app that records consent.
• WhatsApp has its own business messaging policies, so check them before you send bulk messages.
• Replying to a customer who messaged you first, about their order, isn't marketing. Adding offers to that conversation can be.

Good practice

1. Leave the email opt-in unticked for Singapore, and edit the checkbox text to mention cart reminders.
2. Keep the abandoned checkout automation on subscribed customers.
3. Send one to three reminders over a day or two, not a stream of discounts.
4. Put a clear unsubscribe link and your business name and contact details in every message.
5. For SMS and WhatsApp to Singapore numbers, collect explicit consent or check the DNC register every 30 days.
6. Keep records of consent and unsubscribes.
7. Update your privacy policy to cover recovery messages.

For more ways to bring shoppers back, see our local SEO guide, our Singapore merchant FAQ, and selling on Instagram and Facebook.

Frequently asked questions

Can I send abandoned checkout emails to customers who didn't opt in to marketing?

Shopify's abandoned checkout automation sends only to subscribed customers by default, though you can change it to all customers. Shopify itself advises sending promotional content only to customers who agreed to receive marketing. For Singapore, the safer approach is to keep the default, or keep reminders purely about the unfinished checkout with no extra offers, and get advice if unsure.

Do my marketing emails need ADV in the subject line?

Only if they are unsolicited and sent in bulk. The Spam Control Act's Second Schedule requires unsolicited commercial electronic messages sent in bulk to carry an <ADV> label, an unsubscribe facility and accurate sender details. Bulk means more than 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year. Emails to customers who opted in aren't unsolicited.

Do I need to check the Do Not Call Registry before sending marketing SMS?

Yes, before sending marketing messages to Singapore numbers, unless you have the person's clear and unambiguous consent in written or other accessible form. A limited exemption covers text messages related to an ongoing relationship, if they include an English opt-out notice. DNC check results are valid for 30 days.

Does the Do Not Call Registry cover WhatsApp?

Yes. PDPC's guide says the No Text Message Register covers promotional SMS and MMS and app messages that use your number, such as WhatsApp. Check the register or get clear consent before sending marketing on WhatsApp to Singapore numbers.

Should the marketing checkbox at checkout be pre-ticked?

Shopify won't let you pre-tick the SMS checkbox, and lets you choose regions where the email box is pre-ticked. For Singapore, leaving it unticked gives you clearer evidence of consent, which the PDPA and the DNC rules reward.

Want to try abandoned checkout recovery? A Shopify trial lets you set up your consent checkboxes and a recovery automation, then test them before real customers see them.

Start a Shopify trial →

References

Rules, features and fees change, so check the live page before you act on anything here.

1. Opt in to the new abandoned checkout automation, Shopify Help Center. Accessed 14 October 2026.
2. Creating and managing marketing automations in Shopify Messaging, Shopify Help Center. Accessed 14 October 2026.
3. Collecting customer contact information, Shopify Help Center. Accessed 14 October 2026.
4. Editing the checkout form options, Shopify Help Center. Accessed 14 October 2026.
5. Compliant promotional emails, Stripe Documentation. Accessed 14 October 2026.
6. Spam Control Act 2007, Second Schedule, Singapore Statutes Online. Accessed 14 October 2026.
7. Spam Control Act 2007, section 6 (sending in bulk), Singapore Statutes Online. Accessed 14 October 2026.
8. Spam Control Act 2007, section 11, laws.sg. Accessed 14 October 2026.
9. Advisory guidelines on the Do Not Call provisions, Personal Data Protection Commission. Accessed 14 October 2026.
10. Advisory guidelines on key concepts in the PDPA, Personal Data Protection Commission. Accessed 14 October 2026.
11. Personal Data Protection (Exemption from section 43) Order 2013, Singapore Statutes Online. Accessed 14 October 2026.
12. Do Not Call Registry business rules, PDPC Do Not Call Registry. Accessed 14 October 2026.
13. Individual's guide to the Do Not Call Registry, Personal Data Protection Commission (updated 1 Sep 2026). Accessed 14 October 2026.
14. Personal Data Protection Act overview, Personal Data Protection Commission. Accessed 14 October 2026.