Charging customers for shipping protection is legal in the US, the UK and the EU. What differs is who is liable for a lost parcel by default, whether your protection duplicates a right the customer already has, and whether the way you present the fee at checkout is lawful. Get the third one wrong and you can be sued.
That last point is not theoretical. In February 2025 a federal class action was filed against the swimwear brand TA3 and Route App over a shipping protection fee added to carts, and similar claims have since been brought against other retailers. The fee itself was never the problem. How it was presented was.
This guide sets out what the law actually says in each jurisdiction, where the real risk sits, and what a WooCommerce merchant should do about it.
This is not legal advice This article explains publicly available law and cites primary sources so you can check them. It is not legal advice, it is not a substitute for it, and shipping protection sits close to insurance regulation, which is jurisdiction-specific and contested. Speak to a qualified lawyer in your market before launching a paid protection programme.
Is it legal to charge customers for shipping protection?
Yes. No US, UK or EU law prohibits a merchant from charging an optional fee for shipping protection. The legal risk lies elsewhere: in how the fee is disclosed and consented to, in whether the product you are selling amounts to insurance, and in whether the customer already has the same right for free under consumer law.
Shipping protection is an optional charge a customer adds at checkout that entitles them to a refund or a replacement if their parcel is lost, damaged or stolen. It is offered by third-party platforms such as Route and Seel, and by self-hosted plugins that let the merchant run the programme themselves.
Selling it is lawful. Three things about it may not be:
- How you obtain consent to the charge. A pre-ticked box is the practice currently generating class actions in the United States.
- What you call it. Describing an insurance-like product as a “guarantee” or a “tech solution” is exactly the argument regulators and competitors are having right now.
- Whether the customer already has the right anyway. In the UK and the EU, they very often do.
Each of those is examined below.
Who is legally liable when a parcel goes missing?
| Liability for a lost parcel depends on jurisdiction. In the UK and the EU, the seller is liable until the goods are in the consumer’s physical possession, and cannot contract out of it. In the United States, the Uniform Commercial Code presumes the opposite: risk usually passes to the buyer when the goods reach the carrier. |
This is the single most misunderstood point in the whole category, and most articles about shipping protection state it incorrectly. The difference is not a detail. It determines whether your protection product is genuinely useful or is selling customers a right they already hold.
| Jurisdiction | Default rule | Can you contract out of it? |
| United States | Risk passes to the buyer when the goods are delivered to the carrier, under a shipment contract (UCC § 2-509(1)(a)). | Yes. UCC § 2-509(4) allows a contrary agreement, and many merchants voluntarily assume the risk anyway. |
| United Kingdom | Goods remain at the trader’s risk until they come into the physical possession of the consumer (Consumer Rights Act 2015, s.29(2)). | No. Section 31 bars a trader from excluding or restricting that liability in a consumer contract. |
| European Union | Risk passes when the consumer acquires physical possession of the goods (Consumer Rights Directive 2011/83/EU, Article 20). | No. The Directive is a mandatory consumer protection floor, implemented in each member state. |
United States: the seller usually is not liable, and that surprises people
Under UCC § 2-509(1)(a), where the contract authorises the seller to ship by carrier but does not require delivery to a particular destination, risk of loss passes to the buyer when the goods are duly delivered to the carrier. Where the contract does require delivery at a named destination, § 2-509(1)(b) keeps the risk with the seller until the goods are tendered there.
The important part is which of those the courts presume. In Windows, Inc. v. Jordan Panel Systems Corp., 177 F.3d 114 (2d Cir. 1999), the Second Circuit held that where terms are ambiguous there is a strong presumption under the UCC favouring shipment contracts. Absent an explicit written agreement to deliver to a particular destination, a contract is generally construed as a shipment contract.
So the widely repeated claim that “under the UCC the seller bears the risk of loss until the package is delivered to the buyer” is, as a default rule, wrong. It is true only where the parties made a destination contract, or where the seller agreed otherwise.
Three caveats matter, and a US merchant should not read the above as a licence to refuse refunds:
- UCC § 2-509(4) makes the default subject to contrary agreement, and most e-commerce terms of sale do in fact promise delivery.
- State consumer protection statutes and the FTC’s Mail, Internet, or Telephone Order Merchandise Rule impose their own obligations that sit on top of the UCC.
- Card networks do not apply the UCC. A customer who never received their goods will file a chargeback, and you will usually lose it whatever § 2-509 says.
This is precisely why shipping protection has a genuine market in the United States: there is a real gap, and someone has to fill it.
United Kingdom: the trader is liable, and cannot escape it
Section 29(2) of the Consumer Rights Act 2015 states that goods remain at the trader’s risk until they come into the physical possession of the consumer, or of a person the consumer identified to take possession of them. The Act’s own explanatory notes put it plainly: the risk lies with the trader until the consumer has physical possession.
There is one narrow exception. Under s.29(3) and s.29(4), if the consumer commissions a carrier of their own choosing, and that carrier was not one the trader offered as an option, risk passes to the consumer on delivery to that carrier. For an ordinary online store offering its own delivery options, this exception will almost never apply.
And under s.31, a trader cannot exclude or restrict that liability in a consumer contract. A terms page saying “we are not responsible once the parcel leaves us” is not merely unenforceable; it is the kind of term that attracts regulatory attention.
The uncomfortable question for UK and EU merchants If the parcel is legally at your risk until it reaches the customer, what exactly is the customer buying when they pay you for protection? A customer who later works this out, or reads a consumer rights article, may reasonably feel they were sold something they already had. That is a refund request at best, and a Trading Standards complaint at worst.
European Union: the same rule, from the same source
Article 20 of the Consumer Rights Directive (2011/83/EU) applies the same principle across the EU: the risk of loss or damage passes to the consumer when they, or a third party indicated by them, acquire physical possession of the goods. The UK provision above was itself an implementation of that Directive. The rule is a mandatory consumer protection floor, so member state implementations cannot dilute it.
For a WooCommerce store selling into the EU, the practical effect is the same as the UK: you are liable for the parcel until it arrives, and you cannot write that away in your terms.
Does selling shipping protection make you an unlicensed insurer?
It might. This is the most genuinely unsettled question in the category. Insurance is broadly defined as one party paying another a premium in exchange for the other assuming a risk of loss outside their control, and that description fits a merchant-run protection programme uncomfortably well. US state insurance regulation is the live battleground.
Route, the largest third-party provider, publishes a guide to merchants arguing that self-funded or “do it yourself” package protection offerings fail to comply with state insurance regulation, because coverage must be backed by a licensed provider. It names competing self-funded apps directly, and directs merchants to the National Association of Insurance Commissioners licence lookup to check whether a provider is authorised.
It is worth being clear-eyed about two things at once. First, Route is not a neutral party: it sells the licensed, insurer-backed alternative, and this argument is good for its business. Second, the argument is not therefore wrong. The definition of insurance really does capture a lot of what a self-funded protection programme does, and calling it a “guarantee”, a “protection plan” or a “tech solution” does not automatically change its legal character.
What can be said with confidence:
- Nobody has authoritatively settled this. There is no US Supreme Court ruling, and no state has issued definitive guidance covering every model.
- It is a US problem primarily. Insurance licensing is regulated state by state, and the argument has far less traction in the UK and EU, where the merchant is already liable by law and a protection programme looks more like a service promise than a risk transfer.
- The safest structure is one where you are not assuming a risk that was not already yours. If you already owe the customer a replacement, funding that obligation through a customer-paid programme is a different animal from insuring a risk you never carried.
- If you sell into the US at any scale, this is a question for a lawyer, not a blog post. Including this one.
Is a pre-checked shipping protection fee legal?
A pre-checked shipping protection fee is the practice currently generating class action lawsuits in the United States. The Federal Trade Commission has stated that a pre-checked box does not constitute affirmative consent, and Shopify banned merchants from auto-adding optional charges at checkout in February 2025. WooCommerce has no equivalent rule, which leaves Woo merchants exposed.
The FTC’s Rule on Unfair or Deceptive Fees, codified at 16 CFR Part 464, took effect on 12 May 2025. Be precise about its scope: as written, the rule covers live-event ticketing and short-term lodging only. It does not directly regulate e-commerce shipping fees.
That is not the reassurance it sounds like. Three things carry it well beyond ticketing:
- The rule states that a business cannot treat as optional an automatic fee that it removes only if a person notices and challenges it. That principle is being cited in litigation far outside its formal scope.
- The FTC has warned that it retains authority under Section 5 of the FTC Act to act against deceptive pricing in other industries, and expansion of the rule to e-commerce has been under consideration.
- Plaintiffs are using the rule as persuasive authority to support claims under state unfair and deceptive practices statutes, which do give consumers a private right of action. Junk fee class action filings more than doubled between 2023 and 2024.
For a WooCommerce merchant the conclusion is simple. An opt-out or default-on protection fee converts better. It is also the single practice that every current lawsuit in this space is about.
What happened in the shipping protection lawsuits?
In February 2025 a federal class action was filed in the Central District of California against TA3 Inc. and Route App over a shipping protection fee alleged to have been added to carts without consent. Similar claims have been brought against other retailers. The allegations centre on pre-checked fees, unclear disclosure, and free shipping promises contradicted at checkout.
The core allegations, which are consistent across the filings, are worth understanding because they map directly onto configuration choices you make in your own checkout:
- Dark patterns: the fee was added automatically, with only a small, low-contrast option to remove it.
- Lack of meaningful consent: the customer never affirmatively opted in, so under the FTC’s stated position there was no consent.
- Bait and switch: the store advertised free shipping over a threshold, then added a separate protection fee at checkout, which plaintiffs characterise as a disguised shipping charge.
- Little or no added value: the complaints argue that major carriers already include a baseline level of cover, and that the merchant’s own returns policy already covered damaged goods.
None of those allegations has been proven. What matters for a merchant is that every one of them describes a configuration choice, not a product defect. You can avoid all four by how you set your checkout up.
How do you run a shipping protection programme you can actually defend?
A defensible shipping protection programme uses affirmative opt-in, never a pre-ticked box; discloses the fee before the customer commits; describes honestly what it does and does not cover; and does not contradict rights the customer already has. In the UK and EU, it should be positioned as a faster service, not as cover you are legally obliged to provide anyway.
Six steps, in the order they matter:
- Make it opt-in. The customer must take a positive action to add the fee. Not a pre-ticked box, not a default-on toggle, not a fee they must notice and remove. This is the single highest-value change you can make.
- Disclose before commitment. The fee, its amount and its purpose should be visible before the customer reaches the payment step, not revealed at the last screen.
- Name it honestly. Do not call it “shipping” if it is not shipping. Do not call it “insurance” unless you are prepared to defend that characterisation to a regulator.
- Do not contradict your own free shipping promise. If your store advertises free delivery over a threshold, a protection fee added on top invites exactly the bait and switch argument being litigated.
- Write a terms page that says what is actually covered, what is excluded, how a claim is filed and how long it takes. Do not promise what you will not deliver.
- In the UK and EU, do not imply the customer has no rights without it. They do. Position protection as a faster, no-argument route to a resolution you would owe them anyway. That is a real benefit and it is honest.
CoverMyOrder is built around the first of these: the plugin cannot pre-check a protection fee. That is a deliberate constraint, not an oversight, and it is the reason the checkout it produces cannot generate the claim at the centre of the TA3 filing.
Common mistakes WooCommerce merchants make
| The most damaging mistakes are configuration mistakes, not legal ones: defaulting the fee to on, hiding it until the final checkout step, promising cover that the plugin does not actually deliver, and telling UK or EU customers they need protection to be entitled to a replacement when the law already entitles them to one. | |
| Mistake | Why it hurts |
| Default-on or pre-ticked fee | The exact practice alleged in the TA3 and Route class action. The FTC has said a pre-checked box is not consent. |
| Fee revealed only at the payment step | Supports a drip pricing allegation under state unfair and deceptive practices law. |
| “Free shipping” plus a protection fee | Plaintiffs characterise the fee as a disguised shipping charge that falsifies the free shipping promise. |
| Telling UK customers they are unprotected without it | Under CRA 2015 s.29 they are protected. Saying otherwise is a misleading statement about their statutory rights. |
| No terms page, or a vague one | It is the first document a regulator or a claimant’s solicitor will ask for. Not having one is not a neutral position. |
Frequently asked questions
Is shipping protection the same as shipping insurance?
No, although the line is genuinely blurred. Shipping insurance is a regulated product underwritten by a licensed insurer. Shipping protection is usually a contractual promise from the merchant to refund or replace. The distinction matters legally: if your protection product functions as insurance, calling it something else may not save you.
Can I offer shipping protection in the UK if the law already makes me liable?
Yes. Nothing prohibits it. But you must not suggest the customer lacks rights without it, because under the Consumer Rights Act 2015 they have them regardless. The defensible UK position is to sell speed and certainty of resolution, not the existence of cover.
Is a pre-checked shipping protection box illegal in the United States?
It is being litigated, not settled. The Federal Trade Commission has stated that a pre-checked box does not constitute affirmative consent, and multiple class actions rely on that position. Shopify banned auto-added optional charges from February 2025. Treat it as a practice to avoid, not a risk to manage.
Do carriers already cover lost packages?
Partially. UPS, FedEx and USPS Priority Mail typically include a baseline level of declared value cover at no extra cost, commonly around 100 US dollars. That cover applies to carrier fault, requires documentation, and is frequently denied. It is not equivalent to a protection programme, but plaintiffs cite its existence when arguing that a protection fee adds little value.
Does WooCommerce restrict how protection fees are presented at checkout?
No. Unlike Shopify, which banned merchants from auto-adding optional charges at checkout in February 2025, WooCommerce imposes no equivalent platform rule. The responsibility sits entirely with the merchant and the plugin they choose, which is why the plugin’s default behaviour matters.
Key takeaways
- Charging for shipping protection is legal in the US, the UK and the EU. The risk is in the execution, not the product.
- In the US, the UCC presumes a shipment contract and risk usually passes to the buyer at the carrier. In the UK and EU, the seller is liable until the customer physically has the goods, and cannot contract out of it.
- A pre-checked or default-on protection fee is the practice at the centre of the current class actions. Do not use one.
- Whether a self-funded protection programme is unlicensed insurance is genuinely unsettled in the US. Take advice before selling at scale there.
- In the UK and EU, sell protection as a faster resolution, never as cover the customer would otherwise lack.
Sources: UCC § 2-509 (Legal Information Institute); Windows, Inc. v. Jordan Panel Systems Corp., 177 F.3d 114 (2d Cir. 1999); Consumer Rights Act 2015, ss.29 and 31 (legislation.gov.uk); Consumer Rights Directive 2011/83/EU, Article 20; FTC Rule on Unfair or Deceptive Fees, 16 CFR Part 464, effective 12 May 2025; FTC Rule on Unfair or Deceptive Fees: Frequently Asked Questions; Wolf-Bond v. TA3 Inc. et al., No. 2:25-cv-02665 (C.D. Cal.); Route, Guide to Package Protection Offerings.
Last reviewed: [DATE]. Law changes. Verify before relying on anything here.