Shopify adds buyer consent to agent cart and checkout

Shopify’s Cart MCP and Checkout MCP now support the UCP buyer-consent extension. Announced on 16 October, the change applies to agents negotiating dev.ucp.shopping.buyer_consent with UCP version 2026-08-25. Earlier versions and integrations that do not declare the extension are unaffected.

For merchants, the useful question is whether a particular shopping integration presents and preserves the buyer’s choices. This announcement does not establish that every consumer AI service has adopted the extension.

What travels with the checkout

The buyer.consent response carries supported purposes, current states, descriptions and policy links. These cover analytics, preferences, sale or sharing, and marketing with email and SMS choices. Agents can return choices when creating, updating or completing carts and checkouts.

Without supplied consent, Shopify uses the shop’s defaults for the buyer’s country; an unknown country defaults to opt-out. Shopify instructs platforms to use source: "platform" only for choices the buyer actually made.

A channel choice is more specific than a general flag

The UCP specification models a purpose with optional segments, such as email and SMS. A segment overrides its parent purpose within that segment’s scope. It also distinguishes a business-provided default from a choice asserted by the platform.

The protocol communicates consent state; it does not set a merchant’s privacy policy or establish legal compliance. Keep those decisions with the people responsible for the store’s policies and customer communications.

Test the choice, the record and the handoff

Our suggested acceptance test starts with three scenarios: a buyer who declines marketing, a buyer who accepts email only, and a buyer who selects SMS without supplying a phone number. Write down the expected state before running each case.

Check the wording and policy links the buyer sees, the values returned to Shopify and the result visible to your operational team. For SMS, check that the interface explains the missing detail and allows the buyer to resolve the warning.

Then inspect any downstream email or SMS integration you use. Do not infer that its records are correct merely because checkout completed. Repeat the check after changing an agent profile or consent interface, keeping the version and test outcome with your integration notes.

This is a documented integration change and a proposed test plan, not a claim that we tested a live merchant account or that the feature automatically grows marketing lists.