Shopify Agent Checkout Consent in 2026: UCP Opt-Ins Need an Explicit Buyer Choice

Quick answer

On October 16, 2026, Shopify added support for the UCP buyer consent extension to Cart MCP and Checkout MCP. An AI shopping agent can now show the same store-specific privacy and marketing choices a buyer would encounter at checkout and send those choices with the cart, checkout, and order. The capability is not automatic for every agent: the agent must negotiate dev.ucp.shopping.buyer_consent using UCP version 2026-08-25.

Do not treat purchase approval, account creation, or an email address as marketing consent. Render the choices supplied by the shop, record what the buyer actually selected, and pass the result through the checkout flow.

Why older agentic checkout instructions are incomplete

Early agentic-commerce examples focused on finding products, adding items, selecting shipping, and authorizing payment. They often skipped the moment when the merchant normally asks about marketing, analytics, or data-sharing preferences. A checkout completed in an assistant is still a real transaction, and a buyer’s permission to place an order does not imply permission to send promotional SMS messages.

Shopify now advertises the buyer-consent extension in storefront UCP discovery profiles at /.well-known/ucp. When an agent negotiates the capability, the cart or checkout response includes buyer.consent with the purposes the store supports, their current states, descriptions, and links to relevant policies.

What the agent needs to support

These are the minimum purposes Shopify says storefronts advertise. Render the actual purposes and descriptions from each merchant’s response rather than hard-coding a universal checkbox layout.

Implement the consent handoff

1. Discover the store’s UCP profile. Check the merchant’s /.well-known/ucp document rather than assuming a capability from the existence of an MCP endpoint.
2. Negotiate the extension. The agent’s UCP profile must declare dev.ucp.shopping.buyer_consent at version 2026-08-25.
3. Read buyer.consent. Use the purposes, current states, descriptions, and policy links returned by Cart MCP or Checkout MCP.
4. Ask for a real decision. A buyer can approve a purchase while declining marketing. Make those choices independent.
5. Send the choice back. Shopify accepts consent decisions when creating, updating, or completing a cart or checkout. Set source: "platform" only when the buyer actually made the decision in the agent’s flow.
6. Handle missing data. If a buyer selects SMS marketing without providing a phone number, Shopify can return missing_consent_data. Collect the required detail and retry rather than silently discarding the consent decision.

The exact request object depends on the negotiated tool schema. Query the live input schema from the merchant before constructing requests; do not paste a static JSON payload from an old tutorial and assume it matches the current contract.

# Shopify UCP CLI: inspect the merchant's live schema
ucp cart create --input-schema --business https://example-shop.com

# Inspect the checkout flow's available input fields as well.
# Replace the example domain with the merchant's actual domain.

Defaults are not the same as explicit consent

If an agent does not send consent choices, Shopify applies the store’s defaults for the buyer’s country. If the buyer’s country is unknown, consent defaults to opt-out. This is useful for compatibility, but it is not evidence that the buyer explicitly accepted or rejected every purpose.

Keep a clear distinction in your own integration between an explicit selection and a default state. Marketing workflows should not infer opt-in merely because an order exists. Review the merchant’s country-specific consent configuration and legal requirements separately; Shopify’s platform behavior is not legal advice.

Cart MCP and Checkout MCP are not interchangeable

Cart MCP is designed for building and revising a cart over a longer browsing session. Checkout MCP creates a short-lived purchase session when the buyer is ready to commit. Keep consent state synchronized as the buyer moves from cart to checkout, and re-render choices if the merchant’s response changes. Checkout completion requires an authorized payment and an idempotent request; a consent selection is not payment authorization.

Common misunderstanding

“Shopify added buyer consent, so every AI agent now collects it.” Only agents negotiating the extension on the supported UCP version receive the new capability. Older or non-participating integrations are unaffected.

“The buyer provided an email for the receipt, so marketing is allowed.” Transactional contact information and promotional consent are different decisions.

“A missing phone number means SMS consent should be ignored.” The documented response can include missing_consent_data and prevent checkout completion until the missing contact detail is provided.

How to test this

1. Confirm the merchant’s discovery profile advertises the consent extension and that the agent negotiates UCP 2026-08-25.
2. Render the returned purposes and policy links; verify labels and defaults match the merchant response.
3. Complete one test with explicit email opt-in and SMS opt-out, then one with both declined. Inspect the returned consent state and downstream order/customer records.
4. Try SMS opt-in without a phone number. Verify the missing_consent_data warning and recovery flow.
5. Test a buyer whose country is known and one whose country is unknown; confirm default behavior without claiming the buyer made a choice.
6. Convert a cart into checkout and confirm consent is not lost or accidentally overwritten.
7. Repeat with an agent that does not negotiate the extension to verify backward compatibility.

Sources and further reading

• Shopify changelog: buyer consent support, October 16, 2026
• Shopify Dev: Cart MCP and capability negotiation
• Shopify Dev: Checkout MCP, buyer consent and completion
• Shopify Help: checkout form and marketing opt-in settings

Documentation checked October 19, 2026.