On October 16, 2026, Shopify’s Checkout MCP and Cart MCP started supporting the UCP buyer consent extension. An AI agent buying from a Shopify store can now show the buyer the store’s own email, SMS and data-sharing choices, and send the answers back with the cart, checkout and order. If you run Shopify, nothing is required of you. If you build or audit agent flows, this is a new field to expect.

What Shopify changed

Per Shopify’s developer changelog, the extension is dev.ucp.shopping.buyer_consent, available from UCP version 2026-08-25. Storefronts list it in their discovery profile at /.well-known/ucp. It applies to both cart and checkout.

When an agent negotiates the extension, Checkout MCP and Cart MCP responses include a buyer.consent object. It lists each consent purpose the shop supports, the current state, a description and links to the shop’s policies.

Shopify says its storefronts advertise at least these purposes:

  • dev.ucp.consent.analytics
  • dev.ucp.consent.preferences
  • dev.ucp.consent.sale_or_sharing
  • dev.ucp.consent.marketing, with email and sms segments

How the data is shaped

The UCP buyer consent specification models consent in two levels. A purpose says what the consent is for. An optional segment narrows a purpose to a channel, vendor or program, and a more specific segment value wins over its parent.

Each entry carries a granted state and a source:

  • source: "business" means the value is the store’s default and no buyer preference applies.
  • source: "platform" means the value is the buyer’s stated preference, captured by the agent’s platform.

The business’s description and links come back in responses only. The agent sends back granted and source (plus segments when present).

Defaults and the checkout blocker

Shopify’s changelog is specific on three points:

  • If the agent sends no consent, Shopify applies the shop’s default settings for the buyer’s country.
  • If the buyer’s country is unknown, consent defaults to opt-out.
  • Some choices need a contact detail, such as an SMS opt-in without a phone number. The response then carries a missing_consent_data warning, and the checkout cannot complete until the agent supplies the detail.

Agents should set source: "platform" only for choices the buyer actually made during the agent’s flow. Integrations that do not declare the extension, or that negotiate an earlier UCP version, are not affected.

What this means for a merchant

  • You do not configure anything new. The changelog describes what Shopify and the agent exchange; it lists no merchant setting.
  • Your existing consent defaults now travel to agents. The shop’s per-country defaults are what an agent receives and what applies when it sends nothing.
  • Your /.well-known/ucp profile is where this is announced. The same profile carries every other capability an agent negotiates. Our earlier note on the UCP policy snapshot covers the 2026-08-25 consent change from boolean fields to a keyed map.

Neither source says how many agents negotiate this extension today, and the spec leaves how a store acts on consent to its own policy and applicable regulation. Treat legal questions about marketing consent as yours to settle with counsel, not with the protocol.

FAQ

Do I need to enable UCP buyer consent on my Shopify store?

No action is listed in Shopify’s changelog. Storefronts list dev.ucp.shopping.buyer_consent in their discovery profile at /.well-known/ucp, and the extension applies to cart and checkout.

What happens if an AI agent sends no consent choices?

Shopify applies the shop’s default settings for the buyer’s country. If the buyer’s country is unknown, consent defaults to opt-out.

Why would an agent checkout fail on consent?

Some choices need a contact detail, such as an SMS opt-in without a phone number. Shopify then returns a missing_consent_data warning, and the checkout cannot complete until the agent collects the missing detail and retries.

Sources

A checkout that stops on a missing phone number is a failure no storefront page will show you, which is why AgentReady scores whether an agent can complete the purchase, not just find the product.