Shopify Checkout MCP Adds UCP Buyer Consent for AI Agents

When an AI agent buys from your Shopify store, who ticked the marketing box? Until now, nobody. Shopify's Checkout MCP and Cart MCP now support the UCP buyer consent extension, so an agent can show the buyer the same privacy and marketing opt-ins your own checkout shows, and send the answers back with the order. The detail that matters for your list: if the agent sends nothing and the buyer's country is unknown, Shopify records an opt-out.

What actually happened

Per the Shopify developer changelog posted October 16:

• The extension: dev.ucp.shopping.buyer_consent, on UCP version 2026-08-25, for both cart and checkout.
• What agents see: agents that negotiate the extension get a buyer.consent object. It lists each purpose, its current state, a description and links to your store policies.
• Purposes: at least analytics, preferences, sale or sharing, and marketing. Marketing splits into email and sms.
• Writing choices back: agents send consent on cart or checkout create, update or complete calls. Shopify says to mark source: "platform" only for choices the buyer actually made.
• Defaults: no consent sent means your store's default for the buyer's country. Unknown country means opt-out.
• Blocking warning: an SMS opt-in with no phone number returns missing_consent_data, and checkout will not complete until the agent supplies it.
• Scope: agents that do not declare the extension, or that run an older UCP version, see no change.

The UCP buyer consent spec holds the full field list.

Why buyer consent matters for your business

Agent orders can be invisible to your list. An order that arrives through an agent with no consent data falls back to country defaults, or to opt-out. If agent traffic grows and your email signups do not, this is a likely reason. Tag agent-sourced orders and watch the opt-in rate on that segment against your normal checkout.

Your defaults just became policy. Open Customer Privacy settings and check what each region defaults to. That setting now decides consent for every agent that skips the question.

A pre-ticked box from a bot is not consent. The source: "platform" rule exists so a buyer's real choice can be told apart from an agent guess. If you build or buy an agent integration, make sure it asks. Under GDPR and TCPA, "the agent said yes" is not a defense you want to test.

SMS is now a checkout blocker. If you push SMS opt-in hard, agent checkouts without a phone number will stall. Decide whether that trade is worth it.

Sources: Shopify developer changelog, UCP buyer consent specification.