Developer / Checkout MCP & Cart MCP / UCP 2026-08-25

Even for purchases made through AI agents,
email and SMS consent can now reach the shop

Checkout MCP and Cart MCP now support the UCP buyer consent extension (dev.ucp.shopping.buyer_consent). Buyers can make the same privacy and marketing choices inside the agent as in the shop's own checkout, and those choices are passed to the shop along with the cart, checkout, and order.

On this page
  1. What's changing (30-second overview)
  2. How it works: from discovery to order
  3. Consent purposes offered by Shopify stores
  4. When consent isn't sent / when contact info is missing
  5. Scope: which integrations are affected and which aren't
  6. How to adopt it (4 steps)
  7. 5 key points for developers
  8. 3 business use cases
  9. One-line summary for proposals

1What's changing

Starting with UCP 2026-08-25, Checkout MCP and Cart MCP support the UCP buyer consent extension(dev.ucp.shopping.buyer_consent).
Inside the agent, buyers can makethe same privacy and marketing choices as in the shop's own checkout(such as email or SMS opt-in). Those choices reach the shop along with the cart, checkout, and order.
?

If the extension isn't declared

Responses won't include buyer.consent . Integrations that don't negotiate this extension, or that use an earlier UCP version, are unaffected.

If the extension is negotiated

Responses include buyer.consent , returning the current state, description, and policy link for each consent purpose the shop supports. The agent can send the buyer's choices back to the shop.

2How it works: from discovery to order

① Discovery In /.well-known/ucp, buyer_consent is published Storefront side ② Negotiate In the agent profile, declare the extension (version 2026-08-25) Agent side ③ Receive buyer.consent Purpose Current status Description Link to policy Checkout / Cart MCP response ④ Send the buyer's choices create / update / complete (cart & checkout) source: "platform" Only what the buyer actually chose The shop receives consent along with the cart, checkout, and order
This extension applies to both cart and checkout . In their discovery profile (/.well-known/ucp), storefronts now publish dev.ucp.shopping.buyer_consent .

3Consent purposes presented by Shopify stores

Shopify storefronts present at least the following purposes.

Analytics
dev.ucp.consent.analytics
Preferences
dev.ucp.consent.preferences
Sale & sharing
dev.ucp.consent.sale_or_sharing
Marketing
dev.ucp.consent.marketing
email / sms segments
The wording is "at least" these four. The purposes each shop supports are listed in buyer.consent , so the assumption is that yourender them from the response instead of hardcoding a fixed list. Possible status values and the detailed JSON schema are not covered in this article (see the UCP buyer consent spec).

4When consent isn't sent or contact info is missing

SituationShopify behavior
Buyer's choices sent Applied The choices reach the shop along with the cart, checkout, and order
No consent sent Default for the buyer's countrythe shop's default settingis applied
Buyer's country unknown Opt-out Consent defaults to opt-out
Required contact info missing
Example: SMS opt-in without a phone number		 Warning The response includes a missing_consent_data warning, and until the missing information is provided,checkout can't be completed
Opt in to SMS No phone number missing_consent_data Completion blocked Ask for phone number Collect from buyer Retry Can complete When you receive a warning, collect the missing contact info and retry

5Scope: which integrations are affected and which aren't

Affected

UCP 2026-08-25 + extension negotiated

Platforms and agents that use Checkout MCP or Cart MCP with UCP 2026-08-25dev.ucp.shopping.buyer_consent and negotiate the extension.

Not affected

Extension not declared / older version

Integrations that don't declare this extension, or that negotiate an earlier UCP version.

This is an opt-in change. Existing integrations won't break on their own; declare the extension whenever you're ready to support it.

6How to adopt (4 steps)

1

Declare the extension

In your agent profile, declare dev.ucp.shopping.buyer_consent at version 2026-08-25.

2

Show consent options

When rendering the cart or checkout, use thebuyer.consent shop descriptions and policy links to present each option.

3

Send the selection back

Sent on create / update / complete.source: "platform" should only be included for options the buyer actually selected within the flow.

4

Handle warnings

missing_consent_data , collect the required contact info from the buyer and retry.

75 key points for developers

08-25

1. Two conditions: version × extension

You must be on UCP 2026-08-25 and have negotiated the extension. With only one of the two, buyer.consent won't appear. You can also check whether it's listed via discovery (/.well-known/ucp).

2. Use the shop's own wording and links

Each purpose's description and policy link in buyer.consent are shop-specific. The intended usage is to render them as-is rather than writing your own consent copy on the agent side.

source

3. source: "platform" handling is key

Include only the options the buyeractually selectedwithin your own flow. There's an explicit instruction to avoid filling in defaults on the buyer's behalf.

4. Shopify owns regional defaults

If you don't send it, the shop's default for the buyer's country applies; if the country is unknown, it defaults to opt-out.No need to implement region-specific default logic on the agent side.

5. missing_consent_data is a completion blocker

If contact info required for consent is missing (e.g., SMS opt-in without a phone number), a warning is returned andthe checkout can't be completed. Check for warnings before complete, and build a UI branch that sends the buyer back to a contact info form. The detailed warning payload structure isn't covered in this post.

83 practical use cases for your business

USE CASE 1

Add agent-driven buyers to your email and SMS lists too

Problem
Orders sold through AI agents don't carry the email/SMS opt-ins captured in the shop's checkout, so your lists for repeat-purchase campaigns don't grow.
Approach
Declare the extension on the agent side, presentdev.ucp.consent.marketing 's email / sms options with the shop's descriptions, and send back the buyer's choices.
Impact
Buyers get the same consent choices as in the shop's checkout regardless of channel, and those choices reach the shop along with the cart, checkout, and order.
Tech note
If the buyer selects SMS without a phone number, missing_consent_data blocks completion. Placing the phone number input on the same screen as the SMS option reduces back-and-forth.
USE CASE 2

Drop per-country consent default logic from multi-country agents

Problem
For agents serving buyers in multiple countries, maintaining per-country consent defaults yourself is a heavy maintenance burden.
Approach
Don't send options the buyer didn't explicitly choose, and let Shopify apply the shop's per-country defaults. Design on the assumption that an unknown country means opt-out.
Impact
Reduces custom logic for region-specific defaults and makes it easier to meet merchants' consent and communication requirements (from the article's "Why this matters").
Technical notes
Defaults only apply properly if you pass information that identifies the buyer's country early. An unknown country means opt-out, so test for cases where marketing consent is dropped without anyone intending it.
USE CASE 3

Privacy audits and acceptance testing for agentic commerce

Challenge
For purchases made through agents, a merchant's privacy review won't pass unless you can explain which consent was recorded and through which path.
Approach
Turn three rules into test cases and use them as acceptance criteria: "Show the shop's descriptions and policy links as-is," "source: "platform" contains only the buyer's actual choices," and "Retry when a warning is returned."
Impact
You can confirm that consent reaches the shop with the buyer's explicit choices kept separate from the shop's applied defaults.
Technical notes
For each of the four purposes (analytics / preferences / sale_or_sharing / marketing), check every combination of "sent / not sent / country unknown." The article doesn't say how consent appears in the shop admin.

9One-line summary for proposals

"Even for purchases made through AI agents, you can collectthe same consent as the shop's checkout (email, SMS, analytics, sharing)and deliver it to the shop.
It's opt-in: you just declare the extension in UCP 2026-08-25, and Shopify handles the country-specific defaults.
You only need to get two things right: send only the buyer's actual choices, and handle warnings about missing contact information."