On October 16, Shopify’s developer changelog said that Checkout MCP and Cart MCP “now support the UCP buyer consent extension (dev.ucp.shopping.buyer_consent) starting with UCP 2026-08-25.” According to Shopify, “Buyers can now make the same privacy and marketing choices in your agent that they’d make in a shop’s own checkout, like opting in to email or SMS.” The same entry sets the rule for a silent agent: “If you don’t send consent, Shopify applies the shop’s default settings for the buyer’s country.” When the country is not known, “consent defaults to opt-out.”
What is the UCP buyer consent extension?
It is the part of the Universal Commerce Protocol that lets a business tell an agent which consent options it offers, and lets the agent send back the buyer’s decisions. In the spec’s words, it covers “purposes like marketing, analytics, preferences, and sale or sharing of data.” It defines the mechanism only: the 2026-08-25 spec says it “does not dictate either party’s behavior in response to that state.”
Four purposes, each with the spec’s own label
Shopify says storefronts advertise “at least” four consent purposes, with email and sms segments under marketing. The spec’s labels:
dev.ucp.consent.analytics: “Analytics and performance measurement”dev.ucp.consent.marketing: “Marketing communications”dev.ucp.consent.preferences: “Remembering buyer preferences”dev.ucp.consent.sale_or_sharing: “Sale or sharing of personal data with third parties”
The spec adds a caution about the names: “These identifiers are operational definitions, not legal taxonomies.” Shopify’s changelog does not call the result compliant. It says the change “helps merchants meet their consent and communication requirements.” Neither page says what analytics controls for an agent-placed order, and neither do the two Shopify docs pages the changelog links to.
The agent decides whether the buyer is asked
The spec puts the presentation choice with the platform: “Platforms decide which choices to present to the buyer and when.” A choice the buyer makes in the agent reaches the shop through this extension only if the agent negotiated it on 2026-08-25 and sent that choice back. Shopify says integrations that “don’t declare this extension, or that negotiate an earlier UCP version, aren’t affected.”
What the changelog tells agents to do, with one rule from the spec:
- Declare the extension at version
2026-08-25in the agent profile. - Show each option “using the shop’s description and policy links from buyer.consent”. The spec adds that a presented choice “MUST use the advertised description, links, granted value, and purpose/segment grouping.”
- Send the choice back on cart and checkout create, update or complete calls, and set
source: "platform"“only for choices that the buyer actually made during your flow.” - On a
missing_consent_datawarning, collect the contact detail and retry.
What Shopify does when the agent does not:
- Sends nothing: “Shopify applies the shop’s default settings for the buyer’s country.”
- Country unknown: “consent defaults to opt-out.”
- SMS opt-in without a phone number: “the checkout can’t complete until you provide the missing detail.”
The source field is how a buyer’s choice is told apart from the shop’s default. Per the spec, business “means the value reflects the business’s default policy” and platform “means the value reflects an explicit buyer decision captured by the platform.” A choice captured with one business is attributable only to that business, and platforms “MUST NOT propagate it” as the basis for source: "platform" in another business’s request. The changelog does not say where a shop sets its country defaults, or whether merchants see source in the admin. Shops “receive those choices with the cart, checkout, and order.”
From four booleans to a map with source
The 2026-04-08 version had four booleans (analytics, preferences, marketing, sale_of_data) on checkout only, and said “Default behavior when consent is not provided is business-specific.” Version 2026-08-25 turned this into a reverse-DNS keyed map with source, a description, links and segments, on cart and checkout. The April overview named CCPA and GDPR; the August text calls its identifiers “operational definitions, not legal taxonomies.” Shopify’s changelog now states a default rule of its own for the silent agent.
All six storefronts that returned a profile list it
On October 19 at 12:40 UTC we requested /.well-known/ucp from eight stores. Six Shopify storefronts returned a profile: allbirds.com, skims.com, colourpop.com, brooklinen.com, fashionnova.com and kyliecosmetics.com. All six list dev.ucp.shopping.buyer_consent at version 2026-08-25, extending cart and checkout. Two other stores did not answer usefully (one returned HTTP 429, one 404), so we do not count them, and six stores say nothing about the rest.
Agent checkout in Google AI Mode is not settled by this change
For Google AI Mode and Gemini direct checkout, Shopify’s help page lists among checkout blocks that “might not be available”: “Blocks that collect customer consent during checkout for data usage and communication preferences.” We covered that page in our report on Google AI Mode checkout for Shopify. None of the sources we read says that checkout uses Checkout MCP or negotiates this extension, so the October 16 change does not settle whether buyer consent choices reach the shop from it.
For another Shopify change for AI agents where the changelog states the default, see Shopify compare-at prices and AI agents. For merchants, the practical question is narrow: with an agent that negotiates the extension, whether an agent-placed order arrives with an email or SMS opt-in depends first on whether the agent sends the buyer’s choice, and otherwise on the shop’s default settings for the buyer’s country, or opt-out when the country is unknown.
