What changed
On October 16, 2026 Shopify added the Universal Commerce Protocol buyer-consent extension dev.ucp.shopping.buyer_consent to Cart MCP and Checkout MCP, beginning with UCP version 2026-08-25. A storefront's /.well-known/ucp profile advertises the extension; an agent that negotiates it receives buyer.consent on cart and checkout responses and can submit choices on create, update and complete operations. Supported purpose identifiers include analytics, preferences, sale or sharing of data, and marketing with email/SMS segments. Without submitted consent, Shopify uses store defaults for the buyer's country; if country is unknown, the default is opt-out. Missing required contact data, such as a phone number for SMS opt-in, yields a missing_consent_data warning and prevents checkout completion until resolved.
Why it matters
AI commerce integrations now have a protocol-level way to preserve store-specific consent instead of guessing or flattening buyer preferences into one marketing flag. The change matters for platforms that take buyers through shopping and checkout in an agent: they must render the options actually advertised by the merchant, preserve whether a value is a store default or a buyer-stated decision, and return a complete map when submitting consent. Mishandling SMS opt-in can interrupt purchase completion. The protocol defines transport semantics, not automatic legal compliance; businesses and platforms still have policy and regulatory obligations.
Consent is negotiated, not assumed
The UCP extension is advertised in storefront discovery profiles and applies to cart, checkout or both. Agents must negotiate dev.ucp.shopping.buyer_consent using UCP 2026-08-25. Cart MCP and Checkout MCP then expose a buyer.consent map with current values, descriptions and policy links. Existing agents that do not declare the extension, or use an older UCP version, are unaffected. This release concerns Shopify's UCP Cart/Checkout MCP services, not the separate Shop MCP cross-merchant search service.
The source field distinguishes defaults from explicit choices
The UCP spec uses granted plus source: business for a merchant default and source: platform only for a buyer's stated preference captured by the agent. Email and SMS marketing are segments beneath marketing; a segment's value overrides its parent for that channel. When an agent sends consent, it must include every advertised purpose and segment, preserve default attribution where no buyer choice was made, and must not invent or transmit unadvertised options. Consent captured for one merchant must not be silently reused as a merchant-specific decision for another.
Checkout can stop when a consent dependency is missing
For example, SMS marketing opt-in may require a phone number. On cart/checkout create or update, the service can return missing_consent_data as a warning. On complete_checkout, the normative UCP specification prohibits completing the purchase with an unmet required consent dependency. Agents need to collect the missing detail, update the checkout and retry. If no consent is sent, Shopify applies the shop's country-specific defaults, with opt-out when buyer country is unknown.
Implementation and evidence boundaries
Shopify's October 16 changelog describes shipped support, and the versioned UCP buyer-consent specification defines the request/response rules. Shopify's cart/checkout developer guide distinguishes unauthenticated cart operations from authenticated checkout operations. Neither the protocol nor the changelog proves that a given integration satisfies GDPR, CAN-SPAM, TCPA or other consent laws; businesses remain responsible for policy and applicable law. Independent production interoperability and UX evidence is still limited.