Skip to main content

Checkout MCP and Cart MCP now support UCP buyer consent

Checkout MCP and Cart MCP now support the UCP buyer consent extension (dev.ucp.shopping.buyer_consent) starting with UCP 2026-08-25. Buyers can now make the same privacy and marketing choices in your agent that they'd make in a shop's own checkout, like opting in to email or SMS. Shops receive those choices with the cart, checkout, and order.

What changed

Storefronts now list dev.ucp.shopping.buyer_consent in their discovery profiles at /.well-known/ucp. This extension applies to both cart and checkout.

If your agent profile negotiates dev.ucp.shopping.buyer_consent on UCP 2026-08-25:

  • Checkout MCP and Cart MCP responses include a buyer.consent object.
  • buyer.consent lists each consent purpose that the shop supports, its current state, a description, and links to the shop’s policies.

Shopify storefronts advertise at least these consent purposes:

  • dev.ucp.consent.analytics
  • dev.ucp.consent.preferences
  • dev.ucp.consent.sale_or_sharing
  • dev.ucp.consent.marketing, with email and sms segments

You can send the buyer’s consent choices when you create, update, or complete a cart or checkout. If you don’t send consent, Shopify applies the shop’s default settings for the buyer’s country. If the buyer's country is unkown, consent defaults to opt-out.

Some choices require a contact detail, such as an SMS opt-in without a phone number. In that case, the response includes a missing_consent_data warning, and the checkout can’t complete until you provide the missing detail.

Who's affected

Platforms and agents that use Checkout MCP or Cart MCP with UCP 2026-08-25 and negotiate the dev.ucp.shopping.buyer_consent extension are affected.

Integrations that don’t declare this extension, or that negotiate an earlier UCP version, aren’t affected.

Why this matters

This change lets your agent present accurate, store-specific consent options during cart and checkout, record the buyer’s explicit choices, and respect the shop’s default rules when consent isn’t provided. This reduces custom logic for regional defaults and helps merchants meet their consent and communication requirements.

What to do

  1. Declare the dev.ucp.shopping.buyer_consent extension at version 2026-08-25 in your agent profile.
  2. When you render cart or checkout, show each consent option to the buyer using the shop’s description and policy links from buyer.consent.
  3. When the buyer makes a choice, send that choice back on cart and checkout create, update, or complete calls, and set source: "platform" only for choices that the buyer actually made during your flow.
  4. If you receive a missing_consent_data warning, collect the required contact detail from the buyer and retry so the checkout can complete.

Related docs

Was this page helpful?