Checkout MCP and Cart MCP now support UCP buyer consent
Source: Shopify Dev Changelog
What Changed
Shopify’s Checkout MCP and Cart MCP now support the UCP buyer consent extension, identified as dev.ucp.shopping.buyer_consent, starting with UCP version 2026-08-25. This update allows buyers interacting through AI agents to make the same privacy and marketing choices they would normally set in a shop’s native checkout, including opting in to email or SMS communications.
Storefronts now list dev.ucp.shopping.buyer_consent in their discovery profiles at /.well-known/ucp. The extension applies to both cart and checkout flows, meaning consent data can be captured and passed through at multiple stages of the buying process rather than being limited to a single touchpoint.
When a buyer makes a consent choice within an agent-driven interaction, that selection is transmitted to the shop along with the cart, checkout, and order data. This ensures merchants receive consistent consent records regardless of whether a purchase originated from a traditional storefront session or an agent-based transaction.
Why This Matters for Shopify App Developers
As AI agents and conversational commerce tools increasingly handle cart and checkout operations on behalf of buyers, maintaining compliance with privacy regulations and marketing consent requirements becomes more complex. This update standardizes how consent data flows through the Model Context Protocol (MCP) layer, giving developers a defined schema for capturing opt-in preferences without building custom consent-handling logic for each integration.
Apps that build on Cart MCP or Checkout MCP, particularly those offering agent-based shopping experiences, chatbots, or automated purchasing flows, now have a standardized path to pass buyer consent data back to merchants.
Practical Implications
Developers building or maintaining MCP-based integrations should verify their implementation checks for dev.ucp.shopping.buyer_consent in the storefront’s discovery profile. Apps should be updated to properly surface consent prompts during agent-driven checkout flows and ensure consent selections are correctly attached to cart, checkout, and order payloads. Testing against UCP 2026-08-25 is recommended before this becomes a baseline expectation across integrations.