On October 16, 2026, Shopify announced support for buyers’ data and marketing choices in Cart MCP and Checkout MCP. These tools let an AI agent work with a cart and checkout. The store receives those choices with the cart, checkout and order.
Who should pay attention
A small Shopify store already selling through an AI agent or preparing an integration. The practical question for its owner: does the choice shown to the shopper match the data the store receives?
What is supported
The update covers integrations on UCP 2026-08-25 that negotiate the dev.ucp.shopping.buyer_consent extension. Shopify’s negotiation documentation says the active set depends on capabilities shared by the store and agent. Earlier versions and integrations without this extension are unaffected.
The buyer.consent object in the response contains consent state, explanations and links to store policies. Supported purposes include analytics, remembering preferences, data sale or sharing, and marketing with email and SMS choices. If no choice is submitted, Shopify applies the store’s settings for the buyer’s country; an unknown country starts with opt-out.
What to ask your developer to check
Our editorial recommendation: arrange a test-environment check using fictional contact details and no real payment.
- Check that the integration actually negotiated the required version and extension. Checkout MCP also needs authentication or a signed request, as the cart and checkout guide explains.
- Try accepting, declining and leaving a choice unchanged. Compare the displayed options with the cart, checkout and test-order state. This is a proposed check, not a result from our own testing.
- Under the UCP specification, include every purpose and segment advertised by the store when submitting a consent map. Omitting the entire consent field makes no update. The source: “platform” label must reflect a buyer-stated preference; retain the advertised source when no buyer-stated preference applies. A decision for one store cannot be carried over as that buyer’s decision for another.
- Check an SMS opt-in without a phone number. A missing_consent_data warning means required information is absent; checkout cannot complete until it is supplied.
Limits of the update
The protocol communicates consent state but does not determine the store’s subsequent actions or guarantee legal compliance. The announcement does not establish availability for every agent, plan or country. Nadali has not tested the integration or measured sales impact.
The owner’s first step: send this list to the integration developer and obtain the test results before launch. For another tool aimed at store teams, read how Sidekick explains checkout settings.
