So the "keep me updated" box you've carefully placed in your checkout now has a second home: inside someone else's chatbot. Worth five minutes of your time to understand what that means.

What Shopify actually changed

Shopify has a couple of tools for developers building AI shopping agents, called Cart MCP and Checkout MCP. They let an agent build a cart and create a checkout on a Shopify store on the buyer's behalf. The buyer still finishes the purchase on the merchant's own checkout, but the agent does most of the legwork.

The 16 October changelog adds support for something called the UCP buyer consent extension. In plain English, an agent can now collect the same privacy and marketing choices a buyer would make in your own checkout, then send them to your shop along with the cart, checkout or order.

According to Shopify, the choices covered on Shopify storefronts include at least:

  • analytics
  • preferences
  • sale or sharing of data
  • marketing, split into email and SMS

When an agent asks, your store hands back each option with its current state, a description and links to your policies. The agent is supposed to show those to the buyer and send back what they chose.

This follows Shopify's Shop MCP announcement on 13 October, which lets any agent search Shopify's catalogue, build carts and complete Shop Pay checkout through one connection. Agents buying things is clearly where Shopify is putting its effort this month.

The defaults are the bit that matters to you

Most merchants won't build an agent. But your store might well be shopped through one, so the useful question is what happens when the agent doesn't bother with consent at all.

Shopify's answer is reasonably cautious. If an agent sends no consent choices, Shopify applies your shop's default settings for the buyer's country. If the country isn't known, consent defaults to opt-out.

There's one more detail worth knowing. Some choices, like opting in to SMS, need a contact detail to go with them. If that's missing, the agent gets a warning and the checkout can't complete until the detail is provided. Sensible, because a text message opt-in without a phone number isn't much use to anyone.

The specification behind all this is also fairly strict about honesty. Each choice is marked as either the business's default or the buyer's own decision, and the spec says an agent must only mark something as the buyer's decision when it reflects their "stated preference". In other words, no quietly ticking the box for them.

What I'd check this week

None of this needs a panic. Only agents that have specifically signed up to this extension are affected, and the rules lean towards caution. But it's a good prompt to look at a few things you may not have touched since launch.

Your customer privacy settings. In Shopify admin, go to Settings, then Customer privacy. That's where your cookie banner, data sharing opt-out page and the regions they apply to live. Shopify offers automated region settings, and if you use a third-party cookie banner app, Shopify's own help pages say its regions should match the ones set there. Since agents now fall back on your country defaults, those defaults matter more than they did.

Your privacy policy and the wording around it. Agents are handed descriptions and links to your policies to show the buyer. If your privacy policy was copied from a template in 2019 and hasn't been read since, now's a decent time. This isn't legal advice (I'm a developer, not a solicitor), so if you're unsure, ask whoever advises you on data protection.

Where your consent data goes next. This is the one people forget. Plenty of stores push marketing consent from Shopify into an email platform, a CRM or an ERP. If orders start arriving through agents, it's worth checking that consent flows through your integrations the same way it does for a normal checkout. A sync that only looks at one field, or only at web orders, can quietly drop it.

Your own custom checkout bits. If you've had custom checkout extensions or apps built that touch marketing sign-up, make sure they still behave sensibly when the buyer has already made their choice somewhere else.

If you're building your own agent

Some retailers are experimenting with their own shopping assistants, or with letting partners sell their products through one. If that's you, the action list in Shopify's changelog is short and clear. Declare the extension in your agent profile, show each option using the shop's own description and policy links, send the buyer's choices with your cart and checkout calls, and handle the missing data warning by asking for the detail and trying again.

The bit I'd underline is the honesty rule. Only send a choice as the buyer's own if they actually made it. It's tempting with AI tools to let the model fill in the gaps, and consent is exactly the place you shouldn't. Build the flow so a person has to make the choice, and leave everything else at the shop's default.

The bigger picture

For years, the checkout was the one bit of the journey a merchant fully controlled. That's slowly changing. The good news is that Shopify seems to be building the guard rails in early rather than bolting them on later, and the defaults favour the buyer.

For a small retailer, the practical takeaway is simple. Your settings, policies and integrations now speak for you in places you can't see. Make sure they say what you'd want them to.

If you'd like a second pair of eyes on any of this, that's the sort of thing we help with. We do custom Shopify development, we build and fix the integrations that move data between Shopify and everything else, and for smaller firms without their own developers we can act as your outsourced tech department. Drop us a line and we'll have a chat.

Cheers, Rob