Full Answer

A standard WooCommerce checkout collects consent through a browser-based CMP — a cookie banner, a checkbox, a Consent Mode v2 signal. The store fires tracking pixels and processes personal data based on that consent. When an AI agent makes the same purchase through MCP or a headless API, none of that consent infrastructure exists. There's no browser, no DOM, no banner to render. The personal data — name, shipping address, email, payment details — still gets processed, but the usual consent collection mechanism is entirely absent.

The GDPR obligation doesn't disappear because the buyer isn't human. The store owner remains the data controller because they determine the purpose and means of processing. The AI agent acts on behalf of the consumer, but it doesn't absorb the store's compliance responsibility. Consent — or another lawful basis such as contract performance under Article 6(1)(b) — must be established before the data is processed. For agent transactions, that means building consent into the API handshake: the agent passes a verified consent token as part of the purchase request, and the store validates it before processing the order.

Stores that skip this step risk processing personal data without a lawful basis on every agent transaction. As agentic commerce volumes grow, that exposure compounds. A detailed analysis of the consent gap covers the architecture patterns and the specific GDPR articles that apply.