TIL: Shopify only saves the checkout marketing checkbox when the shopper proceeds (Pay now, on one-page checkout)

While building a cart-recovery app for Shopify, I hit a bug report I couldn't reproduce as a bug: a shopper ticks "Email me with news and offers" at checkout, abandons — and the abandoned checkout webhook arrives with buyer_accepts_marketing: false. Every time, in our tests.

It turned out not to be a bug. It's documented — just easy to miss, and it has real consequences for anyone building on the checkout APIs.

The documented behavior

Shopify's Help Center page on collecting customer contact information says consent is captured when the customer selects the marketing checkbox and proceeds — by selecting Pay now on one-page checkout, or Continue to shipping on three-page checkout.

And since one-page checkout became the default in 2023, most stores run the single-page layout — where the recording step is Pay now itself.

Put those together: an abandoned checkout is one where the purchase was never completed — in the common case, the shopper never pressed Pay now. So on a one-page store, an abandoned checkout from a first-time shopper will essentially never carry recorded consent, no matter what the checkbox showed on screen.

What I saw in testing

On a development store (July 2026), with a fresh email address:

• checkouts/create fired within seconds of typing the email — with buyer_accepts_marketing: false and no customer object at all
• ticking the checkbox afterwards produced no consent change in any subsequent checkouts/update
• the REST /admin/checkouts.json listing lagged the webhooks by hours; the webhook stream was the timely signal (and Shopify has marked the REST Admin API as legacy since October 2024 — the GraphQL abandonedCheckouts query is the current read path)

Shopify's Abandoned Checkouts docs define the resource as: "A checkout is considered abandoned after the customer has added contact information, but before the customer has completed their purchase." Nothing about consent timing — which is what makes this easy to trip over.

Why it matters

• Shopify's own abandoned checkout automation sends to subscribed customers only by default — one reason merchants often wonder why so few automatic recovery emails go out. The email's To: field can be switched to All customers, but that's a technical setting, not a legal green light: whether a recovery email to a non-subscribed shopper needs prior consent depends on jurisdiction (the EU is stricter than the US, for example).
• If your app gates recovery emails on recorded consent, expect to skip most abandoned checkouts from new shoppers — not because shoppers didn't tick the box, but because Shopify never persisted it.
• Returning customers who subscribed during an earlier completed purchase do carry consent, so their checkouts behave "normally" — which makes the behavior look intermittent if you don't know the rule.

Practical takeaways for builders

1. Read consent from the customer-level email_marketing_consent as well as the checkout's buyer_accepts_marketing — returning subscribers show up there. (The checkout webhook includes a customer object only when Shopify recognizes the shopper.)
2. Don't treat a false flag as "shopper declined" — on one-page checkout it mostly means "shopper never reached the recording step".
3. If your product's behavior depends on this (ours did), make the policy an explicit merchant setting rather than a silent gate.

---

I'm building Cartback, a cart-recovery app for Shopify — this is one of a few documented-but-easy-to-miss behaviors we've written up on the blog.