Agentic Purchases: What Brands Should Consider Before Letting AI Agents Shop

AI agents now browse the web and buy on behalf of consumers, and the numbers are striking. Adobe reported that during 2025, AI-driven traffic to U.S. retail sites grew over 4,700%. And just this summer, Cloudflare found that automated bots now generate more web traffic than people do.

The infrastructure to support this shift is already here. Several frameworks for enabling agent browsing and purchasing are live, including OpenAI and Stripe's Agentic Commerce Protocol, Google's UCP and AP2, Visa's Trusted Agent Protocol and Mastercard's Agent Pay.

In the face of this shift, brands are increasingly evaluating whether to embrace, restrict or block AI agents. Permitting agent activity on a brand’s website in a safe and optimized way (rather than passively leaving the site open to agent activity) requires technical work to implement; similarly, prohibiting or restricting agents’ access also requires affirmative action. Whichever approach a brand prefers, the time to implement it is now.

Key Considerations for Permitting Agents and Optimizing Agentic Activity

As consumers grow more comfortable using AI applications to search for and recommend products, and increasingly allow AI agents to make decisions on their behalf (including purchase decisions), many brands are embracing agent activity as a necessary step to keep their products “in front of” consumers, regardless of how those consumers prefer to shop. Brands that choose to permit AI agents to access their websites should keep the following considerations in mind:

• Framework diligence. As noted above, AI and payment companies have established a number of protocols for enabling agent browsing and purchasing, each working with different models and payment providers. Before implementing any of these frameworks, brands should conduct diligence: map the data flows for the framework, determine compatibility with the brand’s existing environment and payment partners, and review how agents are authenticated, how payment credentials are protected and who bears liability throughout the transaction. This includes reviewing applicable commercial contracts, which may include platform agreements, payment processor terms, AI provider terms and terms related to the selected protocols. Only frameworks and protocols that have been vetted and approved should be implemented.
• Technical protections. Beyond enabling approved frameworks and associated protocols, brands can and should do additional technical work to protect their websites and payment flows from unauthorized agent activity. These protections may include agent verification methods, firewalls, rate or traffic limits, methods to help distinguish approved agents from malicious bots and a tiered permission structure for different types of agents. Brands should also publish machine-readable agent policies for their sites, which may include transaction amount caps, quantity limits and the circumstances in which a consumer must be pulled into a session to verify an agent purchase (e.g., shipping-address changes, unusual baskets or non-specific requests). Finally, existing fraud models may need to be re-tuned for agent activity, and, where supported by the applicable protocol, brands should retain appropriate evidence of the consumer’s authorization, the agent’s identity and permissions and relevant activity logs, subject to applicable retention, security and data-minimization requirements.
• Data design and parity. When defining machine-readable product catalogs, brands should be careful about which items they include or leave out, particularly as consumers increasingly rely on agents to find all types of products. As a risk-management baseline, brands should seek consistency between material product information, prices, availability and transaction terms presented through human-facing and agent-facing channels, unless a difference is intentional and has undergone legal review. For example, decisions to offer different pricing to agents, to adjust prices based on consumer information supplied by an agent or to make only certain products available to agents should be reviewed for compliance with privacy, automated decision-making technology, algorithmic or surveillance pricing, antidiscrimination, consumer protection and other laws that may apply. Because these rules are evolving quickly, and their application to agent-driven commerce is currently unsettled, brands should confirm the current requirements before publishing and revisit their policies frequently.
• Privacy. As part of their diligence, brands should map data flows for applicable frameworks, understand what data agents are passing to the brand and determine which privacy laws may be implicated and the roles of the various parties. At each point in the browsing or payment process, brands should prioritize compliance with their data-minimization policies and collect from agents only the data required to complete the transaction. Brands should also identify any data they are required to share with agents and understand how the applicable model provider and other involved parties will use that data. Privacy policies may need to be revised to accurately reflect these data collection and use practices and should be updated if the brand adopts new frameworks.
• Consumer authorization and agency. Brands should consider how agent-initiated transactions will be treated when an AI agent exceeds a consumer's instructions, misunderstands preferences or otherwise acts unexpectedly. Existing agency, contract and electronic-transactions laws generally contemplate that actions taken by authorized electronic agents or other automated systems (similar to AI agents) may bind the consumer or other principal, but the scope of that authority, the allocation of losses from unauthorized or erroneous purchases and the standards for revoking or limiting an agent's authority remain unsettled in the agentic-commerce context. Brands should therefore establish clear rules regarding when agent orders are accepted, what authority an agent is deemed to possess, when additional consumer confirmation is required, and how disputes involving agent actions will be resolved.
• Website terms. Finally, any anti-bot clauses in the brand’s website terms and conditions should be revised to accurately reflect the brand’s position on AI agents and to set rules for permitted agent activity. For example, terms and conditions may specify when agent orders are binding, provide processes for resolving agent or catalog errors, allocate responsibility for agent activities and set forth rules for addressing the authorization and agency questions raised above.

The Alternative: Blocking or Partially Blocking Agents

A brand that determines it is in its best interest to block or partially block AI agents from its website can take several steps to protect itself.

First, the brand should not enable (and should actively disable) any agentic payment protocols or permissions. Because certain website platforms include tools that make it easy to turn on agent access, the brand should proactively confirm that all such tools are disabled.

Second, the brand’s developer team should take technological steps to detect and block identified agents, such as deploying agent-identification signals. This can be done in payment flows only, or across the entire website to prohibit both browsing and purchasing by agents. Robots.txt rules and user-agent rules for known agents can also help (though these rules may be ignored or evaded by aggressive agents), as can requiring CAPTCHA, logged-in checkout and other controls. No single protection will detect or block every agent, however, so brands may consider layering several of these technical controls.

Finally, the brand should expressly prohibit agent purchasing (and browsing, if applicable) in its website terms and conditions.

Whether they embrace, restrict or block AI agents, brands should determine their approach now and take steps to protect themselves. Loeb & Loeb is available to help, including by supporting framework diligence, negotiating related contracts and updating website terms and conditions and privacy policies.