AI agents are shopping on your behalf. No one knows the rules yet

In short

The technology is moving faster than the law. A few regulators have issued warnings and guidance, but binding rules are still to come. Here’s what their early positions signal. Explore how agentic commerce works if you want the full picture of the model behind all this.

Somewhere right now, an AI agent is searching for the right product, comparing prices, and completing a purchase for someone who asked it to. The merchant never sees a visitor. No cookie banner renders. Nobody clicks “Accept” or “Reject”. The order simply arrives through an API, complete and paid for.

This is agentic commerce, and it’s happening. What’s missing is the rulebook. The consent architecture the web spent a decade building assumes a human in front of a screen, and agentic commerce has quietly removed that assumption. Regulators have noticed. Over the first half of 2026, supervisory authorities across Europe published a series of positions that deserve attention.

Consent and privacy compliance is what we work on every day at iubenda, which puts us in a good position to follow these developments as they land and to read what regulators are signaling. Here’s what they’re saying, and what it means for legal teams and marketers.

A note before we start: this article reflects the state of play in July 2026. Agentic commerce moves fast, and regulators are catching up. Some of the positions described here will evolve, possibly by the time you read this.

With agentic commerce and AI agents, the consent layer just lost its user

Every consent mechanism online commerce relies on was naturally designed for a person: a banner to read, a checkbox to tick, a preference center to visit. Agentic transactions route around all of it. The transaction happens through APIs and backend systems, and the customer interacts with the AI assistant, not with the merchant’s storefront.

Browser-based agents complicate the picture further. Depending on how they’re built, they may never render the banner at all, or they may programmatically dismiss it to finish the task.

In either case, when it comes to agentic commerce, no informed, freely given consent has been established under the General Data Protection Regulation (GDPR). The legal obligations remain exactly where they were; what has disappeared is the touchpoint where consent used to be collected.

There’s a weaker foundation underneath this than most consent discussions acknowledge. An agent inherits whatever consent posture its user built up over years of clicking through banners, and that posture was rarely a deliberate choice. Software is now acting on those inherited preferences at scale, within frameworks written with human interaction in mind.

Six regulatory moves on agentic AI in six months

Regulation typically trails technology by years. Here, supervisory authorities haven’t waited for legislation to state their expectations. Between January and June 2026, at least six official outputs addressed agentic AI directly:

January 8, 2026, UK: the Information Commissioner’s Office (ICO) published its Tech Futures report on agentic AI, flagging that processing purposes risk being set too broadly for open-ended tasks, that rapid automation will mean far more automated decision-making, that personal-assistant agents concentrate personal data, and that explicit consent, where the law requires it, may prove difficult to achieve in agentic deployments.
February 12, 2026, Netherlands: the Dutch data protection authority warned of major security risks in autonomous AI agents, stressing that deploying them, open source or not, doesn’t transfer or remove the deployer’s accountability.
February 2026, Spain: the Agencia Española de Protección de Datos (AEPD) released a 71-page guide on agentic AI, the most detailed guidance from an EU data protection authority to date.
March 9, 2026, UK: the Competition and Markets Authority (CMA) published Agentic AI and consumers, confirming that consumer law applies whether decisions are made by people or by AI.
March 31, 2026, UK: four regulators together (the CMA, the Financial Conduct Authority, the ICO, and Ofcom) published the Digital Regulation Cooperation Forum’s foresight paper on agentic AI.
June 8, 2026, EU: the European Data Protection Supervisor and Germany’s federal and Bavarian data protection authorities held a high-level debate on the proposed Digital Omnibus and its implications for the GDPR, a sign that EU-level scrutiny of these questions is intensifying.

Across all six, the direction is consistent: the autonomy of the system does not dilute the accountability of the organization deploying it.

We’ve asked Giulia Stancampiano, our Director of Legal (Privacy & Tech) at iubenda, what this pace from regulators tells her:

It tells me they’re not waiting. Guidance moves fast, legislation doesn’t, and regulators know the technology won’t pause for the legislative cycle. The mistake businesses make is reading “guidance” as “not yet binding.” These authorities aren’t inventing new obligations, they’re telling you how the ones you already have apply to agents.
Giulia Stancampiano, Director of Legal (Privacy & Tech) at iubenda

Two substantial responses so far come from the UK and Spain. The UK’s regulators have coordinated around accountability and evidence. The rest of this article looks at those two in depth, because together they sketch what supervision of agentic commerce is likely to look like.

The UK’s position: accountability stays with the business

Read the three UK documents together, and one point stands out: the business answers for the agent.

The ICO says it plainly:

AI agency does not mean the removal of human, and therefore organisational, responsibility for data processing. Organisations must be clear on the expectations that still apply under data protection legislation.
Information Commissioner’s Office (ICO), Tech Futures: Agentic AI

Its report walks through the risks that follow:

Purposes set too broadly to cover open-ended tasks.
Tangled controller and processor roles across the agentic supply chain.
Hallucinated facts that cascade across tools and downstream decisions.

Its practical anchor is the principle of least privilege: give an agent access only to the data its task requires. The report even sketches the commerce case directly, describing a person who authorizes an agent to make purchases up to a set amount, above which it has to ask.

The CMA is just as direct on the consumer side: “Businesses are responsible for how they engage with consumers, regardless of whether that is through people or AI systems.” It flags that:

Hyper-personalization inside agents can make manipulative design harder to spot.
People may defer too readily to automated decisions.
High-risk actions call for mandatory confirmation.

The DRCF foresight paper turns the principle into an evidence question. Four regulators writing together agree that “my agent did it” will not stand as a defense.

The “many hands” problem, where responsibility scatters across model providers, agent builders, and deployers, becomes in their framing an audit-trail problem: organizations should expect to demonstrate who authorized what, when, and against which data.

Spain’s response: the most detailed guidance so far

While the UK set principles, the AEPD wrote something closer to an engineering manual. Three ideas in its 71 pages deserve particular attention.

First, the processing chain. An agent completing one task may touch numerous internal and external services, each with its own privacy policies, cookie rules, and terms. The AEPD expects controllers to map that chain and work out GDPR roles across it, not just at the endpoints.
Second, memory. Agents keep working memory to complete tasks and longer-term memory to improve over time, and both can quietly retain personal data. The guide dedicates entire sections to compartmentalizing memory, limiting retention, and applying what it calls memory sanitization strategies. Consent has to survive this complexity too: the AEPD notes that a person should be able to give, modify, or withdraw consent even when their data sits inside a chain of reasoning spanning multiple entities.
Third, the rule of 2, a threshold borrowed from browser security and adapted for agents. An agent should never combine all three of: uncontrolled input, access to sensitive information, and the ability to act automatically without human supervision. Any two, with safeguards, may be manageable. All three is a configuration that shouldn’t exist.

One nuance matters here: the AEPD points out that automation doesn’t automatically mean automated decision-making under Article 22 of the GDPR. What matters is whether the agent’s actions produce legal or similarly significant effects, whether they’re reversible, and whether meaningful human supervision exists.

We asked Giulia how we can expect regulators in Europe to move on such a new topic as agentic AI:

The disruption is real, but the direction is less mysterious than it looks. Nobody is writing agentic AI law from scratch, they’re applying consumer protection and the GDPR to a new setting. The principles are already settled, and accountability is the clearest of them. What’s genuinely open is narrower: how those principles translate into technical guidance for a merchant accepting orders placed by an agent.
Giulia Stancampiano, Director of Legal (Privacy & Tech) at iubenda

The marketer’s problem: a customer you never meet

Marketing data

For marketers, an agentic sale delivers the order without the relationship around it: no visit, no analytics trail, no pixel, no opt-in. The customer may not even remember which merchant fulfilled the request their agent handled.

The cleanest rule emerging from current guidance is a conservative default: treat agent-driven transactions as having no consent for anything non-essential. Order fulfillment, payment, shipping, and transactional email can proceed, since they’re necessary to perform the contract. Analytics, marketing pixels, retargeting, and profiling remain off until a real consent signal is present.

Follow that logic through, and a larger question comes into view: does agentic commerce become, in practice, untracked traffic that marketing cannot use? How is the sale going to look on the merchant’s side? What data will the merchant receive about customers who purchased through an agent?

If agent-led purchases take a meaningful share of revenue, the dashboards most teams run on will be missing the channel that produced it. How the marketing industry absorbs this is genuinely open. It could:

Accept the signal loss and value the channel on aggregate results, the way some teams already treat consent-declined traffic.
Rebuild measurement on consented, first-party ground. But here, how does consent travel?
Press the platforms for more data than privacy law comfortably allows, and regulators will be watching for exactly that.

Which way the industry leans will shape agent-era marketing at least as much as any regulator’s guidance.

Email marketing

How can e-commerce companies receive and apply user email preferences from a sale performed through an AI agent?

The address an agent passes along to complete an order was shared for exactly that purpose: completing the order. It carries no newsletter opt-in, for instance. Sending marketing to that address without a legal basis is a familiar problem under the EU ePrivacy Directive, playing out in an unfamiliar setting.

The platforms themselves reinforce the boundary: merchants receive order data by design, not the conversation that produced it.

So the customer relationship has to be rebuilt legitimately, and there are only a few moments to do it: the transaction-level disclosure, the subsequent storefront visit if it ever happens, and above all the post-purchase email.

That first transactional message may be the only direct contact where a merchant can invite a preference, plainly and without pre-ticked boxes.

Then there’s the question nobody has answered yet. If the agent is acting for a logged-in customer who already gave consent on the merchant’s site in an earlier session, does that consent travel with the agent? There is no established way to carry consent from one interface to another, and agentic commerce puts that gap in plain view.

Where this leaves us

We work on consent questions every day, and we’ll say it openly: this one is genuinely hard. Regulators are publishing foresight papers and guidance rather than rules because the technology is outrunning the legislative cycle. Nobody can promise certainty about agentic commerce in 2026, and claims of certainty deserve skepticism.

The honest answer is that there’s no playbook yet. The guidance published so far is early and aimed at a technology that keeps changing shape. Anyone offering a definitive checklist for agentic commerce today is ahead of the regulators themselves.

Still, some practices look sensible under every position published so far:

Treating agent-driven visits and transactions as unconsented for anything beyond what the order itself requires.
Updating Data Protection Impact Assessments (DPIAs) early may also be worth it, particularly around agent autonomy and the risk of inferring special category data.
Record-keeping is rarely wasted effort. Mapping where the data flows, and being able to show who authorized what, when, and against which data: this is the evidence regulators keep signaling they’ll ask for.

Here’s what we recommend:

Build the practices any eventual rulebook will reward: consent treated as infrastructure rather than a banner, records that show who authorised what and when, and agents given exactly the access their task requires. None of that depends on knowing the final rules.
Giulia Stancampiano, Director of Legal (Privacy & Tech) at iubenda

This article reflects the state of play in July 2026. Agentic commerce moves fast, and regulators are catching up. Some of the positions described here will evolve, possibly by the time you read this.