In short
Agentic commerce is online shopping where an AI agent finds, compares, and buys products on your behalf. It matters because it is set to become a major new sales channel, changing how people discover and pay for products. In this article you’ll learn what agentic commerce is, how agentic checkout works, and the protocols and privacy questions shaping it.
What is agentic commerce?
Agentic commerce is a model of online shopping where an autonomous AI agent completes tasks for a person: finding products, comparing options, and making a purchase, with little or no click-by-click input from the user. For example, you could ask an assistant like ChatGPT to find a coffee table that matches your living room and costs under $200, and it will search across stores, compare the options, get your confirmation and place the order for you. The agentic commerce meaning is right there in the word “agent.” You hand off the work, and software acts for you.
Here is how agentic AI commerce differs from what came before:
- Traditional e-commerce: you browse a store, add items to a cart, and click buy.
- One-click checkout: the final step is faster, but you are still on the merchant’s page, driving every decision.
- Agentic commerce: an AI agent shops across many merchants for you, often through APIs and backend systems rather than a website you can see.
In agentic commerce, the customer interacts with the AI assistant, not the online store.
This is a radical change for e-commerce: when the transaction happens through an agent, the merchant may never get a “real” visitor on their site, never show a cookie banner, and never run their usual checkout flow. The relationship with the customer now passes through a piece of software that acts on the customer’s instructions.
How does agentic commerce work?
Agentic commerce works by handing an entire purchase to an AI agent that acts on your behalf. Most agentic purchases follow the same four steps:
- Discovery. The agent searches across merchants to find products that match what you asked for.
- Evaluation. It compares options on price, availability, reviews, and your stated preferences.
- Checkout. It assembles the order and confirms the details.
- Payment confirmation. It completes payment and returns a confirmation, often without you leaving the chat.
Three players make this work:
- The AI agent acts for the user and makes the requests after regular checkpoints.
- The merchant exposes its catalog and checkout so an agent can read and act on them, usually through a shared protocol.
- The payment provider, such as Stripe, settles the transaction securely. In OpenAI and Stripe’s model, for example, you ask for a recommendation in ChatGPT, and when you are ready to buy, a Stripe-powered checkout appears right inside the chat. You never leave the agent.
For merchants, this adds a new layer of operational complexity to the checkout, since a sale can now start and finish outside your own systems.
Here is what agentic commerce looks like behind the scenes. When you place an order, ChatGPT sends the details to the merchant’s backend through the protocol, a shared standard that lets the agent and the merchant’s systems talk to each other. The merchant accepts or declines, processes the payment through its existing provider, and handles fulfillment and support exactly as it does today. The checkout is rendered inside the chat, but the checkout logic and payment processing run on the merchant’s own systems. So the experience feels like one continuous conversation for the shopper via an AI conversation, while the real work happens across separate backends.
What is agentic checkout?
Agentic checkout is the moment an AI agent completes a purchase for you. Agentic AI checkout is the buy step of agentic commerce, done by the agent rather than by you on a store page. Instead of taking you to a merchant’s website to enter your details, the agent handles the cart, payment, and confirmation inside its own interface. For example, once you say “yes, buy it” in the chat, the agent charges your saved payment method via a payment provider and returns an order confirmation (with most likely an email order confirmation), without ever opening the store’s checkout page.
The protocols powering agentic commerce
For an AI agent to shop at a store, the two need a common language. The agent has to ask “what do you sell, is it in stock, and how do I pay?” and the merchant has to answer in a way any agent can understand.
That is what an agentic commerce protocol provides: a shared, open standard for agents and merchants to talk to each other. For example, just as any web browser can open any website because they share standards like HTTP, a commerce protocol lets one agent transact with many merchants without a custom integration for each. So when people ask what is agentic commerce protocol, this is it. Two are leading the conversation right now, with more likely to follow.
UCP: the Universal Commerce Protocol
The Universal Commerce Protocol (UCP) is led by Google. It was announced at the National Retail Federation (NRF) event in January 2026 and co-developed with a group of major retailers, including Shopify, Etsy, Wayfair, Target, and Walmart, alongside more than 20 partners in total.
UCP focuses on discovery and interoperability. The goal is to let AI agents find and transact with any participating merchant across many surfaces, so a shopper’s agent is not locked into a single store or platform. In practice, that means a merchant can be reachable by different agents rather than building a one-off connection for each.
ACP: the Agentic Commerce Protocol
The Agentic Commerce Protocol (ACP) or OpenAI agentic commerce protocol is an open standard co-developed by OpenAI and Stripe. OpenAI describes it as the connective layer between merchants and ChatGPT users, and it powers Instant Checkout, the “Buy it in ChatGPT” experience.
ACP focuses on conversational, in-chat checkout. The buyer stays in the conversation, and a Stripe-powered purchase happens inline, without a redirect to a separate website. Merchants are coming online across the ecosystem, including Etsy sellers and Shopify merchants, which extends where an in-chat purchase can happen. OpenAI is also extending ACP beyond checkout into product discovery, so ChatGPT can surface more complete and up-to-date product information directly in the chat.
Other emerging protocols (AP2, MCP)
The space is still taking shape, and a few other standards sit alongside the commerce protocols. The most commerce-relevant is the Agent Payments Protocol (AP2), announced by Google with more than 60 payment and technology companies. It is a payments layer that uses cryptographically signed “mandates” as proof that the user actually authorized a purchase.
Alongside it sits the Model Context Protocol (MCP), a general open standard for connecting AI agents to outside tools and data. MCP is not a commerce protocol, it is a common way for an agent to plug into other systems, and those systems can include a merchant’s. Expect the list to grow as the ecosystem matures.
UCP vs. ACP: what’s the difference?
The difference is simple: UCP handles product discovery and interoperability, while ACP handles the in-chat checkout. It is easy to read them as rivals, but they solve different problems and can work together. Here is a simple comparison:
| Agentic commerce protocol | UCP (Universal Commerce Protocol) | ACP (Agentic Commerce Protocol) |
|---|---|---|
| Who runs it | Google, with retail partners (Shopify, Etsy, Wayfair, Target, Walmart) | OpenAI and Stripe |
| What it does | Product discovery and interoperability, so agents can find and reach many merchants | Conversational, in-chat checkout, so a buyer can purchase without leaving the chat |
| Where it shows up | Google surfaces like Search and Gemini, plus participating retailers | Inside ChatGPT and other compatible AI agents |
| Best thought of as | The discovery and connection layer | The in-chat purchase layer |
The short version: UCP helps an agent find and connect to merchants, while ACP handles the purchase inside a conversation. A merchant can support both. They are complementary pieces of the same emerging stack, not competing bets you have to choose between.
Why agentic commerce matters
Agentic commerce is early, but the projected trajectory is hard to ignore. McKinsey has estimated the following:
By 2030, the US B2C retail market alone could see up to $1 trillion in orchestrated revenue from agentic commerce, with global projections reaching as high as $3 trillion to $5 trillion, according to McKinsey research.
The agentic commerce opportunity: How AI agents are ushering in a new era for consumers and merchants, McKinsey Report
Bain has forecasted the US market alone at $300 to $500 billion by 2030, or roughly 15 to 25 percent of total online retail sales. Estimates vary widely, but the direction is consistent: this is a channel businesses will need to plan for, not a novelty.
For merchants and brands, the shift changes how you get found and chosen. Visibility stops being only about ranking on your own storefront and starts being about whether an agent can reach you, understand your catalog, and trust you enough to transact.
That is a meaningful change for online stores, large retailers, and marketplaces adopting UCP or ACP at scale. Adoption is being made deliberately easy, too. Merchants that already use Stripe can turn on agentic payments in about one line of code, and others can join without switching payment processors. That low barrier is part of why the ecosystem is filling out so fast.
Agentic commerce and your data: the questions to ask now
Here is the part that is easy to overlook in all the excitement. As the privacy folks in the room, allow us to bring you the least thrilling news of the article: privacy rules like the GDPR do not go away, and they’re not clear yet.
For more than a decade, consent on the web was built around the storefront and the cookie banner. In agentic commerce, the shopper may never see either. Yet the obligations do not go away.
User data is still a strong component in agentic commerce. The accountability part and need for control are even more real. What do privacy regulations say about that?
Privacy regulations likely still apply when an agent shares a person’s data with a merchant to complete a purchase, and the laws for e-commerce do not stop applying just because it’s an AI agent who placed the order.
That raises real questions that the industry is only starting to answer:
- What consent is the agent actually inheriting? An agent acts on whatever preferences the user set, sometimes years ago, often by clicking through a banner without reading it. That posture was rarely a deliberate choice, and now it drives real decisions at scale.
- Who is accountable for data shared mid-transaction? When an agent passes your details to a merchant to close a sale, responsibility for that exchange has to sit somewhere clear.
- How do you capture meaningful consent when there is no banner? The old interface for asking permission may simply not be there. What about third-party tools involved in the agentic checkout?
Some answers are taking shape:
- One is least-privilege, revocable, and time-limited authorization, so an agent gets only the access a specific task needs and nothing more.
- Payment standards like AP2 use signed mandates to prove a user genuinely approved a purchase.
- And there is a real push to treat consent as infrastructure connected to how you govern AI, not a compliance checkbox bolted on at the end.
What the main stakeholders are saying
The platforms building these experiences are adding guardrails of their own. In its Instant Checkout model, OpenAI says:
- users stay in control and confirm each step before anything happens,
- payments run on encrypted tokens authorized only for a specific amount and a specific merchant,
- only the data needed to complete the order is shared,
- payment information is not stored by OpenAI,
- chat content is not shared with retailers.
These are real safeguards, and a sign that the platforms are thinking about it. Trust is not a side issue here, it is what will decide whether people are willing to let an agent shop and pay for them at all.
What the platforms don’t answer
Look closely and OpenAI’s safeguards are almost all about the transaction itself: completing the order, securing the payment, and sharing only what the purchase requires. That is a narrow slice of privacy. It says little about what happens to a person’s data after the sale, or about the broader profile a business might want to build from it.
That is where a real tension sits. Many merchants want to collect marketing data from agentic purchases, the behavioral and contact information that powers retargeting, segmentation, and repeat sales. A cautious “no consent unless it is explicit” default protects the shopper, but it also cuts merchants off from data they treat as valuable and actionable.
Normally, regulators draw the line between those interests. Here, the technology has outrun the rules, so the line is not drawn yet. Platform-level confirmation is not the same as consent that stands up to privacy regulations, and closing that gap is the work that still lies ahead.
This is the same problem we at iubenda work on every day: capturing and documenting valid consent and keeping data handling aligned with regulations. Agentic commerce just moves that work into a world where the transaction runs through an agent. Getting it right is not only a legal matter. Clear, well-managed consent is part of what makes a business trustworthy to customers, and to their agents.
FAQ
How does agentic commerce differ from traditional e-commerce?
Agentic commerce differs from traditional ecommerce in who does the work. In traditional ecommerce, a person browses a store and clicks to buy. In agentic commerce, an AI agent does the browsing and buying for you, often across several merchants and through backend connections rather than a website. The biggest change is that the customer interacts with the agent, and the merchant may never see a visit to their own storefront.
How does an agentic commerce agent actually work?
An agentic commerce agent follows four steps: it discovers products across merchants, evaluates them against your preferences, assembles a checkout, and confirms payment. It relies on a shared protocol to read a merchant’s catalog and complete the purchase, and on a payment provider to settle the transaction, often without you leaving the chat where you started.
What are the leading agentic commerce platforms and providers?
The most visible efforts today are two commerce protocols, with supporting standards around them:
- UCP (Universal Commerce Protocol): led by Google, backed by retailers like Shopify, Etsy, Target, and Walmart.
- ACP (Agentic Commerce Protocol): from OpenAI and Stripe, powering checkout inside ChatGPT.
- AP2 and MCP: Google’s payments layer that proves a user authorized a purchase (AP2), and a general standard for connecting agents to tools and data (MCP).
What is the future of agentic commerce?
The future of agentic commerce is steady growth and more standards, but adoption will hinge on trust. Because these transactions involve payments and real money, people will only hand off buying once the process feels safe. Analysts like McKinsey or Bain project the market in the trillions of dollars globally by 2030. For businesses, the practical work is being reachable by agents, keeping catalogs and checkout agent-ready, and handling consent and data responsibly.
Where this leaves you
Agentic commerce is starting to move shopping through agents, not just storefronts. The businesses that do well will be the ones that are easy for an agent to find, simple to transact with, and trustworthy with customer data at every step. That last part is where compliance and growth meet.
As shopping moves to agents, trust with customer data is the edge.
See how iubenda helps you capture and document valid consent and keep your data handling aligned.
