← All research Pilly leans over a shop counter and hands a small bag to the first of a line of small robots waiting on the other side.

An AI agent can now legally shop on your website

A US federal appeals court, 4 August 2026: "the Assistant is a tool, not a person."

Ninth Circuit Court of Appeals · August 24, 2026 · 3 min read


In March 2026 Amazon won a court order blocking Perplexity’s shopping agent from making purchases on Amazon on behalf of logged-in users. It looked like the moment the door closed on agentic commerce.

On 4 August 2026 a federal appeals court, the Ninth Circuit, threw that order out.

The reasoning matters more than the outcome:

“It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”

and

“the Assistant is a tool, not a person”

The judges found Amazon unlikely to win by invoking the federal computer-fraud law. They were careful to leave the other road open, the one that runs through contracts: “This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.” But the criminal route is shut.

Translated: keeping an AI agent off your site is now a matter of your terms of use and your technical setup, not of criminal law. And more to the point, agents that actually buy things have stopped being hypothetical.

Google’s AI Mode books restaurants, appointments and event tickets through named partners: OpenTable, Resy, Tock, Ticketmaster, StubHub, and for service businesses Booksy, Fresha and Vagaro. At I/O 2026 Google announced expansion to local experiences and services in the US, including Google phoning businesses on a searcher’s behalf for home repair, beauty and pet care. Whether those calls can reach you is the owner’s decision, made in their own profile settings.

That last one deserves a second read. For a whole category of local business, the “customer” placing the first call may be a piece of software, and the settings that decide whether it gets through sit in a profile most owners have not opened in two years.

So what does a small business actually need to be reachable by a transacting agent? As of today, four things, and the fourth is where it usually breaks.

Be on a booking platform an assistant already integrates with. Booksy, Fresha, Vagaro, OpenTable, Resy, Tock. For most local service businesses this is the only route that exists right now, and it is not a technical project. It is a decision about which platform you use.

Keep the Google Business Profile complete, current, and correctly configured for calls. That is the surface Google’s calling agent uses. Hours including holidays, services listed, and the call-handling settings actually reviewed.

An orderly product list, if you sell goods. With Google you go through Merchant Center. With OpenAI, for now, you apply and wait to be accepted.

Do not block user-triggered agents at your firewall. ChatGPT-User, Perplexity-User and meta-externalfetcher all state that the instructions file may not apply to them, because a person initiated the request. What actually stops them is the service protecting your site, and that is what ends a purchase halfway through, silently, with no error anyone sees. Note that Claude-User behaves differently: Anthropic commits to honoring the instructions file for it.

And the honest part. Plugging straight into the systems these agents buy through is not realistically available to a small business without a platform partner. OpenAI’s product feed onboarding is “currently available to approved partners” and requires an application. Google’s simplified onboarding through Merchant Center is described as “rolling out over the coming months” with no adoption figures published. Anyone selling you a direct protocol integration today is describing something you cannot buy.

One more open question, and nobody has answered it. Claude in Chrome became available to everyone on 26 August 2026: an agent that reads pages, clicks links, fills in forms and uses the logins a person is already signed in with. Anthropic publishes no name you could recognize it by, no site-owner controls and no guidance on the instructions file. If it visits your site, you currently have no documented way to identify it or to say no. That is a genuine gap, and we would rather flag it than pretend the picture is complete.

Related

Free scan, no card required

Now find out where your own business stands.

That was the research. The free report runs the buying questions from your industry through the AI systems and shows you who gets named instead of you.

We'll email you the report. No card, no call required to get it.