Retailers Blocking AI Shopping Agents: Who Allows, Blocks, or Gates Access in 2026

Current as of November 3, 2026.

Retailers blocking AI shopping agents are not taking one uniform approach. As of November 2026, some explicitly prohibit named agents, many publish legacy bot rules that restrict access, and others allow browsing or checkout only under conditions. Walmart’s gated model adds identification, customer consent, spending controls, and published terms rather than unrestricted access. Billions Network audit Walmart Agentic Access Terms

What are AI shopping agents?

AI shopping agents are software that acts for a shopper to complete retail tasks, such as searching for products, comparing options, adding items to a cart, placing an order, or handling a return. The shopper sets the goal, and the agent carries out the steps.

An agent differs from two things it is often confused with. An AI crawler collects or indexes public pages. A shopping assistant recommends products without accessing an account. An agent goes further by acting inside the shopping journey for a specific customer.

Where the agent comes from also matters. A retailer-owned assistant works within the retailer's chosen systems and controls. An external agent, built by someone else, may need access to customer accounts, payment flows, inventory, product data, and checkout functions. Most of the access decisions in this article concern external agents.

An agent can touch five separate stages of the shopping journey:

1. Discover products and prices
2. Browse product pages
3. Access a customer account
4. Add items to a cart and check out
5. Handle returns, disputes, and post-purchase changes

A retailer can permit one stage while blocking another. It can also run its own assistant while restricting external agents.

Why are retailers blocking AI shopping agents?

Retailers give different reasons, and not every retailer gives every reason. The ones below come from public statements, published terms, and reporting.

• Security and customer data. In its dispute with Perplexity, Amazon alleged that the Comet shopping agent violated its terms, degraded the shopping experience, and created privacy vulnerabilities. Walmart's terms prohibit agents from evading anti-bot checks, impersonating human behavior, masking their origin, or exploiting security weaknesses. Engadget Walmart Agentic Access Terms
• Unverified identity and consent. A retailer needs to know who the agent is and that the customer authorized it. The Billions audit found that none of the 51 retailers it reviewed had a dedicated route for a verified, authorized agent to transact. Walmart's terms respond by requiring agent identification and explicit customer consent. Billions Network audit Walmart Agentic Access Terms
• Responsibility for payments, returns, and disputes. Walmart's terms say the customer remains responsible for payment, returns, and disputes, and that Walmart may refuse transactions, throttle activity, suspend an agent, or block access. Walmart Agentic Access Terms
• Terms of service and commercial control. eBay's user agreement prohibits unauthorized buy-for-me agents unless eBay grants permission. Engadget
• Older bot defenses that catch agents by accident. Not every block is a decision. The Billions audit found that 37 of 51 retailers used older general bot rules that blocked automated access to account, cart, or checkout paths without stating an AI-agent policy. Zillow has said its anti-scraping defenses sometimes catch agents it otherwise permits. Billions Network audit Engadget

What "blocking" does and does not mean

Blocking is not one decision. A retailer that restricts external agents has not necessarily blocked every AI crawler, product search tool, or shopping assistant.

Misconception: A retailer that blocks AI crawlers has rejected all AI shopping.

Correction: A retailer may block training or scraping bots, allow product discovery through selected platforms, operate its own assistant, or permit a customer-authorized agent only after identity and consent checks. Billions Network audit Walmart Agentic Access Terms

A robots.txt rule is also not proof that every agent interaction is technically blocked. It states how a site asks automated clients to behave. CAPTCHA challenges, login requirements, fraud controls, rate limits, and checkout authentication can stop an agent even where robots rules appear permissive. They can also interrupt an agent that the retailer has not deliberately decided to prohibit. Engadget

What the 2026 retail access spectrum looks like

The market is mostly a mix of blocking, browse-only access, accidental friction, and controlled gateways, rather than fully open agent commerce. Boston Consulting Group (BCG) surveyed 50 leading retailers and 100 global brands. Its labels describe data-access strategy, not permission to complete checkout: 42% were “collaborative,” 32% “selective,” 6% “wholly defensive,” and 20% were still deciding. BCG, October 19, 2026

The clearest way to understand retailer positions is to separate explicit restrictions, partial access, accidental friction, and controlled gateways. The retailer examples below follow the available public evidence and its dates.

The Billions Network audit reviewed public robots directives and terms for 51 major United States retailers in August 2026, with sources verified through September 2. It measured stated policy at account or sign-in and cart or checkout stages. It was a directional policy snapshot, not a live technical test or a census. Billions sells identity infrastructure for agents, so its research should be read as vendor-sponsored research. Methodology and caveats

The audit reported that none of the 51 retailers had a dedicated route for a verified, authorized AI shopping agent to transact at the time of its review. That finding does not override later first-party announcements, such as Walmart’s October agent-access terms.

Amazon is a useful example of why the wording matters. Per Billions’ August 2026 audit, with sources verified through September 2, its review of Amazon’s robots.txt recorded named AI agents and crawlers with Disallow: /, alongside restrictions on account, sign-in, and cart paths. That is strong evidence of a stated crawler restriction, but it is not proof of how every agent interaction is technically enforced. Amazon robots.txt

Nor is Amazon’s legal position settled by that file. In Amazon.com Services, LLC v. Perplexity AI, Inc., the United States Court of Appeals for the Ninth Circuit vacated a preliminary injunction on August 4, 2026, and remanded the case. The court’s preliminary-injunction analysis treated the user, aided by the tool, as the party accessing Amazon’s computers. The underlying dispute remained unresolved. Ninth Circuit opinion

Why gated access is different from open access

Gated access is a controlled path between a blanket block and unrestricted agent activity. Walmart’s published Agentic Access Terms and October 21 announcement describe this approach through customer authorization, spending controls, and consent requirements.

On October 21, Walmart announced Agent Profiles, the Walmart Agent Gateway, and terms for AI agents. Walmart said customers would be able to authorize a named agent through a dedicated profile, see that agent’s purchases separately, set a spending limit, and remove access. Its examples included $50, $100, and $200 spending-limit settings. These were illustrative settings in the announcement, not a universal requirement. Walmart announcement, October 21, 2026

Walmart’s terms define an authorizing customer as the human account holder who permits an agent to act on their behalf. They also require an agent, when asked, to identify its deployer, product name and version, operational contact, and information that associates it with the customer’s account.

The operating rules include these conditions:

• Outside the Walmart Agent Gateway, Walmart requires a Human Consent Gate before every checkout.
• An agent may check out without that separate approval only through the Gateway and only if it meets the Gateway’s requirements.
• The customer must give explicit, informed, affirmative consent and must be told that the named agent will transact with Walmart, that the customer remains responsible for payment, returns, and disputes, and how authorization can be revoked.
• Agents must not evade anti-bot checks, impersonate human behavior, mask their origin, or exploit security weaknesses.
• The Gateway uses agent credentials, scoped access tokens, and an agent mandate containing the customer’s instructions and consent.
• Walmart may require additional human consent, refuse transactions, throttle activity, suspend an agent, or permanently block access.

Walmart describes the Gateway as using the Model Context Protocol (MCP), a protocol for connecting AI systems to tools and data, or a similar connection protocol. Its announcement said the Gateway would begin with a beta for companies and developers. The public materials do not establish that the Gateway is broadly available to every developer or agent. Walmart says it may enable autonomous checkout through the Gateway under its terms, so this should not be described as universally available or unrestricted. Walmart Agentic Access Terms Walmart announcement

A five-question agent-access policy framework

Retailers deciding how to handle external agents need a written policy, not only a robots file. Assign ownership across digital commerce, security, payments, customer service, and loss prevention.

1. Identity

Must the agent disclose its provider, version, deployer, and the customer it represents? Define what information the retailer needs and when the agent must provide it.

2. Authority

What proves that the customer authorized this named agent? Define how the customer grants, reviews, and revokes that authority.

3. Scope

Which actions are permitted? Separate search, price checks, product comparison, cart changes, checkout, returns, substitutions, and post-purchase service. An agent authorized to reorder a product does not automatically need permission to change an address or payment method.

4. Transaction guardrails

Set limits for spend, categories, order frequency, substitutions, payment changes, delivery addresses, and identity verification. State when the customer must approve an action in the retailer’s app or another trusted channel.

5. Enforcement and recovery

Define what triggers a human check, throttle, suspension, refund review, or dispute process. Log the agent identity, customer authorization, permitted scope, transaction, and approval events so the retailer can investigate what happened.

Hypothetical example: A grocery retailer permits an identified agent to reorder household goods up to $75 per order, once per week, from a customer-approved list. Any alcohol purchase, substitution, delivery-address change, payment-method change, or order above $75 requires the customer to approve it in the retailer’s app. The retailer logs the agent identity, customer authorization, order scope, and approvals.

This model permits a useful repeat-ordering task without treating agent access as unrestricted account access.

What retailers should expect next

The near-term choice is not simply whether to “allow AI” or “block AI.” It is whether the retailer deliberately defines access controls or leaves older anti-bot systems to decide.

BCG reported that 68% of surveyed retailers expected agentic commerce to have a significant or transformational effect within two years. At the same time, only 18% said they were deploying agentic-commerce initiatives at scale. Those figures point to strong interest alongside limited scaled deployment. BCG, October 19, 2026

Expect more selective access, verified identity, scoped permissions, and customer approval gates rather than one open-web standard appearing overnight. Browsing permission will continue to differ from account access, and account access will continue to differ from permission to complete a purchase.

Retailers evaluating governed agent workflows can Talk to the team at NuPlay AI.