Google has overhauled the plumbing of its payment system so that AI agents can buy things without a human navigating a checkout page. The update is built around a new open standard called the Universal Commerce Protocol, which gives AI agents a common way to communicate with merchants: confirm inventory, agree on a price, and complete a transaction, all through a machine-to-machine connection.
The protocol was announced at the National Retail Federation's conference in January 2026 and has now been extended with new infrastructure updates. It was built with major retailers from the start. Shopify, Etsy, Wayfair, Target, and Walmart all helped develop it. Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa, and Zalando have all formally backed it.
This is not Google acting alone. Visa launched its own Trusted Agent Protocol in October 2025, which helps merchants tell the difference between a legitimate AI buyer and a malicious automated bot. Mastercard completed its first real agent-driven transaction in September 2025 and has since expanded the program to Australia, the US, India, and Hong Kong. PayPal is simultaneously integrating with ChatGPT, Perplexity, and Mastercard's system. The entire global payments industry is moving in the same direction at the same time.
The practical impact for any business that sells online is straightforward. AI agents cannot read a webpage the way a human does. They cannot click, scroll, or interpret persuasive copy. What they can read is structured data: a clean product feed with accurate prices, stock status, and specifications. If your product information is not presented in a format a machine can parse, an agent searching on behalf of a customer will pass you by. One analysis put it plainly: Amazon blocked AI crawlers and lost 18% of its ChatGPT referral traffic month-over-month. Walmart, which did not block them, now captures 20% of ChatGPT referral traffic.
The security question is real and not yet fully solved. A faulty or poorly configured agent could place orders at scale without anyone noticing. Google's answer is cross-device biometric checks: an agent can request a confirmation prompt on your phone before completing a high-value purchase. Mastercard registers and verifies agents before allowing them to initiate any payment at all. But every organisation that starts using AI agents for procurement, travel, or supply ordering will need to define a clear policy: what is the agent allowed to do without asking, and what needs a human sign-off. That policy needs to be encoded into the agent's operating rules, not just written in a document.
Google's central role in this system carries a cost worth understanding. Every transaction routed through its platform gives Google a detailed view of what AI agents are buying and from whom. Merchants retain their own customer data and remain the seller of record, but the transaction data flowing through Google's infrastructure is Google's. That is the same trade-off that has always existed with platform dependency, now applied to an entirely new layer of commerce.
The timeline here is compressed. Visa predicted millions of consumers will use AI agents to complete purchases by the 2026 holiday season. That is roughly six months away. Businesses that are still waiting to think about this are already behind the first wave of preparation.