The future of e-commerce: AI shopping, agentic checkout and what to do in 2026

How big is e-commerce now? The official numbers

Start with official statistics, because they cut through vendor forecasts. In the United States, the Census Bureau's quarterly e-commerce series put online sales at 17.1% of all retail sales in the second quarter of 2026, seasonally adjusted. In the second quarter of 2017, when this page first went up, the same measure was 8.7%. The pandemic pushed it to 16.3% in the second quarter of 2020. It fell back to 14.2% by mid-2022 as shops reopened, then passed the pandemic peak in the third quarter of 2025 (16.4%). The next estimate is due on November 19, 2026.

The share in Great Britain is higher by the Office for National Statistics measure: the proportion of retail sales made online was 28.8% in August 2026, up from 28.4% in July. Statistics Canada put retail e-commerce at 7.5% of total retail trade in July 2026 ($5.5 billion, seasonally adjusted), down from 7.7% in June.

Do not compare the three levels with each other. Each agency draws the line its own way: the Census Bureau counts a sale as e-commerce when the order is placed online, whether or not the payment is, and Statistics Canada leaves travel and accommodation bookings, tickets and financial transactions out of retail altogether. Compare each country with itself over time. In all three the trend is a slow climb, not a collapse of physical retail. The larger change is where the online sale starts.

How AI shopping in search changes the way products are found

The front page of a store used to be its home page, or a category page in Google's results. More and more, it is an AI answer that pulls products from several stores into one response. Google's changes came in dated steps:

• May 2025. At I/O, Google introduced shopping in AI Mode, built on its Shopping Graph of more than 50 billion product listings, more than 2 billion of them refreshed every hour. AI Mode runs a query fan-out, several searches at once, to work out what matters for a request, then shows products that fit. A virtual try-on that uses the shopper's own photo went into Search Labs in the US.
• November 2025. Google expanded conversational shopping in AI Mode with comparison tables and review insights, brought shopping to the Gemini app for all US users, and began rolling out "Let Google Call", which phones nearby stores to ask about stock, price and promotions in categories such as toys, health and beauty, and electronics.
• January 2026. Google launched Business Agent, a branded chat agent that answers product questions on Search in the retailer's voice, and a Direct Offers pilot that shows advertisers' exclusive discounts inside AI Mode. It also announced dozens of new Merchant Center attributes for conversational shopping, such as answers to common product questions and compatible accessories.
• May 2026. The Shopping Graph passed 60 billion product listings, and Google said people shop across Google more than a billion times a day.
• September 2026. AI performance insights became generally available in Merchant Center in Australia, Canada, India, New Zealand and the US. It compares a brand's share of voice with similar brands on AI Mode and AI Overviews.

ChatGPT is the other large shopping surface. OpenAI said in September 2025 that more than 700 million people used ChatGPT each week, and that its product results are organic and unsponsored, ranked on relevance. In March 2026 it rolled out a more visual shopping experience, with side-by-side comparisons of price, reviews and features, to all Free, Go, Plus and Pro users. OpenAI's help centre says merchants are ranked on availability, price, quality and whether they are the maker or primary seller, using structured metadata from merchants and third-party providers.

What this changes for a store: shoppers often meet your price, stock, reviews and product facts before they see your page, and the AI system decides which of those facts to show. Our guide to how AI Overviews and AI Mode choose their sources covers the page side. The rest of this article covers the commerce side.

Agentic commerce: what is live and what is only announced

Agentic commerce means an AI agent completes part of a purchase for a person: it finds the product, fills the cart and, with the shopper's approval, pays. Since 2025 the largest AI platforms and both big card networks have each announced a protocol or a program for it. They are at very different stages, so here is where each one stood as of September 2026.

Two lessons stand out from the first year. The first is that checkout inside an AI surface has proved harder than discovery. OpenAI said the first version of Instant Checkout did not give merchants the flexibility it wanted, and moved to merchant-owned checkout; Shopify merchants' shoppers now complete the purchase in the merchant's own online store through an in-app browser. Google keeps both paths open: its Universal Cart, announced in May 2026 for a US rollout that summer, lets a shopper pay with Google Pay or transfer the cart to the merchant's site. The second lesson is that in both ACP and UCP the store stays the merchant of record. It accepts or declines the order, charges the payment and handles fulfilment and returns.

How an agent checkout works

The protocols differ in detail, but a purchase moves through the same four steps:

1. The agent picks products from product data. It reads feeds and catalogues: Google's Shopping Graph, or the feeds merchants share with OpenAI through ACP. In March 2026 UCP added a Catalog capability so agents can fetch real-time variants, inventory and prices, and a Cart capability for several items from one store.
2. The shopper approves. In OpenAI's design the user confirms each step before anything happens. AP2 records the approval as a signed Cart Mandate, a tamper-proof record of the exact items and price, and uses an Intent Mandate with price and timing limits when the shopper delegates a purchase in advance.
3. A scoped credential travels, not the card. With ACP, Stripe issues a Shared Payment Token scoped to one merchant and one cart total, so the agent never sees the buyer's card details. Mastercard's Agentic Tokens carry the permissions and limits the cardholder sets. Google's UCP checkout currently uses cards saved in Google Wallet, through Google Pay.
4. The merchant's own systems do the rest. The order reaches the merchant's back end through the protocol. The merchant accepts or declines it, charges through its existing payment provider, and ships, exactly as for a web order.

Two practical issues follow for a store. First, agents arrive as automated traffic, and bot defences built to stop scrapers can also block a legitimate buyer's agent. Visa's Trusted Agent Protocol, built with Cloudflare on the HTTP Message Signatures standard, lets approved agents sign their requests so merchants can tell them apart from malicious bots. Second, you do not have to implement every protocol yourself. Commerce platforms and payment providers are adopting them: Visa's Intelligent Commerce Connect, in pilot since April 2026, accepts agent payments made through Trusted Agent Protocol, ACP, UCP and the Machine Payments Protocol through one integration, and Google named Commerce Inc, Salesforce and Stripe as platforms that will implement UCP.

Why product data is now your storefront

Every surface above reads the same thing: structured product data. Google recommends two channels together. Product structured data on each product page helps Google read price, discount and shipping costs correctly, and helps Merchant Center check your feed against your site. A feed in Google Merchant Center tells Google about products its crawler might miss and lets you update prices and stock on your own schedule. Small stores that change rarely can let Merchant Center build an automated feed from crawled pages. Some surfaces, such as the Shopping tab, require Merchant Center.

The feed is also becoming the main input for AI features:

• Google's conversational attributes add context to listings for AI Mode. In Google's test with lululemon, attributes the brand submitted were used in 50% of relevant product recommendations in AI Mode.
• A UCP "Buy" button appears only on listings that carry the native_commerce attribute with checkout eligibility, according to Merchant Center help.
• OpenAI takes product feeds and promotions through ACP, directly or through providers such as Salesforce and Stripe (March 2026). Shopify merchants are already covered through Shopify Catalog, with no extra work; our Shopify SEO guide shows where those channel settings live.

One deadline has already passed. Google sunset the Content API for Shopping on August 18, 2026, and requests to it began failing progressively from September 1, 2026. If a plugin or custom script pushes your prices and stock to Merchant Center, confirm that it now uses the Merchant API.

The detailed work is in our e-commerce SEO guide: Product and Offer markup, variants, out-of-stock handling and the Merchant Center feed. The short version is that price, availability and shipping cost must match on the page, in the markup and in the feed. A mismatch that once cost one listing now travels to every surface that reads the feed.

Social and video commerce: selling inside the app

Social commerce is buying inside a social or video app, usually from a shoppable video or a livestream, without visiting the store's own site. It is growing along two lines:

• Shops inside the app. TikTok Shop lets people buy from shoppable videos and LIVE sessions without leaving TikTok. It expanded in Europe on June 15, 2026 to Austria, Belgium, the Netherlands and Poland, joining France, Germany, Ireland, Italy, Spain and the UK. TikTok says more than 100,000 European businesses joined in the markets it opened in late 2024 and early 2025.
• Creator affiliate programs that send buyers to your products. YouTube said in September 2026 that more than 1.3 million creators are in its Shopping affiliate program, which it is expanding to 35 countries by the end of 2026, and that US creators can now tag Amazon products.

The AI and video threads are merging. Google said in May 2026 that UCP checkout is coming to YouTube in the US, and that brands with UCP running Shopping ads on YouTube from their product feeds will let viewers buy on the spot. In September 2026 it opened a Business Agent beta for YouTube ads in the US, so viewers can ask product questions without leaving the video. For most stores the channel plan is the same as for search: one accurate catalogue, syndicated everywhere. The videos still have to be found, which our YouTube SEO guide covers.

Payments: tokens, passkeys, wallets and buy now, pay later rules

Checkout is moving away from a person typing a card number into a form. Three changes are under way, and most of them reach a store through its payment provider.

Tokens and passkeys replace typed card numbers

Mastercard's goal is to phase out manual card entry for e-commerce in Europe by 2030. In June 2026 it said three in five of its European e-commerce transactions were already tokenized, and that Click to Pay, its one-click checkout, was available in 32 European markets. Visa's Payment Passkey Service, announced in May 2024, is built on FIDO standards: the shopper authorizes a payment with a quick face or fingerprint scan instead of a password or one-time code, and Visa's first deployment is inside Click to Pay.

Wallets follow the same pattern. UCP checkout on Google runs on Google Pay, and Google said at Google Marketing Live in May 2026 that Affirm and Klarna buy now, pay later options were being built into Google Pay. For a store, the job is to switch on wallets, network tokens for stored cards and Click to Pay where your payment provider offers them, not to build any of it.

The payment page itself is in scope

PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 took effect on March 31, 2025. They require that scripts on payment pages are authorized, checked for integrity and monitored for tampering. The PCI Security Standards Council says e-skimming attacks, which steal card data through scripts running in shoppers' browsers, have increased significantly. Merchants that fully outsource card handling and validate with SAQ A no longer answer those two requirements, but must confirm that their site is not susceptible to attacks from scripts that could affect their e-commerce systems. Either way, keep an inventory of every script on your checkout pages and know who can change it. Our website security checklist covers the rest of the site.

Buy now, pay later is becoming regulated credit

Most obligations sit with the lender, but your checkout is where the offer appears. If you sell to UK or EU shoppers, review your BNPL provider's updated terms, and how its widget presents the credit, before November 20, 2026.

Headless and composable commerce, and when it is overkill

Headless commerce separates the storefront, the pages shoppers see, from the commerce engine that holds the catalogue, cart, checkout and orders. The two talk through APIs. Composable commerce goes further and assembles the engine itself from separate services (search, content, payments, promotions) joined by APIs. The industry shorthand for that style is MACH: microservices, API-first, cloud-native and headless.

Shopify's documentation shows the two common routes. Hydrogen, Shopify's headless framework, is built on React Router with server-side rendering and deploys to Oxygen, Shopify's edge hosting, at no extra cost. Or you bring your own stack, any framework and any host, and call Shopify's APIs; Storefront Web Components can even embed products in an existing site with a few lines of HTML.

When is headless overkill? When the reason is fashion rather than a constraint. If your theme passes Core Web Vitals on real phones, your team can publish without a developer, and you sell in one or two languages, a headless rebuild adds a second system to maintain without adding revenue. AI agents are not a reason either. OpenAI describes ACP as sending the order to the merchant's back end, and Google's Merchant Center help describes UCP as an exchange between the agent and the merchant's back end: both plug into your commerce engine and your product data, not your storefront templates.

Our web design and development team builds stores on Shopify, Shopify Hydrogen, WooCommerce, BigCommerce and Medusa, and will say so when a template is the right answer.

Customer data, privacy and accessibility rules to plan for

Rules on personal data decide what a store can measure and personalize, and accessibility law now reaches online shops too.

• Third-party cookies. Google decided in April 2025 to keep third-party cookie choice in Chrome's settings rather than roll out a new standalone prompt; Chrome's Incognito mode already blocks them by default. The cookie deadline many teams planned around is gone, but first-party data (accounts, orders, loyalty and consented analytics) is still the safer foundation, because it does not depend on a browser vendor's next decision.
• Consent for EEA visitors. If you measure or advertise to people in the European Economic Area with Google tags, Google requires you to collect consent and pass it through consent mode, including the ad_user_data and ad_personalization parameters, to keep measurement, ad personalization and remarketing working.
• Less data from agents. Agentic checkout shares less customer data by design. OpenAI says only the information needed to complete the order reaches the merchant, with the user's permission. UCP's Identity Linking lets a shopper signed in to your loyalty program keep member prices and free shipping on an AI surface. When the first touch happens elsewhere, accounts and loyalty are how a store keeps the relationship.
• Accessibility. The European Accessibility Act applies to e-commerce services provided to consumers after June 28, 2025. Microenterprises that provide services (fewer than 10 people and an annual turnover or balance sheet total of no more than EUR 2 million) are exempt; other businesses selling online to EU consumers must meet its requirements. Our WCAG compliance guide sets out the WCAG 2.2 AA process.

What a small online store should do this year

None of this needs a rebuild. For a store with a small team, the order of work in 2026 is:

1. Fix the product data first. Complete titles, descriptions, prices, availability, variants and shipping costs in a Merchant Center feed, with matching Product markup on every product page. Add Google's conversational attributes where your categories benefit.
2. Check the feed connection. If a plugin or script used the Content API for Shopping, confirm it moved to the Merchant API; the old API was sunset on August 18, 2026.
3. See how AI shows you. Ask AI Mode, Gemini and ChatGPT for your own products and categories, note wrong prices or missing items, and fix the data behind them. In Australia, Canada, India, New Zealand and the US, open AI performance insights in Merchant Center.
4. Decide on agent checkout deliberately. Shopify stores already reach ChatGPT through Shopify Catalog. For Google's UCP checkout, check the eligibility rules for your country and platform before you apply.
5. Let good agents in. Review bot rules in your firewall or CDN so they block scrapers without blocking signed, legitimate shopping agents.
6. Modernize the checkout through your payment provider. Turn on wallets, network tokens for stored cards, Click to Pay and passkeys where they are offered.
7. Lock down the payment page. Inventory every script on checkout pages and meet PCI DSS 6.4.3 and 11.6.1, or the SAQ A script eligibility criterion.
8. Review buy now, pay later. If you sell in the UK or the EU, read your provider's updated terms and check how the offer is presented before November 20, 2026.
9. Get consent right. Implement consent mode for EEA visitors, and build on first-party data rather than third-party cookies.
10. Keep the store fast and accessible. Hold Core Web Vitals in the "good" range on mobile (our mobile optimization guide covers how) and test against WCAG 2.2 AA. Unless you are a microenterprise, the European Accessibility Act already makes accessibility a legal requirement for selling online to EU consumers.
11. Stay on your theme unless a documented requirement forces headless. Spend the budget on data, speed and checkout first.

If you want help with the build, our web design and development work puts Core Web Vitals budgets and Schema.org structured data into every template. For product data and AI visibility, our SEO service covers product and merchant structured data, validated on every release, and tracks where AI answers cite you.