--- title: "Checkouts are for humans: where Shopify and Amazon draw the line on AI agents" description: "Shopify's robots.txt tells agents a person must review the order before payment. Amazon's terms now spell out how agents must identify themselves. A federal appeals court says the user is the one who shops. Part 5 of Who Keeps Score." section: Playbooks author: David Steel published: 2026-10-24T12:15:46.591Z url: https://www.sneeze.it/blog/checkouts-are-for-humans tags: ["who-keeps-score", "ai-agents", "checkout", "shopify", "amazon"] --- # Checkouts are for humans: where Shopify and Amazon draw the line on AI agents _Shopify's robots.txt tells agents a person must review the order before payment. Amazon's terms now spell out how agents must identify themselves. A federal appeals court says the user is the one who shops. Part 5 of Who Keeps Score._ Picture a new member joining your studio through her assistant. It found the intro offer, picked the 6am class she always takes, filled in her name and card, and is ready to press "Join." Should it be allowed to? Two of the largest commerce companies in the world have answered that question in writing, and their answers line up. Software can do the shopping. A person signs off on the purchase, and the agent has to say what it is. ## Shopify's sign at the checkout In July 2025, Shopify added a short block of comment text to the default robots.txt file that its stores serve. Modern Retail reported it on July 14, 2025. We found it still in place today, October 24, 2026, on a Shopify store we checked: ``` Robots & Agent policy Checkouts are for humans. * Automated scraping, "buy-for-me" agents, or any end-to-end flow that completes payment without a final human review step is not permitted. * Legitimate integrators must use the official Checkout Kit ``` Shopify's own engineer played it down at the time. Ilya Grigorik, a distinguished engineer at Shopify, said on X that the change "doesn't add or remove any rules for bots or agents," as reported by Modern Retail. It is a comment written for people who read robots.txt, pointing them to Shopify's official route for building checkouts. The wording has moved on since. Another Shopify store we checked today serves a newer version that points agents to Shopify's shopping tools instead of only warning them off. The principle stayed: ``` # Agents must: # - Identify agent-initiated requests ... # - Obtain buyer authorization, follow required review steps, and yield # to the buyer when a required shopping action is unsupported. ``` That store's agent instructions say it again in one line: "Place orders and submit payment only with the buyer's authorization." :::compare "Shopify, July 2025" "Shopify stores, October 2026" "Checkouts are for humans." Buy-for-me agents and any flow that pays "without a final human review step" are not permitted. Integrators are sent to Checkout Kit. --- Agents are invited in through Shopify's shopping tools, but must identify themselves, "obtain buyer authorization" and "follow required review steps." When a step needs the buyer, the agent hands it back. ::: ## Amazon's terms for agents Amazon took the same idea and made it a contract. Its Conditions of Use, last updated August 14, 2026, now include a section called "Agent Terms." It defines an agent as "any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity," and it sets out rules any agent must follow: :::stats 4 | technical rules Amazon now sets for any agent on its store Aug 14, 2026 | date Amazon's Conditions of Use were last updated Jul 2025 | Shopify adds "Checkouts are for humans" to its default robots.txt source: [Amazon Conditions of Use](https://www.amazon.com/gp/help/customer/display.html?nodeId=508088), read October 24, 2026; [Modern Retail](https://www.modernretail.co/technology/shopify-has-quietly-set-boundaries-for-buy-for-me-ai-bots-on-merchant-sites/), July 14, 2025 ::: The four rules, quoted from the terms: agents must identify themselves in every request with "Agent/[agent name]"; must not conceal that they are agents, "such as by (a) mimicking the speed or pattern of human keystrokes" or "(b) completing or circumventing CAPTCHAs"; must "respond truthfully" when asked whether they are human; and must not get around any measure meant to control them. Amazon also says that "at our sole discretion" it may limit how any agent uses its store. This is the same position Amazon took in public when it blocked Meta's Muse agent in September. Amazon spokesperson Lara Hendrickson told Bloomberg, as relayed by PPC Land, that agents "should operate openly and respect service provider decisions about whether or not to participate." Meta's position is that Muse "has no visibility into people's passwords or payment methods." ## What the court said about who shops Amazon's earlier attempt to stop an agent through federal anti-hacking law did not hold up on appeal. In Amazon v. Perplexity, the Ninth Circuit vacated a preliminary injunction against Perplexity's Comet browser on August 4, 2026, and the full court declined to rehear it on September 10. We covered the timeline in [Part 4](/blog/amazon-locks-out-ai-agents-but-not-googlebot). The line that matters for a checkout is how the court described the agent: :::pullquote However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. -- U.S. Court of Appeals for the Ninth Circuit, Amazon.com Services v. Perplexity AI, August 4, 2026 ::: In the court's reading, the customer is the one shopping, and the agent is the customer's tool. The court kept its ruling narrow: it covers "access" under the anti-hacking statutes, on that record, and says the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service." Taken together, the person is the buyer, the agent has to identify itself, and the store sets the terms. On Shopify, those terms include a human review before payment. The case itself is back in the district court, with nothing decided on the merits. This is not legal advice; it is our reading of public documents. :::figure wide ![A studio front counter where a small glowing magenta figure has placed a filled-in membership card and a pen, and a person's hand reaches in to sign the card while a brass bell sits beside it](/blog/media/5ff74eb0bf6c6a0695c8f308.jpg) The assistant can carry the card to the counter. The member still signs it. ::: ## Your join and booking flow A gym or med spa is not Amazon, and most of your customers do not have an agent yet. But the bookings you sell, a class pack, a first facial, an intro month, are small purchases an assistant could easily handle. Shopify's rule is simple to copy: let software do the legwork, and keep the final yes with a person. :::flow "A join flow that works with agents" Find | The assistant reads your schedule, prices and intro offer Fill | It enters the person's name, contact details and class choice Review | Your page shows a clear summary: what, when, how much, cancellation terms Confirm | The person taps yes, by text link, email link or on the page itself Record | Your system stores who joined, when, and how they arrived ::: That last step is easy to skip. If an assistant books the class and your system logs only "website," you lose the one thing you need to judge your marketing: where the member came from. Owning the record means the join lives in your booking or membership system with its source attached, not only in someone else's app. :::steps 1. Find your final step Walk through your own join and booking flow on a phone. Is there a summary screen before payment? Write down exactly what it shows. 2. Make the summary complete Price, start date, length of commitment, cancellation terms and the location, on one screen, in plain words. An agent will read it, and so will the person. 3. Keep a confirmation the person controls A tap on the summary page, or a confirmation link by text or email for anything recurring. Ask your booking platform what it supports. 4. Record the source Make sure every join stores how it arrived, including a field for "booked by an assistant" if your platform allows it. 5. Keep the record yourself Export new joins monthly from your own system and reconcile them against what any platform reports. ::: :::takeaways "What the checkout rule means for you" - Shopify's robots.txt has said "Checkouts are for humans" since July 2025; newer versions ask agents to "obtain buyer authorization." - Amazon's Conditions of Use, updated August 14, 2026, require agents to identify themselves and not pose as people. - The Ninth Circuit called an AI agent "a tool, not a person" and treated the user as the one accessing the store. The case is still open. - Keep a clear human confirmation step in your join and booking flow. - Own the record of who joined, and how they got there. ::: Next, in [Part 6](/blog/two-courts-found-google-broke-antitrust-law), we turn from agents to the courts: two federal judges, two monopoly findings against Google, and what the remedies did and did not change. For the measurement side of agent bookings, see [Measuring marketing when agents shop](/blog/measuring-marketing-when-agents-shop). :::cta button="Scan your website free" href="https://agentready.sneeze.it" Can an assistant reach your booking page and hand the final step back to your customer? Agent Ready checks your site in about a minute and lists every fix in order. ::: --- #### Sources - Modern Retail, Allison Smith, "Shopify has quietly set boundaries for 'buy-for-me' AI bots on merchant sites," July 14, 2025. [modernretail.co](https://www.modernretail.co/technology/shopify-has-quietly-set-boundaries-for-buy-for-me-ai-bots-on-merchant-sites/) - Shopify default robots.txt with the 2025 agent policy, as served by a Shopify store (Keychron), fetched October 24, 2026. [keychron.com](https://www.keychron.com/robots.txt) - Shopify default robots.txt and agent instructions, newer version, as served by a Shopify store (ColourPop), fetched October 24, 2026. [colourpop.com/robots.txt](https://www.colourpop.com/robots.txt) and [colourpop.com/agents.md](https://colourpop.com/agents.md) - Amazon, "Conditions of Use," last updated August 14, 2026, Agent Terms section. [amazon.com](https://www.amazon.com/gp/help/customer/display.html?nodeId=508088) - PPC Land, "Amazon blocks Meta's Muse AI agent from shopping on its site," September 2026, relaying Bloomberg. [ppc.land](https://ppc.land/amazon-blocks-metas-muse-ai-agent-from-shopping-on-its-site/) - U.S. Court of Appeals for the Ninth Circuit, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, opinion, August 4, 2026. [cdn.ca9.uscourts.gov](https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf) - U.S. Court of Appeals for the Ninth Circuit, order denying rehearing en banc, No. 26-1444, September 10, 2026, as posted by Courthouse News. [courthousenews.com](https://www.courthousenews.com/wp-content/uploads/2026/09/amazon-perplexity-no-rehearing.pdf)