AI Shopping Assistants Are Already Talking to Your Customers: Is Your Consent Framework Keeping Up?

Somewhere between a shopper typing "best deals on running shoes" into an AI assistant and that shopper landing on your product page, an agent has already looked at your site, decided if it's relevant, and made a recommendation. None of that happened through a search results page or a social feed you have any visibility into.

The Discovery Channel Retailers Don't Control

AI-referred traffic converts at roughly eight times the rate of social-referred traffic, per Salesforce’s 2025 holiday shopping data. A Numerator “Verified Voices” survey surfaced that 22 percent of consumers said they planned to use AI-powered tools or features to shop Prime Day 2026 deals, with another 15 percent unsure. Whatever the numbers have been, by Black Friday, they’ll be higher.

That's a real shift in where the shopping journey starts. It doesn't change where the retailer's consent obligations begin. The moment that an AI-referred visitor lands on-site, the same data collection and disclosure rules apply as they do for anyone arriving from a search ad. The entry point moved, but the compliance responsibility didn't.

Consumers Are Already Deciding What They'll Let AI Touch

The 2026 State of Digital Trust Report from Usercentrics, Cookiebot's parent company, is based on a survey of 11,000 consumers, and found (unsurprisingly) that comfort with AI access isn't uniform. It depends heavily on what's being accessed. 

Consumers are most comfortable with AI assistants handling work tools (49 percent) and least comfortable with AI accessing financial accounts (37 percent). Nearly a quarter (23 percent) said they'd only allow AI access if they could approve each request individually, and just 8 percent are fully comfortable with AI access without any conditions attached. 

Another 17 percent described themselves as uncomfortable but willing to allow it anyway, a pattern researchers call resigned consent.

Shopping sits somewhere in that spectrum. It touches purchase history, saved payment methods, and increasingly, an agent acting on a customer's behalf without a human clicking "buy" directly. 

Retailers have no current benchmark for where their own AI-driven personalization and recommendation features fall on that comfort scale, because almost nobody is asking shoppers the question yet.

The Governance Gap Nobody's Filled Yet

What part is worth sitting with most right now? That no statute currently requires a specific consent standard for what an AI shopping agent can see or do with a customer's data. That is not a loophole to exploit. 

However, it is a gap that's going to close, the same way GPC recognition went from best practice to statutory requirement in a dozen states within a few years.

The consent standards required by U.S. state laws in recent years, and to which retailers have built, are designed around a human clicking a banner. They weren't designed around an agent accessing product data, pricing, and potentially a customer's stored preferences on that customer's behalf, at a speed and scale no human interaction resembles. 

Extending the same principle, clear disclosure, real control, no dark patterns, to what an AI agent can access is a reasonable next step even without a law consistently requiring it yet.

What This Actually Means Right Now

This isn't a call to build an AI-agent compliance program overnight. Nothing currently mandates one. But it is a case for treating this as a question worth asking before it becomes one you're forced to answer under pressure.

What data can an AI agent representing your customer actually see when it interacts with your site? What data does your own AI-driven personalization send back out? Who's actually looking at that path today?

Retailers that start mapping this now, ahead of a wave of AI-mediated Black Friday and holiday shopping, are the ones who won't be improvising an answer when a customer, or a regulator, asks for one.