Universal Commerce Protocol: What Agentic Commerce Actually Shipped

ChatGPT's Instant Checkout was supposed to be the moment agentic commerce went mainstream. OpenAI started backing away from it after about five months.

Checkout inside an AI didn't die with it, though. It moved to Google. Since February 2026, US shoppers in Google's AI Mode and the Gemini app have been able to buy from Etsy and Wayfair without visiting either site. By May there was a Buy button in regular search results, and in June Australia became the first market outside the US to get it. That checkout runs on the Universal Commerce Protocol (UCP). The part of UCP you can see from the outside is a dull JSON file at a fixed URL on your store, usually written by your platform. If you're on Shopify, there's a good chance you already have one and never decided anything.

I wanted to know how far that file had actually spread, so on 23 October 2026 my research agent asked 14 storefronts for it. Nine served a valid profile. Target, Walmart, Best Buy and IKEA didn't, which is a bit awkward, because Target and Walmart helped develop the protocol and Best Buy publicly endorsed it.

So the useful question for a store owner isn't "how do I get ready for AI agents?" It's "can an agent read my catalogue today, and what does it find when it gets there?" You can answer the first half with two terminal commands. The second half is the actual work, and most of it is catalogue hygiene.

A quick definition, since the term gets stretched to cover pretty much anything with a chatbot near a shopping cart. Agentic commerce is shopping where an AI agent does some or all of what a person would normally do in a browser: find products, compare them, check stock and shipping, and sometimes pay. To do that reliably, the agent needs the store to describe itself in a format a machine can parse, and that's what protocols like UCP and ACP are for. I wrote the broader version in April, a developer's honest take on agentic commerce in 2026. This one is narrower: what the protocols actually shipped, and what a store serves when an agent comes asking.

What happened to ChatGPT Instant Checkout

Instant Checkout went live inside ChatGPT on 29 September 2025 (OpenAI). It ran on the Agentic Commerce Protocol (ACP), which OpenAI co-developed with Stripe. At launch it handled single-item purchases from US Etsy sellers, with over a million Shopify merchants announced as coming soon.

Then it quietly stopped mattering. The Information reported on 4 March 2026 (5 March here in Sydney) that OpenAI was scaling back its shopping plans. On 20 March CNBC reported that OpenAI was working with retailers on apps inside ChatGPT that send shoppers to the retailer's own site to pay (CNBC). That month Walmart's number did the rounds too: its in-ChatGPT checkout had converted three times worse than shoppers clicking through to walmart.com (Search Engine Land).

On 24 March OpenAI made it official. It published "Powering Product Discovery in ChatGPT", said Instant Checkout didn't give merchants the flexibility it wanted, and told TechCrunch it was deprioritising Instant Checkout as a standalone feature (TechCrunch). Merchants now use their own checkout. For Shopify stores, that's the store's normal checkout inside an in-app browser.

The title of OpenAI's post is the summary. Discovery, not checkout.

What is the Universal Commerce Protocol (UCP)?

UCP is an open standard Google announced at NRF on 11 January 2026. Google co-developed it with Shopify, Etsy, Wayfair, Target and Walmart, and more than 20 other companies endorsed it, including Best Buy, Stripe, Visa, Mastercard and The Home Depot (Google).

The mechanics are simple. A store publishes a profile at /.well-known/ucp, the standard spot for site-wide metadata defined in RFC 8615. An agent fetches it and learns which services the store offers, where to call them, and which payment handlers it accepts. The spec makes three members mandatory: ucp.version, ucp.services and ucp.payment_handlers. The services and payment handler registries have to be there even when they're empty. Services can be exposed over REST, MCP, A2A or an embedded binding. MCP is the one you'll see most, and every profile in my check uses it. If you've never looked inside an MCP server, I walked through how to build an MCP server with TypeScript.

The spec calls this "permissionless onboarding". Any platform that can find your profile can deal with your store without registering with you first. There's no sign-up form, and nothing in the mechanism asks the merchant a question. Keep that in mind, because it explains most of what I found.

Governance moved fast for a protocol announced in January. Google and Shopify are permanent members of the Governing Council, and Stripe joined them on 28 April 2026. Four days earlier the Tech Council grew to 16 seats, adding members from Amazon, Meta, Microsoft, Salesforce and Stripe (ucp.dev announcements). Stripe co-built ACP and now sits at UCP's top table too. Nobody said you had to pick one.

UCP vs ACP: what's the difference?

Both protocols let an agent talk to a store. Back in April I called this a protocol war in my take on agentic commerce. Six months on, it looks more like a division of labour: they come from different camps and, in October 2026, they do different jobs.

The ACP discovery file is optional, and the ACP spec says a 404 there means the seller doesn't support ACP. That doesn't make a store invisible to ChatGPT, though. OpenAI's March post says Shopify merchants are included in ChatGPT discovery through Shopify Catalog, so the product data travels platform to platform rather than through a file on your domain.

In short: ACP is how product feeds reach ChatGPT, and UCP is what Google's checkout runs on.

A timeline of agentic commerce, in order

Look at the shape of it. The headline launch, checkout inside ChatGPT, was scaled back inside six months. Underneath, the protocols kept shipping: four UCP releases, a discovery file for ACP, and a council with Amazon, Meta and Microsoft on it. Google went from announcing UCP to a Buy button in ordinary search results in under four months.

Checkout in chat didn't die. It changed landlords.

I checked 14 stores for a UCP profile

On 23 October 2026 my research agent sent one GET request to each of two paths, /.well-known/ucp and /.well-known/acp.json, on 15 storefronts. It used a descriptive user agent (biznez-research/1.0) and no retries. I've left one of the 15, a marketplace, out of this write-up, so the table shows 14.

Nine stores served a valid UCP profile, and all nine declared 2026-08-25, the current release. All nine point their MCP endpoint at {store}.myshopify.com/api/ucp/mcp. That hostname tells you who wrote the file, and it wasn't the merchant.

Four big retailers served nothing at /.well-known/ucp on their main consumer domain. Target, Walmart and Best Buy returned a 404. IKEA returned a 301 to an HTML page, which is a redirect to marketing copy, not a profile.

Being in the launch announcement clearly isn't the same as answering the URL. To be fair to the big three, I only checked the root of the domain shoppers use. I don't know whether Google's merchant integration reads that file or gets the same details through Merchant Center, and Wayfair, the co-developer whose checkout went live first, isn't in my sample. So read those 404s as "doesn't advertise a profile to any agent that asks", not "isn't doing UCP at all".

Bombas returned a 429 on both paths, so I counted it as neither. That's a hole in the data, not a result. A 429 on a single polite request is most likely a bot filter rather than a policy.

Bigger censuses than mine

My 14 stores are an illustration. Five dated censuses exist, and every one of them is bigger:

• UCP Checker, read on 23 October 2026 (Sydney time): 20,189 of the 25,099 stores it tracks publish a valid profile, 10,857 of them on Shopify and 7,399 on Wix. Of those valid profiles, 41.5% still declare the 8 April release, two months after 25 August replaced it.
• ARC, data as of 22 October 2026, CC-BY-4.0: 72.4% of 11,824 stores have a valid profile. ARC also tests whether creating a cart returns a checkout link, and 63.4% did.
• agenticcommerceprotocol.info, measured 9 September 2026 and published the next day: 64 of 500 merchants (250 French, 250 US) had a valid profile.
• neryn.pro, October 2026: 37 of 109 checkable stores had no profile. Neryn sells a Shopify app, so it has a horse in this race.
• Canlah AI on Zenodo, v1.0.0 dated 21 August 2026 and revised since: 25 of 47 reachable Chinese-origin DTC stores served a valid manifest, every one of them issued by Shopify.

The headline rates run from 13% to 80%, which tells you more about who's in each sample than about the protocol. The number I'd actually look at is UCP Checker's wider read of about 4.07 million ecommerce sites. Across all of them, 28.4% publish a valid profile, but only 3.3% of the top 10,000 by traffic do. By platform, it's 99.3% of Wix sites, 94.7% of Shopify sites, and 0% for WooCommerce, Squarespace and PrestaShop (UCP Checker stats).

Wix and Shopify publish the file for you. The other three don't.

Why your platform decides this, not you

Because UCP onboarding is permissionless, whoever controls /.well-known/ on your domain controls whether you have a profile. For most small stores, that's the platform.

Shopify's developer docs put the profile on every merchant storefront at {shop}.myshopify.com/.well-known/ucp (Shopify). When the 2026-08-25 release landed, Shopify's changelog said storefronts started advertising it with no configuration change needed (Shopify changelog). Shopify's Agentic Storefronts, which put products into ChatGPT, Google AI Mode, Copilot and more, are switched on automatically for eligible stores. And in September, Shopify merchants got word that eligible products were now included in Google's UCP-powered native checkout, with nothing to set up (Search Engine Roundtable).

Shopify doesn't define "eligible", and I couldn't find a page promising a profile for every store, so check yours rather than assume.

Wix is the odd one. I couldn't find Wix announcing or documenting UCP anywhere. Yet the two Wix profiles my agent pulled both point their REST and MCP endpoints at Wix's own API domain (wixapis.com), and both declare the 8 April release. That looks a lot like the platform publishing them. If it holds across all 7,399, it would also explain much of that 41.5% on the older version. Two profiles is an inference, not a finding.

So if your platform already writes the file, an app promising to "turn on agentic commerce" is selling you something you already have. If it doesn't (WooCommerce, Squarespace, most custom stacks), the file is three keys you could publish by hand. A profile that declares no services gives an agent nothing to act on, though, so a hand-built one is a starting point, not a fix. Wiring real services behind it, an MCP endpoint that answers catalogue, cart and checkout calls, is a proper build. It's the kind of AI agent development work I take on for custom stacks.

How to check if your store has a UCP profile

Two commands, from any terminal:

curl -s -o /dev/null -w '%{http_code}\n' https://yourstore.com/.well-known/ucp
curl -s https://yourstore.com/.well-known/ucp | jq '.ucp.version, (.ucp.services | keys), (.ucp.payment_handlers | keys)'

A 200 with JSON carrying a version, services and payment handlers means you're publishing a profile. A 404 means you aren't. A 301, or a 200 that returns HTML, means the path is falling through to a web page, so count it as a no, the way I did for IKEA. No jq installed? Swap the second command's ending for | head -c 300 and read the start of it.

Check the exact host your customers use, with and without www.. While editing this I re-checked Gymshark: gymshark.com served a valid profile, and www.gymshark.com returned a 404 from its headless front end. Same store, two answers.

For ACP, the path is /.well-known/acp.json. A 404 there is normal for a Shopify store, for the reason in the comparison above.

What to fix once an agent can read your store

Getting a profile is the easy part, and for most small stores it already happened. What the agent finds behind it is where stores actually differ.

Structure your product attributes

Each product has to resolve to variants with size, colour, material, availability and a price with a currency. If colour and size live in a sentence in the description instead of in variants, a machine has to guess. Guessing is how a catalogue gets skipped. It's the same lesson as context engineering for AI agents: the model is only as good as what you put in front of it.

In schema.org terms, that means a ProductGroup with hasVariant and variesBy, which is also what Google's product variant guidelines ask for. Colour, size and material are all valid variesBy values.

Here's what that looks like in practice. On 23 October 2026 my research agent read the schema.org data on twelve outerwear product pages, five at Fashion Nova and seven at Kith. The five Fashion Nova pages published colour as structure: Cream, Green, Burgundy, Leopard and so on, each a variant. The seven Kith pages published brand, name, offers, availability and a size list, and no colour field at all. Colour only existed inside the product name ("Beige", "Black", "Olive"), where a filter has to dig it out.

That's what those twelve pages published on that date, not a verdict on either retailer's whole catalogue. Both stores run the same UCP version on the same platform, and they'd still give an agent very different answers to "do you have this in burgundy?"

Reading pages like this at scale is its own problem. I wrote about it when I built an AI SEO agent in TypeScript with Claude, and if you're tempted to run one against your own catalogue, here's what an AI agent actually costs per month.

Make your policies parseable

Shipping cost, delivery time, returns window, who pays return postage. This is the cheapest work on the list, and it's the thing most often missing when an agent has to decide between your store and the next one.

Don't buy a switch

What I wouldn't do is pay for anything sold as a switch. Nothing I could find suggests a profile earns you ranking in AI answers. It's a yes or a no. Everything that varies between stores is the quality of the data behind it.

Where AI agents can actually buy today

As of 23 October 2026, an AI can complete a purchase without sending the shopper to the store's website in at least three places:

• Google AI Mode, the Gemini app and, since 5 May, regular Google Search, through UCP checkout and Google Pay, for eligible merchants (PYMNTS, PPC Land). Google's own merchant help page says the checkout happens on Google's surfaces while you stay the merchant of record.
• Microsoft Copilot, through Copilot Checkout with PayPal, Shopify and Stripe, since 8 January 2026 (Axios). Microsoft's merchant page says Shopify stores were enrolled automatically, and only English-language merchants selling to US buyers qualify.
• Perplexity, through Instant Buy with PayPal, launched on 25 November 2025 (PayPal). I couldn't find a 2026 update on it.

All three launched US-only, and Google is the one moving past it. In May it said UCP checkout would reach Canada and Australia "in the coming months", with the UK after that (Google). Australia came first: in mid-June it became Google's first Asia-Pacific market for UCP, with Bunnings, THE ICONIC, Kogan, Adore Beauty and Petbarn among the first retailers trialling single-item checkout in Search, AI Mode and Gemini (Ragtrader).

What hasn't crossed over yet is the automatic part. The September opt-in for Shopify stores covered US merchants selling to US customers (TechWyse). So if you sell from Australia on Shopify, as I do, Google's checkout is something the big retailers are trialling and you're probably not in yet. The profile is still how an agent reads your store in the meantime.

ChatGPT is now the odd one out. Shopify shoppers finish on the store's own checkout in an in-app browser, and Walmart's ChatGPT app takes them into a Walmart-run environment.

There's also a route that needs no protocol at all: general browser agents that read and click your normal web pages the way a person would. That's a different risk profile, especially on a logged-in account, which I dug into in my piece on the Claude Chrome extension.

On numbers, be careful what you're being shown. The only published figure I found for purchases completed inside a chat is Walmart's three-times-worse conversion, and that's one retailer on one surface that has since changed course. The figures you'll see more often measure something else. Adobe reported that AI-referred visits to US retail sites converted 60% better than other traffic in July 2026 Adobe's AI Traffic Trends Report, and Similarweb puts generative AI at 0.4% of retail ecommerce visits (Similarweb). Both count shoppers clicking through from an AI answer, not agents buying.

So if a vendor hands you a conversion percentage for "agentic commerce", ask what it counts: referrals, or orders an agent actually placed.

FAQ

Is agentic commerce live?

Partly, and mostly in the US. Machine-readable store data is live at scale, as the censuses show. Checkout inside an AI is live in Google AI Mode, Gemini, Google Search and Copilot for eligible US merchants. In Australia, a handful of big retailers have been trialling Google's checkout since June. ChatGPT stepped back from it in March 2026.

Do I need an app to get a UCP profile?

Probably not. A UCP profile is a JSON file at a fixed path, and on Shopify and Wix the platform already publishes it. If yours does, an app adds nothing. If it doesn't, an app is one route among several, and no app fixes the product data the agent reads next.

What's the difference between ACP and UCP?

ACP is OpenAI and Stripe's protocol. It launched with checkout inside ChatGPT and now mostly carries product feeds for ChatGPT's shopping results. UCP is Google's, co-developed with Shopify and big retailers, and it powers checkout in Google AI Mode, Gemini and Search. In my check, 9 of 14 stores served UCP and none of the 13 that answered served ACP.

Is UCP only for Shopify stores?

No. All nine stores in my table run on Shopify, but UCP Checker counts 7,399 valid profiles on Wix, plus smaller numbers on Salla, Shoptet, BigCommerce, Shopware and custom stacks. WooCommerce barely registers: 20 valid profiles out of 175 stores checked.

Can I opt out?

On Shopify, partly. Google's native checkout can be switched off under Sales channels > Agentic in the Shopify admin, and Shopify's help docs say you can block individual agentic channels. What you can't do is opt out of Shopify Catalog itself (Shopify Help Center).

Does a UCP profile help my store rank in AI search?

Not that anyone has shown. A profile makes your store readable by an agent. Whether the agent picks you depends on what it reads: attributes, prices, stock and policies.

The limits of this check

One day, 14 stores in the table, one request per path, no retries. That's a snapshot, not a census, and a single 429 shows how thin it is. Trust the censuses first, and use my table as the worked example that makes them concrete.

If your store answers with nothing, or answers with a profile and then hands an agent thin product data, that second half is the work I take on: catalogue and attribute structure, policy pages, and the data an agent reads once it's inside. If that sounds like your shop, here's the automation work I do. If you're an Australian retailer working out what Google's checkout means for you before it reaches stores your size, that's the kind of question I take on in AI consulting in Sydney. And if you're still deciding where agents fit in a small business at all, start with cutting through the AI agent hype for small business.

Checked on 23 October 2026. Every dated figure above carries its own date, because the UCP version, the release shares and the census counts all move, the live counters especially.