Buying Through ChatGPT and Google: Preparing a Store for ACP, UCP and AP2
For two years the question about AI and ecommerce was whether chat interfaces would send traffic. That question is now secondary. The one that matters is whether an agent can complete a purchase from your catalogue without a human ever loading your storefront, and whether your store is technically capable of accepting that order.
Three protocols are being written to answer it, backed by nearly every company that matters in commerce. They are at different stages, they solve different layers, and they are not competitors in the way the coverage suggests. This is what each one actually requires from a merchant.
The three protocols side by side
| ACP | UCP | AP2 | |
|---|---|---|---|
| Full name | Agentic Commerce Protocol | Universal Commerce Protocol | Agent Payments Protocol |
| Behind it | OpenAI and Stripe as founding maintainers, Meta since added, Apache 2.0 | Governance council seating Google, Shopify and Stripe; shopping council including Amazon, Meta, Microsoft, Target, Etsy, Salesforce and Wayfair | Google, with an ecosystem spanning A2A, UCP and the FIDO Alliance |
| What it standardises | How an agent reads a catalogue, runs a checkout and takes a delegated payment | Interoperability between commerce systems as declarable capabilities | Proof that a human authorised what the agent is about to pay for |
| What a merchant exposes | A product feed, checkout endpoints per the checkout spec, and a payment provider implementing delegated payment | A capability profile declaring which of Checkout, Cart, Catalog, Identity Linking and Order it supports | Nothing directly; it constrains what the agent and the payment network exchange |
| Layer | Merchant to agent | System to system | Trust and authorisation |
| Status | Beta, dated revisions roughly every two months, live in ChatGPT | Published capabilities and extensions, formal governance in place | Version 0.2, open protocol, reference implementations |
ACP: what OpenAI and Stripe actually ask for
The OpenAI commerce documentation breaks the protocol into three specs. Merchants implement the Agentic Checkout Spec. Payment service providers implement the Delegated Payment Spec. And everyone supplies product data through the Product Feed Spec. The protocol’s own site describes it as an open standard for programmatic commerce flows between buyers, AI agents and businesses, community designed under the Apache 2.0 licence and compatible with both REST and MCP.
Two details are worth correcting, and the way they went wrong is the more useful lesson. Nearly every summary in circulation states that the feed accepts TSV, CSV, XML or JSON and can be refreshed every fifteen minutes. That was accurate in October 2025. It is not accurate now. The current file upload guidance reads: prefer parquet, ideally compressed, with jsonl.gz, csv.gz and tsv.gz also supported, and a recommended cadence of at least daily. XML and plain JSON are gone, and so is the fifteen-minute figure. A separate Google Merchant compatible path still accepts a UTF-8 tab-delimited .txt or .tsv file, or a comma-delimited .csv, with gzip variants.
ACP has shipped dated revisions roughly every six to eight weeks since Stripe and OpenAI published it on 29 September 2025. An integration plan written against a summary rather than against a dated spec version will be wrong within a quarter, and the parts that move are precisely the parts your data pipeline depends on.
The required fields are ordinary and that is the point: id, title, description, link, image link, availability, price, brand and seller name, plus two flags that decide whether an item is eligible for search and eligible for checkout. Conditionally, a GTIN or MPN. Any store with disciplined product data already has most of this. Any store where the product description lives in a PDF does not.
UCP: the one with the interesting membership list
UCP was announced by Google on 11 January 2026, co-developed with Shopify, Etsy, Wayfair, Target and Walmart and endorsed by more than twenty other companies. It is frequently misdated to Google’s May developer conference, which is where Universal Cart was launched; Universal Cart is the shopper-facing product and UCP is the plumbing underneath it.
UCP is worth understanding through its governance rather than its launch coverage. The published maintainers list seats Google, Shopify and Stripe on the governance council, with a shopping technical council drawing maintainers from Amazon, Meta, Microsoft, Target, Etsy, Salesforce and Wayfair, and a separate food council with Square, Toast, DoorDash and Uber Eats. That is not a vendor initiative; it is most of the demand side and most of the supply side in one room.
The specification repository describes UCP as an open standard for interoperability between commerce entities, structured as Capabilities (Checkout, Cart, Catalog, Identity Linking, Order) and Extensions (Discounts, Fulfillment), and transport agnostic across REST, MCP and A2A. The merchant-facing consequence is a design decision rather than an integration: a business declares which capabilities it supports through a standardised profile, and platforms discover and configure themselves against that declaration. You are publishing a contract about what your store can do, not writing a bespoke integration per agent.
AP2: the layer that decides whether anyone gets sued
The awkward question in agentic commerce is who is liable when an agent buys the wrong thing. AP2, published by Google on 16 September 2025 and now at version 0.2, is the attempt to answer it with cryptography rather than terms and conditions.
Here the version most people are working from is out of date, so check before you build. At launch AP2 defined three mandates: an Intent Mandate, a Cart Mandate and a Payment Mandate. The current specification defines two, a Checkout Mandate and a Payment Mandate, each in an open and a closed form depending on whether the user was present at the moment of purchase. Intent and Cart no longer exist as objects in the specification.
One correction is worth making firmly, because it is repeated almost universally. These mandates are not W3C Verifiable Credentials, and they never were. AP2 has called them verifiable digital credentials since launch, and the current specification states plainly that it uses SD-JWT, an IETF construct, to secure the Checkout and Payment mandates. If a vendor tells you their integration is built on W3C VCs, they have read a summary rather than the spec.
The stewardship has moved as well. In April 2026 Google donated AP2 to the FIDO Alliance, where it continues as a community-led standard rather than a single vendor’s project. The original announcement named more than sixty participating organisations, including Mastercard, American Express, PayPal, Adyen and Worldpay.
For a merchant, AP2 is mostly something that happens to you rather than something you implement. Its practical importance is that it is the mechanism by which an agent-initiated order arrives with evidence attached, which is what makes acquirers and card networks willing to process it at all.
Where the platforms already are
Shopify’s Spring ’26 edition, released on 17 June 2026 under the name Everywhere, makes the direction explicit. It ships a Catalog API described as product data structured for agents, adds UCP support for checkout on additional surfaces, and puts Shop Pay inside AI channels so a purchase can complete in the conversation. Shopify’s developer announcement is blunter still: catalogue access takes an API key and no approval, and UCP is described as the standard Shopify co-developed with Google. Whatever you think of the marketing, a platform serving a large share of the market has decided this is table stakes, and merchants elsewhere will be asked why they cannot do the same.
What is actually worth doing this quarter
| Work | Why now | Cost if you delay |
|---|---|---|
| Clean the product data to feed-spec field level | Every protocol reads the same fields; none of them can invent a missing GTIN | High. This is slow, manual and cannot be rushed at launch |
| Publish a machine-readable feed | Useful for ads, marketplaces and agents simultaneously | Low, but it gates everything else |
| Correct structured data on product pages | Price, availability and reviews are what gets quoted back | Moderate. See our guide to what to mark up with Schema.org |
| Make stock and price truthful in real time | An agent that sells an out-of-stock item creates a chargeback, not a sale | High. Usually an integration problem, not a website one |
| Separate AI referrals in analytics | You cannot manage a channel you cannot see | Low, and it is the only way to know when this becomes real |
| Implement checkout endpoints | Only once the four rows above are done | Low today. This is the last step, not the first |
The unglamorous truth is that four of those six rows are ordinary data and integration hygiene that pays off regardless of whether agentic commerce arrives on schedule. Stock accuracy across a website, a warehouse system and an accounting system is the same problem it was five years ago, and we wrote it up in our piece on connecting a website to a CRM and warehouse. The protocols just raised the penalty for getting it wrong, because a human buyer forgives a stale stock figure and an automated one files a dispute.
What this does not justify yet
Adobe’s Digital Insights team reported in April 2026 that traffic from AI sources to US retail sites grew 393% year on year across the first quarter of 2026, and that in March 2026 that traffic converted 42% better than non-AI channels such as paid search and email, a reversal from converting 38% worse a year earlier. Those are vendor figures drawn from Adobe Analytics customers and should always carry that attribution; Adobe’s own summary of the analysis describes triple-digit growth and consistently better engagement and conversion, across more than a trillion visits, without claiming the volume is large.
And the volume is the point. Measured share of visits from AI sources is still around half a percent on the independent datasets, which we went through in detail in what actually happened to ecommerce in 2026. A very high growth rate on a very small base is a reason to prepare cheaply, not a reason to reallocate a budget. The same discipline applies to the search side of this shift, covered in our piece on what zero-click search means for organic traffic.
The failure mode to avoid is treating this as a marketing project. Nothing in ACP, UCP or AP2 is a campaign. It is catalogue quality, inventory truth, a checkout that a third party can drive, and analytics that can see what happened. Our broader look at which ecommerce trends actually affect sales makes the same distinction across a wider set of fashions.
The short version
ACP is the merchant-facing one: a feed, a checkout endpoint and a payment provider, open sourced by OpenAI and Stripe under Apache 2.0. UCP is the interoperability layer, governed by Google, Shopify and Stripe with most of the industry on its technical councils, and it asks you to declare capabilities rather than build integrations. AP2 is the trust layer, now at version 0.2 with Checkout and Payment mandates secured as verifiable digital credentials, donated to the FIDO Alliance, and it mostly happens around you rather than to you. Shopify’s Spring ’26 edition already ships a Catalog API and UCP support.
Three claims in wide circulation did not survive checking. The XML and JSON feed formats and the fifteen-minute refresh were real in October 2025 and have since been replaced by parquet and a daily cadence. AP2’s mandates were never W3C Verifiable Credentials. And UCP was announced in January 2026, not at Google’s May developer conference. Read dated specs, not summaries.
The work that pays regardless is product data, real stock, and a checkout an outside system can complete without a person. That is ordinary ecommerce engineering, and it is what we do when we build and rebuild online stores.
