From Anker SOLIX to xTool — the brands above already see how ChatGPT, Gemini and Perplexity mention, cite and recommend them. Your brand is being talked about in AI right now. See it.
ACP vs UCP vs AP2: Agentic Commerce Protocols Guide 2026 | GEOly | GEO/AEO Platform for DTC Brands
ACP vs UCP vs AP2: Agentic Commerce Protocols Explained for Brands (2026)
Summary
ACP, UCP, and AP2 solve different layers of agentic commerce — and after OpenAI's checkout retreat, the discovery layer (whether AI recommends you at all) is where brands win or lose.
2026/08/24
14 min read
In under a year, agentic commerce went from demo to infrastructure. OpenAI and Stripe shipped the Agentic Commerce Protocol (ACP) in September 2025, Google answered with the Universal Commerce Protocol (UCP) at NRF in January 2026, and Google's Agent Payments Protocol (AP2) is now governed by the FIDO Alliance. Meanwhile, Shopify quietly turned millions of US storefronts into agent-readable endpoints, and Microsoft launched checkout inside Copilot.
If you run marketing or ecommerce for a brand, the acronym soup is genuinely confusing — and most explainers come from vendors selling one side of the stack. This guide is the neutral version: what each protocol actually standardizes, where it sits in the stack, what shipped as of August 2026, and what you should do about it.
Key Takeaways
ACP, UCP, and AP2 are not competitors on the same layer. ACP standardizes agent-driven checkout, UCP spans the full shopping journey across Google surfaces, and AP2 handles payment authorization and trust. Most brands will eventually touch more than one.
OpenAI reversed course in March 2026, pulling back from Instant Checkout toward AI-powered discovery that hands shoppers to merchant sites — a shift confirmed by CNBC reporting.
That reversal raised the value of the discovery layer. If checkout returns to your own site, the battleground moves upstream: whether AI engines find, trust, and recommend your products at all.
The lowest-effort, highest-leverage work is agent readiness: clean product feeds, schema.org structured data, MCP-accessible content, and monitoring of how AI engines describe and recommend your brand.
Why protocols suddenly matter
Through 2024, "AI shopping" mostly meant chatbots summarizing product reviews. Two things changed in 2025: AI assistants gained real traffic — Visa reports AI-driven traffic to US retail sites surged over 4,700% in a year — and the platforms decided ad-hoc scraping and one-off integrations wouldn't scale. When an agent selects products, fills a cart, and pays, every party needs machine-readable answers to questions humans resolve implicitly: What exactly is for sale? Is this agent legitimate? Did the human authorize this charge? Who is the merchant of record?
Protocols are how the industry is answering those questions — in public, on GitHub, mostly under Apache 2.0 licenses. Because each solves a different question, the cleanest mental model is a stack with four layers: content access, commerce data, checkout, and payments/trust.
Layer 1: Discovery and content access — MCP and NLWeb
Before an agent can buy anything, it has to read your content. Two open projects define how.
The Model Context Protocol (MCP), introduced by Anthropic in late 2024, is the general-purpose standard for connecting AI models to external tools and data sources. It has become the de facto plumbing of the agentic web: Shopify exposes storefront data through MCP servers, and most agent frameworks speak it natively.
NLWeb, an open project Microsoft announced in May 2025, sits one level up: it lets any website offer a natural-language query interface over its own content, built on schema.org markup — and every NLWeb instance is also an MCP server, making your site's content directly queryable by agents rather than merely scrapeable.
Neither project handles transactions. But they determine whether agents can access accurate first-party information about your products, which is the raw material for everything downstream. This is also the layer where Generative Engine Optimization lives: structured, verifiable, agent-accessible content is what gets you cited and recommended.
Layer 2: Commerce data — catalogs, feeds, and merchant programs
Agents don't browse product pages the way humans do; they consume structured catalogs. In 2025–2026 every major platform built a feed-ingestion pipeline:
Shopify Catalog and Agentic Storefronts. Shopify announced Agentic Storefronts as the way its merchants "sell everywhere AI conversations happen," then in March 2026 flipped them on by default for eligible US-selling merchants — making millions of stores discoverable inside ChatGPT and Microsoft Copilot, with Google's AI Mode and the Gemini app available to select US shops, all managed from a new agentic section of the admin (Shopify Help Center).
Perplexity's Merchant Program. Perplexity invites merchants to share product data to improve how their products surface in its shopping experience, alongside its Buy with Pro checkout; in November 2025 PayPal and Perplexity launched Instant Buy to extend agentic checkout to US users.
PayPal Store Sync. Part of PayPal's Agentic Commerce Services (October 2025), Store Sync pushes a merchant's product data into AI channels through a single integration, with order drop-through to existing fulfillment systems.
The pattern: a clean, current, structured product feed now controls how you appear across every agent surface. Stale or thin feed data means invisibility by default.
Layer 3: Checkout — ACP and UCP
This is where the two headline protocols live, and where the most strategic drama has played out.
ACP: the Agentic Commerce Protocol (OpenAI + Stripe)
ACP is an open standard — Apache 2.0, maintained by OpenAI and Stripe on GitHub — that defines how an AI agent and a merchant's backend communicate to complete a purchase: cart creation and updates, fulfillment options, order state, and delegated payment. It launched on September 29, 2025 as the machinery behind Instant Checkout in ChatGPT, which let US users buy from Etsy sellers (with Shopify merchants announced as coming next) without leaving the chat. Stripe's design goal, per its engineering blog, was that merchants remain the merchant of record and keep their existing payment processor.
The critical nuance for 2026: ACP the protocol survived, but Instant Checkout — the in-chat buying experience built on it — did not survive in its original form (more on that below).
UCP: the Universal Commerce Protocol (Google + Shopify)
Google's answer arrived at NRF on January 11, 2026, when Sundar Pichai announced UCP: an open protocol "built together with industry leaders Shopify, Etsy, Wayfair, Target and Walmart, and endorsed by 20+ more," designed to link merchants, payment providers, and AI platforms across the full shopping journey — discovery, loyalty, and checkout — not just the final transaction. Like ACP, the spec is public on GitHub under Apache 2.0.
UCP is already wired into Google's consumer surfaces. At I/O in May 2026, Google introduced Universal Cart, an agentic shopping experience in Search's AI Mode and the Gemini app that assembles items from multiple merchants into one cart, tracks prices and restocks, and — per TechCrunch — begins rolling out in the US in summer 2026, with YouTube and Gmail integration to follow.
ACP and UCP genuinely overlap on checkout, which is why the market reads them as rivals. The practical difference in August 2026: ACP is a lean checkout spec with OpenAI's distribution behind it; UCP is a broader journey-level standard with Google's surfaces and Shopify's merchant base behind it. Notably, Shopify backs both. If you want the deeper picture of how ChatGPT specifically decides which products to surface, see our ChatGPT AEO guide.
The adjacent checkout surfaces
Two more checkout endpoints matter even though they aren't protocols themselves. Microsoft's Copilot Checkout launched January 8, 2026 in the US with PayPal, Shopify, and Stripe as launch partners — merchants remain the merchant of record, and Shopify merchants were included automatically. And Stripe packaged its ACP tooling into an Agentic Commerce Suite in December 2025, including Shared Payment Tokens that let an agent hand a merchant a payment credential scoped to a specific merchant and cart — the buyer's card number never touches the AI platform.
Layer 4: Payments and trust — AP2 and the card networks
Checkout protocols move the order; a separate set of rails answers the harder question of authorization: how does anyone prove the human actually approved this?
AP2: the Agent Payments Protocol
Google announced AP2 on September 16, 2025 with more than 60 payments and technology partners, including Mastercard, PayPal, American Express, and Coinbase. Its core mechanism is cryptographic Mandates — tamper-evident, signed digital contracts (implemented as verifiable credentials) covering the user's intent, the final cart, and the payment itself. That produces a non-repudiable audit trail for both "human present" purchases and delegated ones, and it's designed to be payment-method-agnostic, from cards to stablecoins (AP2 documentation).
In 2026 AP2 made two moves that signal it's becoming the trust layer rather than a Google product. Google donated AP2 to the FIDO Alliance — the body behind passkeys — for open, industry-neutral governance, a transfer joined by roughly 60 organizations. And the v0.2 release added Human Not Present transactions (an agent completing a pre-authorized purchase while you sleep — think restock drops) plus Verifiable Intent, co-developed with Mastercard.
Card network and PSP rails
Visa launched Intelligent Commerce in April 2025 and followed with the Trusted Agent Protocol in October 2025, developed with Cloudflare: a framework built on HTTP Message Signatures that lets merchants distinguish trusted AI agents from malicious bots at the front door, with minimal changes to existing checkout pages.
Mastercard unveiled Agent Pay in April 2025, introducing Agentic Tokens — an extension of its proven tokenization stack that binds a payment credential to a specific, verified agent.
The good news: this layer is mostly your payment provider's problem. Your job is knowing which rails your PSP supports — and not blocking legitimate, credentialed agents with blunt bot defenses.
Anthropic (MCP); Microsoft-initiated open project (NLWeb)
Discovery / content access
How agents query tools, data, and website content (schema.org-based)
De facto standard (MCP); NLWeb instances double as MCP servers
Add schema.org markup; consider an MCP/NLWeb endpoint for content
What the OpenAI checkout retreat means
Here is the strategic event of 2026 that most protocol explainers gloss over. OpenAI launched Instant Checkout in September 2025 as the flagship proof of ACP. By March 2026, it had pulled back: CNBC reported on March 24 that OpenAI revamped ChatGPT shopping after Instant Checkout struggled, shifting toward AI-powered product discovery with retailers like Target, Sephora, and Nordstrom — where the purchase completes on the merchant's site.
The reported reasons are instructive. Per Forbes' analysis, Walmart found in-chat checkout converted roughly three times worse than a click-through to walmart.com — even though ChatGPT referrals brought about twice the new-customer rate of search engines — and by February 2026 only around 30 Shopify merchants were live on Instant Checkout, per Forrester. The feature also launched with real operational gaps, from single-item purchases to unfinished sales-tax handling.
Three takeaways for brands:
Discovery-layer value went up, not down. The scarce asset was never checkout plumbing — it's the recommendation slot. When an agent narrows 40 options to 3, being one of the 3 is the whole game. That's a Generative Engine Optimization problem: the content, citations, and structured data that make AI engines trust and surface your brand. Understanding which sources AI engines actually cite in your category is now competitive intelligence, not curiosity.
Checkout returns to territory you control. "Discover in AI, buy on your site" preserves your conversion stack, your first-party data, and your post-purchase relationship. The merchants hurt most in an agentic world are those who never appear in the AI answer at all.
Protocols outlive products. ACP didn't die with Instant Checkout — Microsoft, Stripe, and others continue building on it, and UCP-powered Universal Cart proves platforms will keep trying in-surface checkout where the economics work. Bet on the standards, not on any single buying surface.
The uncomfortable question this raises: do you actually know what ChatGPT, Gemini, Perplexity, and Copilot say when a shopper asks for "the best [your category]"? Most brands don't. GEOly tracks whether AI engines recommend your products — and how they describe your brand — across the major assistants, so you can see where you stand at the discovery layer before agents ever reach a checkout API. That's the layer where agentic commerce is currently won.
Agent-readiness checklist for brands
You don't need to implement six protocols this quarter. Work down this list in order:
Fix your product feed first. Complete titles, current prices, real-time availability, GTINs, shipping and returns data. Every agent surface — Shopify Catalog, Perplexity's merchant program, PayPal Store Sync, Google — consumes feeds; feed quality is now conversion infrastructure.
Ship schema.org structured data everywhere.Product, Offer, AggregateRating, FAQPage, Organization. Both NLWeb and Google's shopping surfaces lean on schema markup as the semantic layer agents read.
If you're on Shopify, audit — don't assume. Agentic Storefronts are on by default for eligible US-selling merchants; check the agentic section of your admin to confirm which channels (ChatGPT, Copilot, Google) are live and how products render (setup guide).
Expose content through MCP or NLWeb so agents can query your sizing guides, compatibility info, and policies directly instead of hallucinating them.
Don't block good agents. Review your bot-management rules against Visa's Trusted Agent Protocol and legitimate agent signatures; blanket bot-blocking now blocks revenue.
Ask your PSP where they stand on ACP, AP2 Mandates, Shared Payment Tokens, and agentic tokens — this layer should cost you a conversation, not an engineering sprint.
Monitor your AI visibility continuously. Track which prompts surface your brand, which competitors own the recommendation slots, and which sources engines cite. Map your category's real buyer prompts with our free AI prompt generator, then measure your share of AI recommendations over time.
FAQ
Are ACP and UCP competing standards?
Partially. Both are Apache 2.0 open standards that cover agent-driven checkout — but UCP is scoped to the whole shopping journey across Google surfaces, while ACP is a focused checkout spec. Shopify co-developed UCP and supports ACP-based surfaces: platforms expect to speak both, and merchants mostly inherit support through their commerce platform and PSP rather than choosing sides.
Is ChatGPT Instant Checkout dead?
The original in-chat, single-item Instant Checkout experience was pulled back in early 2026; CNBC reported OpenAI's shift to a discovery experience that hands shoppers to merchant sites to complete purchase. The underlying ACP standard remains live and maintained, and other surfaces (Microsoft Copilot Checkout, Perplexity Instant Buy) continue to offer in-assistant purchasing.
What does AP2 actually do that ACP doesn't?
ACP moves the order between agent and merchant; AP2 proves authorization. Its signed Intent, Cart, and Payment Mandates give merchants, issuers, and networks cryptographic evidence of what the user approved — which is what makes delegated, "Human Not Present" purchases and dispute resolution workable. They're complementary layers, and AP2's donation to the FIDO Alliance positions it as neutral infrastructure.
Do small brands need to integrate any of this directly?
Mostly no. If you're on Shopify, discovery and checkout surfaces arrive through Agentic Storefronts automatically; if you use Stripe or PayPal, agentic payments arrive through theirsuites. Your direct work is feed quality, structured data, and AI visibility — the parts no platform does for you.
How do I know if AI agents are recommending my products?
Ask the engines systematically: run real buyer prompts across ChatGPT, Gemini, Perplexity, and Copilot, log which brands and sources appear, and repeat on a schedule — one-off spot checks mislead because answers vary. This is what AI visibility platforms automate; see how GEOly compares to other tools on our alternatives pages.
Does traditional SEO still matter in agentic commerce?
Yes — it's the substrate. Agents ground recommendations in crawlable, structured, authoritative web content, and the discovery experiences that survived 2026 draw heavily on the same signals search does. GEO extends SEO rather than replacing it: same foundation, new success metric — share of AI recommendations instead of blue-link rank. Our GEO Academy covers how the two fit together.
