AI Agents Taking Over The Buying Role

AI-powered consumer agents that can independently research, compare and order products on behalf of customers are raising serious legal and privacy questions.

While AI-assisted chat advice is already relatively common in online shopping, providers are steadily expanding their agents to cover the shopping itself — all based on customer specifications, but ultimately carried out autonomously.

Amazon, for example, is moving in this direction with Alexa for Shopping (formerly Rufus). And Google recently announced at its I/O developer conference an AI agent that can not only place products from multiple platforms into a single shopping basket, but also make payments on the user's behalf.

When AI-controlled software agents act independently on behalf of individuals or companies — making decisions and even processing purchases and payments — it raises a host of questions. Chief among them: is it actually legal?

Even though the first pilot schemes for fully autonomous AI shopping, including payment, are currently limited to the US, so-called agentic commerce is likely already legally permissible in many countries. However legal experts say there are many unresolved and legally complex questions around liability, contract law, consumer protection and payments.

One thing is clear: the more rights and autonomy AI assistants are given when shopping, the more problematic their use becomes. Critics are therefore calling for decisions to always remain with the human.

Experts at German tech magazine C't experts identify three risk areas around AI shopping agents:

1. Unresolved legal questions
   Who is liable if the AI orders the wrong product or falls for a fraudulent shop?
2. Technology vulnerable to manipulation
   Particularly problematic are the extensive permissions that agents require — such as access to emails, payment systems, calendars or online storage. If those permissions are too broad, a compromised agent could cause significant harm through unwanted purchases, or follow hidden buying instructions on manipulated websites such as fake shops.
3. Data protection problems
   To function effectively, AI agents require extensive information about preferences, context and purchase history.
   This is difficult to reconcile with GDPR principles such as data minimisation, transparency and purpose limitation. Retailers could also use the data to build psychological user profiles and exploit them for price discrimination.
   Consumers should remain sceptical of AI shopping assistants and follow these principles, c't advises:
   • Always confirm purchases manually.
   • Never grant full access to bank accounts.
   • Set spending limits.