The Agent Economy: Bots, Brands and Buyers in 2026

1. The state of online consumerism

This report is about three things that collided in 2026: the way people buy online, the way they check what they buy, and the arrival of software agents that buy on their behalf. We publish product reviews for a living, so we have a stake in all three, and we have a small but unusual dataset: who clicks our affiliate links, what they searched to find us, and what the brands we review do at checkout. We have combined that data with public figures from the Census Bureau, the Federal Reserve, the FTC, Adobe, Salesforce, Cloudflare and others. TopCrate is reader-supported and may earn an affiliate commission on purchases made through its links.

Start with the size of the market. US e-commerce reached $340.2 billion in the second quarter of 2026, up 12.2% from a year earlier, and accounted for 17.1% of all retail sales ^[1]. The 2026 holiday forecasts assume that share keeps rising. Deloitte expects total holiday retail sales of $1.70 trillion to $1.71 trillion for November 2026 through January 2027, growth of 4.0% to 4.8%, with e-commerce rising faster at 7.5% to 8.4% to between $316.1 billion and $318.9 billion ^[2]. Adobe, which measures online transactions directly rather than surveying retailers, forecasts $275.1 billion in US online holiday sales for November 1 to December 31, up 6.7% ^[3]. The two forecasts differ in scope and window, not in direction.

The 2025 season set the baseline. NRF reported that holiday sales from November 1 through December 31, 2025 grew 4.1% and crossed $1 trillion for the first time ^[7]. Shoppers nonetheless told Deloitte they planned to spend less: an average of $1,595 per person for 2025, down 10% from 2024 ^[8]. They also planned to buy 56% of their gifts online and 44% in stores ^[9]. The result was a record season funded by more people spending more cautiously.

The phone is where most of that money moves. Adobe expects 57.4% of online holiday spend to come through mobile devices in 2026, rising to 63% on Thanksgiving Day ^[3]. Mobile checkout favours whatever is fastest, and the fastest option is increasingly a deferred one. Adobe forecasts $21.3 billion in buy now, pay later spend for November and December, up 6.6% ^[3]. The Federal Reserve found that 16% of US adults used BNPL in the prior 12 months, up from 10% in 2021, and that slightly more than a quarter of those users were late making a payment ^[4]. Eleven percent of BNPL users had a BNPL payment trigger an overdraft or non-sufficient-funds fee in the prior year ^[5].

A large share of what is bought comes back. Retailers told NRF and Happy Returns that 15.8% of 2025 sales would be returned, a total of $849.9 billion, down from 16.9% and $890 billion in 2024 ^[6]. Online returns run higher, at an estimated 19.3% of online sales ^[6]. Nearly one in five online orders coming back is the context for every claim in this report about pricing, guarantees and reviews. The online buyer is guessing more often than the in-store buyer, and knows it.

Subscriptions complete the picture of a consumer who pays in instalments for things that may not stay. Deloitte finds 90% of US households hold a paid streaming subscription, averaging four services, and 41% cancelled one in the last six months, with 22% cancelling and then returning to the same service ^[14]. We raise streaming not because we review it but because the same churn-and-return pattern now shows up in physical goods sold on auto-renew, which we cover in section 3.

2. How people actually shop: the research ritual

The dominant behaviour before an online purchase is checking. Bazaarvoice's 2026 Shopper Experience Index found 97% of shoppers consult multiple sources before buying; 60% want two or three sources and 37% want four or more ^[10]. A Clutch survey of 400 US consumers in February 2026 put the share who check reviews before a first-time purchase at 96% ^[21]. The most-cited Pew figure, from 2016, was 82% of US adults reading reviews at least sometimes before a first purchase, with 40% doing so always or almost always ^[13]. Whatever the exact number, the ritual has only hardened over a decade.

AI has joined the ritual without replacing it. Alchemer found 48.5% of US shoppers used an AI tool to research a retail purchase in the past 12 months, but only 35.4% trust AI recommendations completely or mostly ^[12]. Bazaarvoice and Kiri Masters report that 94% of consumers insist on doing outside research after receiving an AI recommendation, and 75% require written user reviews before buying an unfamiliar product an AI suggested ^[11]. Deloitte's 2025 holiday survey had 33% of shoppers planning to use generative AI in their shopping journey, more than double the 2024 figure ^[8]. The pattern is consistent: people ask the machine, then go and check what the machine said.

The checking shows up in search demand as a distinct query class. Ahrefs puts US monthly searches for "is temu legit" at 65,000, "is super.com legit" at 36,000, "is aliexpress legit" at 34,000, "is stubhub legit" at 28,000 and "is shein legit" at 27,000 ^[29]. These are not product searches. They are trust searches, and the brands attracting them are the ones whose ads reach people who have never heard of them. McAfee found 91% of Americans see ads from unfamiliar retailers, and scam-related URLs climbed about 10% between early October and early November 2025 ^[28]. The Better Business Bureau listed 1,852 complaints against TikTok as of November 2025, 896 of them unanswered, and warned shoppers to research TikTok Shop sellers before buying ^[27].

Our own search data shows the same intent at small scale. In the 28 days to October 12, 2026, Bing sent us 525 clicks from 14,706 impressions ^[55]. Of our top 200 Bing queries, 78 contain the words "legit", "scam", "complaints" or "reviews", and those 78 queries account for 46% of our impressions ^[55]. Nearly half of the people who find a review site through Bing are not asking whether a product is good. They are asking whether the company selling it is real.

That matters for how reviews get written. A review that answers "is it good" and ignores "is it legit" misses the question half the audience is asking. We now treat shipping times, refund friction, auto-renewal terms and the identity of the company behind a brand as review content rather than footnotes, because the demand data says that is what readers came for.

3. The DTC price illusion

Our catalogue covers 596 products, of which 438 are sold on Amazon and 154 are live direct-to-consumer offers from affiliate networks ^[55]. The DTC offers are the ones advertised in social feeds and search ads under brand names most shoppers have never seen, and they share a checkout design. A large crossed-out regular price sits beside a smaller price for today, often with a countdown or a stock warning.

We recorded both prices for the seven DTC offers in our catalogue where the checkout shows a struck-through regular price ^[55]. The table below lists them. The median anchor is 2.0 times the price actually charged, and the mean is 2.3 times ^[55]. In the most extreme case, a $99.99 product is shown against a $333.30 regular price, a 3.3 times multiple ^[55]. We found no evidence that any of these products sold at the crossed-out price for any sustained period, which is the point of the anchor. It exists to make the real price feel like a discount.

The anchor is one of several checkout patterns we log. Of 154 DTC reviews, 30 note a subscription or auto-renewal attached to the purchase and 14 note paid add-ons at checkout such as shipping protection or an extended warranty ^[55]. Money-back guarantees cluster tightly: across the 27 offers that state a guarantee period, the median is 30 days and the range runs from 14 to 100 days ^[55]. Thirty days is long enough to feel generous and short enough that a product shipped from an overseas warehouse may arrive with much of the window already used.

These are small counts from one catalogue and we present them as such. But they line up with the public record. The FTC's TruHeight settlement in April 2026 concerned a DTC supplement brand whose website carried several thousand five-star reviews written by company employees, alongside discount-for-five-stars incentives and bot-run social profiles; the agency obtained a $4 million judgment, suspended on payment of $750,000 ^[18]. The pattern there, a direct-response product sold with unverifiable claims and manufactured social proof, is the pattern our checkout data describes from the price side.

The returns and BNPL figures from section 1 make the anchor more costly than it looks. A shopper who pays $64.99 in four instalments for an item framed as 60% off, then finds the 30-day guarantee has run before the return is processed, has combined three of the most common friction points in one order ^[55][3][6]. None of this is illegal in itself. All of it is the reason "is it legit" is a 65,000-a-month query ^[29].

4. The review economy under pressure

The review itself, the thing shoppers check, is now a regulated product. The FTC announced its final Rule on the Use of Consumer Reviews and Testimonials on August 14, 2024 by a 5-0 vote, banning fake and AI-generated reviews, undisclosed insider reviews, reviews bought on condition of sentiment, company-controlled independent review sites, review suppression and purchased social-media indicators ^[15]. The rule took effect on October 21, 2024 and allowed civil penalties of $51,744 per violation at the time, adjusted annually for inflation ^[16].

Enforcement arrived about a year later. On December 22, 2025 the FTC sent its first warning letters under the rule to 10 companies, citing fake reviews, sentiment-conditioned incentives, undisclosed insider reviews and review suppression, and noting penalties of up to $53,088 per violation ^[17]. The TruHeight settlement followed in April 2026 ^[18]. In May 2026 the FTC and the Illinois Attorney General sued Premium Home Service for creating thousands of fake local-business listings and planting five-star reviews to dilute real one-star reviews ^[19]. The research behind these cases is older than the rule: He, Hollenbeck and Proserpio tracked Amazon sellers buying reviews through Facebook groups and found that manipulation is used mostly by low-quality products and produces only a short-term lift in ratings ^[22].

Platforms report the scale. Trustpilot removed 4.5 million fake reviews in 2024, 7.4% of the 61 million submitted, with 90% of removals made automatically by machine-learning systems ^[20]. Consumers have noticed. In the Clutch survey, 48% of respondents said they frequently encounter AI-written or manipulated reviews and 72% said suspected AI involvement lowers their trust ^[21]. The review has become something the shopper must verify before it can be used to verify the product.

Search engines are the other gatekeeper, and 2026 brought a large correction. Google's August 2026 spam update rolled out between August 18 and 21 ^[25]. SE Ranking's study of 100,000 US keywords found 16.71% of URLs that had been in the top 10 fell beyond position 100 during the update, against 9.2% in a quiet July baseline ^[25]. Case studies published afterwards show thin affiliate sites among the losers: one fully programmatic Amazon-affiliate site lost rankings for more than 14,000 queries, and a programmatic health site lost more than 200,000 ^[26]. This continued a line Google began in March 2024, when it targeted a 40% cut in low-quality, unoriginal content and later reported 45% ^[23]. Google's spam policies also name site reputation abuse, third-party content published mainly to borrow a host's rankings, and list syndicated sponsored review pages as an example ^[24].

We can report the effect from the receiving end. Over the 28 days to October 12, 2026, Google sent us 3 clicks from 1,369 impressions, while Bing sent 525 clicks from 14,706 impressions ^[55]. Our Google traffic has been suppressed since the August update ^[55]. We do not know which signals Google weighted, and a site of our size cannot separate a policy effect from noise with any confidence. What we can say is that the two largest search engines currently disagree about us by a factor of roughly 175 in clicks, and that the engine sending traffic is the one where legit and scam queries dominate ^[55].

5. The rise of agent shopping

Since early 2025 the largest technology and payments companies have shipped the pieces of a system in which software buys on a shopper's behalf. The timeline below lists the launches and milestones we could verify against primary sources or well-sourced secondary reporting.

The commercial logic is in Salesforce's and Adobe's numbers. Salesforce measured $1.29 trillion in global online sales for November 1 to December 31, 2025, and estimated that AI and agents influenced 20% of retail sales, or $262 billion ^[44]. AI-search referrals converted 9 times more often than social referrals, and retailers that deployed their own AI agents grew 59% faster, 6.2% against 3.9% ^[44].

Adobe's monthly series tracks the traffic side. AI-referred traffic to US retail sites grew 393% year over year in the first quarter of 2026, and by March it converted 42% better than non-AI traffic, where a year earlier it had converted 38% worse ^[39]. By May 2026 the growth rate was 138% year over year and the cumulative increase since October 2024 was 1,324%; AI visitors converted 54% better, spent 53% more time on site and viewed 23% more pages ^[38]. July 2026 growth was 62% year over year, with conversion 60% higher and revenue per visit 53% higher than non-AI traffic ^[36]. For the 2026 holiday, Adobe forecasts AI traffic to retail sites up 130% year over year, peaking at 159% on Thanksgiving ^[3][33].

Two things in that series deserve attention. The growth rate is falling as the base grows, from 393% to 138% to 62%, which is what maturing channels do ^[39][38][36]. And the conversion gap has flipped from negative to strongly positive in about 18 months ^[39]. The combination suggests agent referrals are moving from novelty to a channel retailers will pay to be in, which is what the advertising launches in ChatGPT signal: an ad test for US Free and Go users in February 2026 and visual display ads in October 2026, against a base of 1.2 billion weekly users ^[41][30].

The payment rails are the part shoppers will notice least and that matters most. Mastercard's Agentic Tokens, Visa's Intelligent Commerce Connect, Google's Agent Payments Protocol and the Agentic Commerce Protocol are all attempts to answer one question: how a merchant can know that the software presenting a card was authorised by the cardholder to use it ^{[53][40][49][48]}. Visa's answer covers both Visa and non-Visa cards and takes on PCI compliance for the enabler, which suggests the networks expect agent purchases to be large enough to fight over ^[40]. Regulators have arrived early. The FTC probe opened on September 30, 2026 examines unfair or deceptive acts by AI companies and potential harms to consumers, and is described as the first federal enforcement action examining agents acting beyond their instructions ^[31][32].

6. Who is actually clicking: bots versus buyers

Our affiliate links are the end of the funnel. A reader on a review page clicks through to a brand's checkout, and the network records the click, the IP address's network owner and country, and any eventual sale. Between September 24 and October 12, 2026 the DFO network logged 4,379 clicks on our links ^[55]. We classified each click by the organisation that owns the IP range. Of 2,252 clicks from product review pages, 1,604, or 71%, came from hosting and data-centre networks such as OVH, Alibaba Cloud, Microsoft, Hetzner, Semrush and Cogent ^[55]. Of 389 clicks from our Christmas gift guides, 308, or 79%, came from the same kind of network ^[55]. Only 40% of all clicks came from US IP addresses ^[55].

The buyers tell a different story. All 20 sales recorded on that network in the trailing 90 days were from US buyers ^[55]. None came from a hosting network. The clicks and the purchases are drawn from different populations.

The GiddyUp network over the same window shows the same shape at larger volume: 9,067 clicks ^[55]. France, almost entirely OVH data centres, sent 1,465 clicks from review pages against 875 from the United States ^[55]. The Christmas gift guides drew 1,111 clicks, of which 296 were rejected by the network as "offer not targeting user country", and produced zero purchases ^[55]. The largest sources of gift-guide clicks were OVH with 342, Alibaba Cloud with 156, Amazon AWS with 128, Hetzner with 59, Semrush with 47 and Microsoft with 42 ^[55].

We cannot say with certainty what these clicks are. Some are SEO tools such as Semrush checking links. Some are search-engine and AI crawlers that follow outbound links. Some are probably agents or scripts running on rented servers, and some may be humans on VPNs. What we can say is that a page built for gift shoppers received roughly four machine visits for every human one, and that machines do not buy gifts ^[55].

This is the small-publisher view of a pattern Cloudflare measures at internet scale. For June 19 to 26, 2025, Cloudflare reported that Anthropic's Claude made nearly 71,000 HTML page requests for every HTML page referral it sent back to a publisher ^[51]. The same week Cloudflare began blocking AI crawlers by default on new domains and opened a private beta of Pay Per Crawl, which lets a site return HTTP 402 Payment Required with a price ^[50]. HasData's index of 10,894 domains finds 10.3% of the web blocks at least one AI crawler in robots.txt, against 56.4% of news publishers; GPTBot is blocked by 7.9% of the web and 50.5% of publishers, and 39.5% of GPTBot bans are not actually enforced at the server ^[34].

Publishers have also tried to invite the machines in on their own terms. The llms.txt convention, a plain-text summary of a site for AI readers, had been adopted by 9.3% of the top 1,000 domains by September 2026, up from 0.3% in June 2025 ^[35]. Originality.ai counted 36,120 such files by May 2026, an 8.8 times increase in twelve months ^[37]. Ahrefs server logs from 137,000 domains showed 97% of llms.txt files received zero requests that month ^[37]. We publish one ourselves. The adoption numbers describe publishers' hopes. The request numbers describe the crawlers' indifference.

The economics follow. Our organic affiliate revenue in the trailing 90 days was 39 sales and $2,634 in commission ^[55]. That is a small business by any measure, and we say so plainly so the percentages above are read in proportion. But the ratio is the finding, not the total. If 71% of the clicks a review page sends to a merchant are machines, the merchant's cost per click is overstated, the publisher's conversion rate is understated, and any agent that learns from click behaviour is learning mostly from other agents ^[55].

7. What it means for shoppers, brands and publishers

Five expectations for the next twelve months follow from the data above. Each is tied to a trend we can cite rather than a view we hold.

First, the "is it legit" query class will grow faster than product queries. The ingredients are in place: 91% of Americans seeing ads from unfamiliar retailers ^[28], 48% of consumers frequently encountering manipulated reviews ^[21], and a 94% habit of checking AI recommendations against outside sources ^[11]. Trust searches are the form that checking takes. We expect our own 46% share of impressions from legit, scam, complaints and reviews queries to rise ^[55].

Second, price anchoring will be the next enforcement target in the style of the review rule. The FTC moved from a rule in August 2024 to warning letters in December 2025 to settlements in 2026 on reviews ^[15][17][18]. The agentic AI probe opened in September 2026 covers unfair or deceptive acts broadly ^[31]. A median 2.0 times anchor across checkout pages is the kind of measurable, repeated pattern that the review cases were built on ^[55].

Third, agents will buy from brands, not from publishers, and the referral will disappear. Instant Checkout, Copilot Checkout, Google's agentic checkout and Rufus Auto Buy all complete the purchase inside the assistant or the retailer's own app ^{[48][43][46][47]}. Shopify's Agentic Storefronts syndicate catalogues directly to the assistants ^[45]. A crawl-to-refer ratio of roughly 71,000 to 1 is the current state of the exchange between AI platforms and the sites they read ^[51]. Review publishers that depend on a click to a merchant should expect that click to be bypassed.

Fourth, paid placement inside assistants will displace organic recommendation for commodity products. ChatGPT's ad test went live in February 2026 and visual ads were added in October 2026 against a base of 1.2 billion weekly users ^[41][30]. Adobe's AI-referred visitors already convert 60% better than other traffic ^[36]. When a channel converts that well and carries ads, the ranking of free recommendations inside it becomes something the platform can price.

Fifth, bot traffic will force a change in how affiliate clicks are counted and paid. On our site 71% to 79% of outbound clicks were from hosting networks and none of the sales were ^[55]. Networks already reject clicks for country mismatch, 296 of 1,111 in one of our guide cohorts ^[55]. Cloudflare's default blocking and Pay Per Crawl show the infrastructure layer moving to price machine access ^[50]. We expect affiliate networks to follow with human-verified click counting, and publishers who report raw clicks to be surprised by how few remain.

We will update this report as our sample grows. The TopCrate figures, including the network classification behind the bot-share numbers, are described in the methodology below and are available on request.