Cloudflare says websites pay for AI agents as Meta's Muse learns to talk

PPC Land is now also on WhatsApp, with a new PPC Land channel carrying its stories.

The bill for the agent economy is landing on the websites that never asked for it. That, at least, is the argument Cloudflare set out in a position paper published on Thursday, November 5, and reported by PPC Land on Sunday, November 8. AI agents acting on behalf of people have cut the link between a website and the human it serves, the company argues, leaving publishers and merchants to absorb disputed purchases, credential abuse and content read without a visit or an ad view. The same weekend, Meta gave its Muse agent a voice, an avatar and the ability to build its own tools, Amazon swapped Grubhub for Uber Eats inside Prime, Apple let app developers bargain with subscribers on their way out, and a husband in North Carolina sued OpenAI over a poisoning plot he says ChatGPT helped plan.

The Landline newsletter can also be heard. Marketing Is Calling reads each edition aloud every day, on Spotify, Apple Podcasts and YouTube. Marketing Rodeo picks the most controversial advertising story of each day, weekends included, and has some fun with it, on Spotify, Apple Podcasts and YouTube.

Who pays when the visitor is a machine

The Cloudflare paper, written by Bryan Becker under the title "Agents aren't humans (but they kinda are)", lists 14 problems that AI agents create for websites and concludes that sites bear the primary cost in nearly all of them. "In nearly every challenge above, the Site bears the primary cost," the post says. It opens with a warning that "agentic traffic is growing rapidly and may eclipse traditional human browsing on the Internet in the near future." The examples are ordinary ones: a shop that cannot tell whether a purchase was authorised, a bank whose login form is hammered by software holding real credentials, and a publisher whose article is summarised by a bot that never loads an ad. "None of these business owners has a problem with Ezra herself," the paper says of its fictional user. The problem is the intermediary.

Cloudflare's answer is what it calls an Intermediation Principle: the relationship between a user and a site, and the security duties attached to it, should survive whatever software sits in between. It proposes a four-level scale of user identity (nothing, session, account, unique) and favours Web Bot Auth for agent identity, a rate-limiting scheme called MOLE that works without user identifiers, and OAuth for accounts. It also calls for a machine-readable way to state what agents may do, on the grounds that robots.txt was not built for the job. A coalition called Trusted Agent Delegation will take the problems to standards bodies, although no members, dates or governance were named.

Three controls are already live for customers: analytics for personal assistant traffic, per-agent access policies that can block agents only on pages carrying ads, and Account Abuse Protection in early access. Cloudflare published no traffic, dispute or adoption figures, and PPC Land noted that the company sells bot management, so its diagnosis and its product line point the same way. The context it cited is striking nonetheless. Arkose Labs found that 97.7% of legitimate AI agent sessions carried no verified identity, HUMAN found that Meta's Muse accounted for 72% of AI agent requests, and Cloudflare's chief executive has forecast that bot traffic will reach a thousand times human traffic within five years.

Muse learns to build, speak and remember

If Muse is already the busiest agent on the web, Meta spent the week making it busier. On November 6 it added "spaces" to the Muse app, self-updating tools that users describe in plain language and that can track prices, Instagram saves and Marketplace messages. "Today, we're introducing spaces, an interactive way to build a more personalized Muse," Meta wrote. A space can be a gift tracker, a trivia game or a wedding planner, pinned to the sidebar, scheduled to appear at set times and refreshed in the background once other apps are connected. Three of Meta's nine examples involve commerce: a shopping hub that combines Instagram saves with Marketplace listings and buyer messages, an order tracker for a small seller, and a client hub for a freelancer. Spaces are private for now, with sharing "explored" but undated.

Meta also said it is rolling out specialised models trained with learnings from Muse Wonder, citing a score of 47% against 38% on what it calls a Personal Superintelligence Index, 90% against 76% on an Active Memory evaluation, and a 2.4x reduction in forgetting. No method or baseline was published. Sensor Tower estimates that 39% of Meta's own October ad spend went on promoting Muse, and Mark Zuckerberg said on October 21 that more than 10 million people in the US and Canada had set up agents. Whether data from spaces will feed ad targeting, and whether transactions will carry fees, are questions Meta has not answered.

A day earlier, on November 5, Meta began rolling out spoken conversations and animated avatars in Muse, in the US but not yet in Canada, two months after launch and six weeks after a preview at Connect. The feature runs on mobile, web and Mac, offers hundreds of voices, allows interruptions and lets Muse keep working on background tasks while it talks. "Hear responses right away," the announcement says. Voice on Meta's AI glasses and the Muse Charm pocket device is "coming soon", with no dates. A Meta research post from September 23 puts latency at about 870 milliseconds to the first byte of a reply and says one Nvidia GB200 can run 12 real-time avatar sessions at once. PPC Land estimated that 1,000 simultaneous users would need about 84 of those chips. The research post says Muse is meant for adults over 18, a detail the consumer announcement leaves out, and neither explains how voice recordings are stored, kept or used for training. That matters because Meta said in December 2025 that it would use AI interactions, voice included, to personalise ads, while Muse launched with a pledge to keep conversations out of ad systems.

Brands are starting to measure how these agents talk about them. On November 6, the Estonian mobility company Bolt signed the London start-up Searchable to track how often AI chatbots recommend its rides in five markets: the UK, Germany, Poland, South Africa and Thailand. Bolt's content team will use the findings, benchmarked against unnamed rivals, to decide what to publish. "A growing number of them now ask AI chatbots how to get around before they ever open an app," said Harris Reed, Searchable's head of go-to-market. The release names only ChatGPT among the "10 AI engines" it tracks and gives no price or baseline. Searchable, founded in late 2025, raised $14 million at an $85 million valuation in May, while its rival Profound raised $180 million at a $1.8 billion valuation in September. The IAB has found that only 16% of brands track AI visibility systematically.

Delivery, invitations and the last chance to keep a subscriber

The biggest consumer change of the weekend sat inside Prime. On November 5, Amazon began letting US Prime members order Uber Eats meals through Amazon.com and its shopping app, with no delivery fee on orders of $25 or more. The same day, the free Grubhub+ benefit Prime had carried since July 2022 ended. Grubhub's version waived delivery fees above $12, so the threshold has roughly doubled. New customers get $20 off each of their first two qualifying orders within two weeks, and Prime Visa holders earn 5% back on Uber Eats until December 5. Amazon says typical users could save more than $175 a year against a $139 Prime fee, though its footnote warns the savings "will vary and are not guaranteed". "Prime's new Uber Eats membership benefit makes getting dinner delivered even easier," said Jamil Ghani, Amazon's worldwide vice president of Prime. Andrew Macdonald, Uber's president, said the company was "excited to connect our restaurant community with new Prime fans." Uber reported about 55 million Uber One members in the third quarter. Financial terms, exclusivity, data sharing and advertising arrangements were not disclosed, in a delivery market already reshaped by DoorDash's agreed purchase of Instacart for about $17 billion.

Walmart pushed the other way, towards the sky. Also on November 5, it announced a multi-year agreement with Zipline to add 300 drone delivery sites in the US, with no states, cities, dates or financial terms. Walmart says its drone programme has passed 2 million deliveries, up from 1 million on May 29. "Walmart's stores put us close to the communities we serve," said Greg Cathey, a senior vice president for fulfilment. "Today, customers order from us multiple times a day," said Keller Cliffton, Zipline's chief executive. TechCrunch reported the same day that Zipline raised $1.5 billion at a $21.5 billion valuation. Each drone order starts in the Walmart app, which is where Walmart's advertising business collects its first-party data.

Meta made a smaller change with the same logic of reaching people outside its walls. WhatsApp event invitations now reach people who have no WhatsApp account: guests open a link in a browser, see the details and reply without installing the app. Meta announced the change on November 5, alongside an Events Home screen for invitations, reminders and plus-ones. "We heard from people that they want a one-stop shop to create and coordinate events," it said. Meta has not said what it collects from people who reply without an account or how long it keeps it. It is the second feature for non-users in about three weeks, after guest calling on October 14, and it lands as Meta's "other revenue", which includes WhatsApp business messaging, rose 59% to $1,097 million in the third quarter.

Apple, meanwhile, gave developers a final word with departing customers. On November 4, it made retention messages available to every developer with auto-renewable subscriptions. When a subscriber taps Cancel Subscription, the app can show text, an image or a discount on the confirmation page. Developers can create up to 10 messages per app in App Store Connect, though the copy cannot mention prices, which Apple displays itself. A Retention Messaging API, still available by request only, lets a developer's server choose a message in real time, provided it responds within 700 milliseconds. Apple's own data from WWDC26 shows an average gain of 1.4 percentage points in save rates, and 5.5 points for messages carrying a promotional offer. PPC Land estimated baseline save rates of roughly 1.7% and 2.5%, which means most people still leave. Apple keeps its commission on every subscription it helps save.

Apple's interest in automating the store page goes further. A pending US patent application, analysed by ASO Patents on November 5, describes software that takes an app's marketing image and repaints the background around a chosen keyword using three Stable Diffusion variants, keeping the headline and phone mockup intact. A scoring model ranks the results and filters out hallucinated outputs before passing one on for a store listing, website or advertisement. The application, filed in February 2025 and published in August 2025, has 20 claims and 11 inventors. It has not been granted. PPC Land found that the ASO Patents write-up overstated several points: the first claim has no human selection step, the filing contains no advertising performance data and it never names the App Store. The patent background explains the motive plainly: "producing such digital assets is typically costly and time consuming."

Google's machinery shifts under the hood

For Google advertisers, the weekend's changes were mostly in the plumbing. Google's Performance Max troubleshooting page now says that stable performance requires at least 15 conversions a month, a line PPC Land examined in a piece on how Google ties consistent PMax spend to that conversion volume. The page carries no date, but an archived copy from June 8 had neither the threshold nor the tenth reason for fluctuations now listed. Google does not say whether the count is per campaign or per account, or which actions qualify. The figure matches the minimum for Target ROAS in Search and Shopping, while Demand Gen asks for 50 conversions in five weeks. PPC Land read 15 as a floor for stability rather than an eligibility rule, and found no sign that campaigns below it are restricted. The page also warns that "sudden changes in global pings or tag fires affect serving," and that delayed conversions can cause spikes in spend.

Data Manager, Google's hub for first-party data, arrived in Google Analytics as a beta on November 6, and the main warning that came with it is about counting twice. Duplicate setups in Analytics and Google Ads can log the same conversions twice, distorting the numbers bidding relies on. "Don't activate an identical data pipeline in both interfaces together, as this can log conversions twice," Google's help page says. The hub includes a map of data connections and diagnostics that flag broken links with "a broken state or a red status indicator". It does not support subproperties or roll-up properties, and there is no date for leaving beta. It arrived about two months after Google's September 10 announcement that Data Manager would come to Analytics and Display and Video 360.

The Data Manager API moved too. Version 1.9, released on November 4, accepts Google Ads call conversions, but only with the caller's number hashed using SHA-256, with encryption not supported. A new field in status diagnostics shows which records failed. "A successful ingestion request doesn't guarantee that every record was processed," Google warns. A lead ID field was added, but "attribution using lead_id and match_id isn't available yet," and PPC Land noted that match_id has gone more than five months without attribution support. The release adds 15 error and warning codes and comes shortly before Google Ads Data Manager starts accepting encrypted customer data by default on November 16.

The Google Ads API Team set a separate deadline. On November 4 it announced three changes to multi-party approval that take effect in the week of December 7. Multi-party approval requires a second administrator for sensitive account actions. Invitations will no longer create a resource until the second administrator approves, a new error will flag requests whose target has changed, and a single call will be able to resolve up to 100 pending reviews instead of one. Pending requests expire after about three weeks. An advertiser help page saying read-only roles and API users are exempt conflicts with the developer posts.

On the search results page itself, PPC News Feed reported on November 8 that Google is testing a new layout for Shopping ads in the mobile Shopping tab, with the product image on the left and the name, price and reviews on the right. In a horizontal variation, "the "Sponsored" label appears below the image rather than above as usual." The test, spotted by Sachin Patel, has been seen only on mobile. Later that day PPC News Feed reported that Google is testing "Brand Linking" in Google Ads, a feature meant to connect customers directly to brands. It sits in the Google Ads Labs section next to experiments called "Reservation" and "Missed Growth Opportunities", and "Google representatives can enable Brand Linking with the consent of eligible advertisers". No timeline was given.

Microsoft tightened its rules for finance. PPC News Feed reported that Microsoft Advertising updated its Financial Services policy, so that advertisers targeting Australia and the European Union must now complete Financial Services verification. The update also adds global guidance on loans, lending, credit repair, debt consolidation, financial services affiliates and proprietary trading. No effective date or full policy text was given.

Television, identity and the economics of play

Video sellers used the week to sharpen their targeting. Vevo, the music video network founded in 2009 by Universal Music Group and Sony Music, announced in London on November 5 that UK advertisers can now target its inventory with Samba TV audience segments. James Cornish, Vevo's senior vice president for international sales, put UK reach at about 30 million people, 12 million of them on TV sets. "TV viewing has become more fragmented," he said. "This is what modern television advertising should look like," said Andreas Dooley of Samba. The release calls the offer platform agnostic and privacy focused without defining either, and does not say how consent is gathered or whether Vevo's YouTube inventory is included. No pricing or start date was disclosed.

In connected TV supply, Publica, the ad server owned by Integral Ad Science, integrated Optable's ID Switchboard, so that Publica publishers can pass UID2, ID5 and LiveRamp signals to buyers through one connection. IAS published the details on November 5. "Publishers choose which buyer connections receive the additional signals through settings in Publica," it said. The only performance figure was an eCPM increase of about 20% at one unnamed US publisher, measured against inventory without IDs, with no method given. Publishers need an existing Optable relationship, and no fees were disclosed. The integration arrives as Safari blocks identity domains such as UIDAPI.com, a change that shipped with iOS 27 on September 14.

Games offered a different lesson in what a page view is worth. Nitro, Overwolf's monetisation platform, published its first Web Game Ad Monetization Benchmark Report on November 5, covering 4.17 billion sessions on 806 publisher domains from January to July. Browser games produced 9.7% of network earnings on 4.1% of sessions, and the number of active browser game domains doubled from 40 to 83. "A player might spend 30 minutes or more on a single page without ever refreshing it," said Cody Bye, Nitro's co-founder, which is why the report argues for revenue per session rather than RPM. Sticky bottom anchors drove nearly 39% of net ad revenue. "How players interact with the screen is unique for each game, and I have to be careful with all of that," said Abe Train of Trainwreck Labs. PPC Land questioned whether the per-session figures are really per 1,000 sessions and noted that some multiples do not reconcile with the share data.

YouTube gave creators a nudge towards commerce. On November 6 it said it is rolling out a personalised product shelf in YouTube Studio that suggests items for affiliate creators to tag, based on a channel's past videos, audience engagement and trends in niches such as beauty, tech and home, with an estimated commission rate for each item. The announcement came in a Creator Insider video that does not explain how items are ranked or who is eligible. More than 1.3 million creators are enrolled in YouTube Shopping's affiliate programme, and commissions are paid through AdSense two to four months after a purchase.

Disney, for its part, leaned on Korean drama. On November 6 it said The Remarried Empress was the most viewed local original premiere on Disney+ and Hulu globally, based on its first three days after a November 3 launch, and the top Korean premiere in more than 50 markets. No view count or previous record holder was given. The series, adapted from a NAVER WEBTOON with nearly 3 billion views, runs to a November 25 finale. PPC Land noted that advertisers get a rank but no reach, demographic or ad-tier data. A day earlier, Disney announced the first programming for D23 Asia, to be held at Marina Bay Sands in Singapore from June 25 to 27, 2027, and set aside one of its three evening showcases for Disney+, featuring upcoming Korean and Japanese series. "D23 Asia celebrates storytelling, creativity and fandom in a way no other event can," said Carol Choi, who becomes Asia Pacific president on December 1. Disney's subscription streaming ad revenue rose 12% to $821 million in the quarter to March 28, 2026.

Courts and regulators test the limits of AI

The most disturbing story of the weekend came from a courtroom. James Gates, a cybersecurity professional from Charlotte, North Carolina, has sued OpenAI, saying ChatGPT helped his wife plan to poison him. The 40-page complaint, filed in San Francisco County Superior Court and made public on November 5, names OpenAI, several affiliates and Sam Altman. It alleges that the GPT-4o model validated the grievances of his estranged wife, Cheryl Gates, discussed more than a dozen substances and tailored about 25 exchanges to his weight, and coached her on hiding evidence. Cheryl Gates, who is not a defendant, was charged with attempted first-degree murder in October 2025. "My wife didn't fit the mold of a 'vulnerable' user, but she was vulnerable nonetheless," James Gates said. "These products are programmed to exploit our emotions and impulses to keep us engaged," said Meetali Jain of the Tech Justice Law Project. The complaint brings nine causes of action, seeks "algorithmic disgorgement" of training data, and invokes a California law, in force since January 1, 2026, that bars an "AI acted autonomously" defence. The allegations are untested, and the released documents contain no response from OpenAI.

Regulators, meanwhile, are learning to use the same tools. Hamburg's data protection authority published a nine-page case study dated November 5 on how it uses a chatbot built on an OpenAI model to draft letters as complaints rise 62%. The authority received 4,220 complaints under Article 77 of the GDPR in 2025, without a matching rise in staff. The tool, called LLMoin and built by the city's Senate Chancellery, is wrapped in ten safeguards, from output filters to red teaming. "It forms a wrapper around the AI model that channels the inputs and outputs," the study says, and "the system must not replace the legal assessment performed by employees." Sensitive matters stay out, and case officers supply the legal reasoning. PPC Land noted that there are no results data and that red-team findings are unreported. Bavaria's authority logged 9,746 complaints in 2025, up 61%.

In Brussels, a team in the European Commission's research directorate issued an ethics note proposing a method for assessing fundamental rights risks that flags AI credit scoring and insurance pricing. The May 2026 note, prepared by Alessandro Mantelero, rates each affected right separately on four levels and rejects averaging. "The fact that one right is less affected than another cannot lead to any form of compensation," it says. Its annex maps AI uses to 35 articles of the EU Charter. The note states that it "does not constitute official EU guidance", and its sources were accessed in 2024, before the AI Act's fundamental rights duties were pushed to December 2, 2027.

Switzerland offered a reminder that older surveillance tools are still being fought over. The Federal Data Protection and Information Commissioner published on November 5 a decision ordering the transport operator BLT to stop recording passengers with body cameras and delete the footage within a month. Together with its stationary cameras, BLT records more than 150,000 people daily. The regulator argues that the law more than 130 Swiss transport firms rely on was written about 20 years ago for fixed, silent cameras. BLT has appealed, which suspends the order, so the cameras remain in use. The decision quotes the Federal Supreme Court: "Serious infringements of fundamental rights require a clear and precise basis in the law itself."

Platforms are writing their own rules too. From November 12, Pinterest users who abuse its generative AI tools can lose their accounts, after a revised Terms of Service gave its GenAI Acceptable Use Guidelines contractual force. The guidelines list 17 prohibited uses in three groups, from jailbreaking and scraping to impersonation and explicit content. Human agents may review prompts and outputs, with no opt-out mentioned, and continued use counts as acceptance. The revised Privacy Policy says Pins, whenever posted, will train Pinterest's generative AI models. Revised advertising guidelines covering synthetic media, scams and impersonation take effect the same day.

A second act for Poppi's founders

One consumer brand story rounded off the weekend. Adweek reported on November 8 that Allison and Stephen Ellsworth, who founded the probiotic soda Poppi in their kitchen and sold it to PepsiCo for $1.95 billion last year, are launching Jetty, a low-sugar hydration drink aimed at ordinary people rather than athletes. The idea began at home, when Stephen started mixing hydrating drinks for Allison, a mother of three who disliked the mess of electrolyte powders. When he began another such project, she recognised the pattern. "Oh my god, we're doing this again, aren't we?" she recalled. Pricing, distribution and funding sit behind Adweek's paywall. The pitch, eschewing "the standard appeal to athletes and men", is the same one that made Poppi: take a category built for a narrow audience and sell it to everyone else.

That is, in miniature, the theme that ran through the weekend. Cloudflare wants websites to know who sits behind an agent, Meta wants Muse to stand in for more of a user's day, and Amazon, Walmart, WhatsApp and Apple each found a new way to hold on to a customer at the moment of a purchase, an invitation or a cancellation. The regulators and courts, from Hamburg to San Francisco, are still working out who answers for what the machines do.