UCP, the Universal Commerce Protocol, is an open standard that lets an artificial intelligence agent discover a merchant's products, assemble a cart, complete payment and follow the resulting order without a bespoke integration built for that merchant. It exists because the alternative does not scale. Before it, an assistant that wanted to sell something had to be wired individually into every shop, and every shop had to be wired into every assistant. Google engineers describe the result as an N x N bottleneck: fifty surfaces and fifty retailers imply 2,500 separate connections. UCP replaces those with one machine-readable profile per business and one client per agent.

How a transaction runs

A business publishes a JSON profile at the path /.well-known/ucp. That document declares three registries: the services it supports, the capabilities within them, and the payment handlers it accepts. Names use reverse-domain form, so the standard checkout capability is dev.ucp.shopping.checkout and a vendor extension sits under that vendor's own reverse domain. Each entry carries a version string in YYYY-MM-DD format, a human-readable specification URL and a machine-readable schema URL.

The schema URL is not decorative. The specification requires a platform to check that the host serving a schema, with its labels reversed, matches the entity's namespace, so dev.ucp.shopping.checkout may be served from ucp.dev but not from an unrelated content delivery network. A platform must reject any entity that fails that binding and must not follow redirects when fetching one. The check establishes provenance rather than trust: it proves who is making a claim, not that the claim is worth acting on.

Agents identify themselves in the other direction. Every request over HTTP carries a UCP-Agent header pointing at the platform's own profile. The business then computes the intersection of the two capability sets, selects the highest version present in both arrays, discards extensions whose parent capability did not survive, and repeats until the set stops shrinking. Capabilities with no mutual version are dropped rather than downgraded. Failures are typed: an unreachable profile returns HTTP 424, a malformed one 422, and an empty capability intersection returns 200 with a capabilities_incompatible code, because a negotiation that concluded with nothing in common is a business outcome rather than a transport error.

Capabilities at the time of writing cover catalogue search and lookup, cart, checkout, order lifecycle updates over webhooks, permalinks, location and identity linking through OAuth 2.0. Extensions sit on top: fulfilment, discounts, buyer consent, loyalty, split payments and a mandates extension binding the flow to the Agent Payments Protocol. Four transports are defined - REST described by OpenAPI 3.x, the Model Context Protocol described by OpenRPC, Agent2Agent through an agent card, and an embedded option for businesses that want to inject their own checkout interface into the host surface.

Google's published walkthrough shows the shape of the exchange. A demo flower shop advertises checkout, discount and fulfilment capabilities. The agent posts a line item to /checkout-sessions with an idempotency key and receives a session identifier back with a status of ready_for_complete. Prices travel as integers in minor units, so a 35 dollar bouquet is 3500; applying the code 10OFF returns a discount total of 350 and a new total of 3150. Floating point never appears on the wire, and the specification defines no rounding tolerance anywhere in the quantity lifecycle.

Payments are deliberately split. The instrument a shopper uses is separated from the handler that processes it, which is how a single checkout can offer Google Pay, Shop Pay and a processor tokeniser side by side. Businesses remain the merchant of record.

Origin and evolution

The problem predates the protocol. Google deployed agentic checkout for the 2025 holiday season on 13 November 2025 with Wayfair, Chewy, Quince and selected Shopify sellers. OpenAI and Stripe had moved first, publishing the Agentic Commerce Protocol alongside Instant Checkout in ChatGPT on 29 September 2025. Microsoft followed with Copilot Checkout on 8 January 2026.

Three days later, at the National Retail Federation conference, Google launched UCP with Shopify, Etsy, Wayfair, Target and Walmart as co-developers and more than 20 endorsing companies including Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa and Zalando. Target and Walmart switched on checkout inside Gemini and AI Mode the same day. Mastercard announced Agent Pay in parallel. The specification went to GitHub under the Apache 2.0 licence, versioned 2026-01-11.

Documentation lagged the announcement. Merchants had no central reference until Google published a Merchant Center help page on 2 March 2026, spotted by Hana Kobzova and amplified by Glenn Gabe of G-Squared Interactive, which set out the native_commerce product attribute, the funding primary account number credentials held in Google Wallet, and the payment service provider requirements. Cart and catalogue capabilities arrived that month.

Governance widened on 24 April 2026, when Amazon, Meta, Microsoft, Salesforce and Stripe joined the Tech Councilalongside founders Google, Shopify, Etsy, Target and Wayfair, taking the body to ten of a possible sixteen seats. Amazon's arrival was the surprise, eight months after it blocked crawlers from OpenAI, Anthropic, Meta and Google. Google then moved checkout out of AI Mode into standard search results in May, and at Google Marketing Live on 20 May extended UCP to hotels, food delivery, Canada, Australia and the United Kingdom, adding Affirm, Klarna and multi-item carts. The published specification had reached version 2026-08-25 as of September 2026.

Why it matters to marketers

For anyone running a product feed, UCP converts data hygiene into distribution. Eligibility for checkout on Google's surfaces runs through an existing Merchant Center account, so feed completeness, price parity and return policy accuracy decide whether inventory is transactable rather than merely visible. Google's own reference implementation is the only one most merchants will encounter, which makes a nominally neutral standard operationally indistinguishable from a Google product requirement.

The commercial layer arrived with it. Direct Offers launched the same day as the protocol, shopping ads reached AI Modeon 11 February 2026 when the surface passed 75 million daily active users on Google-commissioned research, and the Universal Cart unveiled at Google I/O on 19 May put a cross-merchant basket across Search, Gemini, Gmail and YouTube. Intermediaries lose ground in that arrangement: a cart that applies codes automatically weakens the coupon and deal sites that monetise the last click.

Adoption and disputes

Uptake is the weakest part of the story. A scan of more than 3 million websites by Originality.ai found 26 with a detectable UCP file in May 2026, none of them co-developers or endorsers. Google's implementation does not require merchants to host their own endpoint, which explains part of the gap, but not the absence of independent deployments. Walmart's experience with the rival protocol supplied a further caution: the retailer reported that Instant Checkout in ChatGPT converted three times worse than click-out links.

Pricing is the sharper dispute. Lindsay Owens argued on 11 January 2026 that merging search history, conversation data and retailer records amounts to surveillance pricing; Google responded on 13 January that merchants cannot show prices above those on their own sites. The United States Federal Trade Commission put undisclosed price personalisation under Section 5 in a policy statement in August 2026. Separately, Productrise reported on 1 September 2026 that across more than 2 million listings tracked from 9 to 31 August, identical products appeared 21.6% more expensive in AI Mode than in standard search on the same day, with the lead seller differing on 49.6% of matches. That measures surface composition rather than personalisation, and the two explanations have not been reconciled.

Governance draws the third objection. The repository is Apache 2.0 with Google as dominant contributor, and no transfer to a neutral foundation has occurred, unlike the Model Context Protocol. France's competition authority flagged lock-in risk in July 2026 with OpenAI, Google and Anthropic holding 84% of AI agents.

Disambiguation

ACP, the Agentic Commerce Protocol, is the OpenAI and Stripe specification published in September 2025 and used by ChatGPT. It requires merchants to apply and submit catalogues; UCP relies on autonomous discovery. Both are live.

AP2, the Agent Payments Protocol, handles cryptographic proof that a user authorised a purchase. UCP carries AP2 mandates as an extension rather than replacing them.

MCP and A2A are transports UCP can run over, not competitors. A checkout capability can be bound to REST or MCP without changing its schema.

Universal Cart is a consumer product built on UCP, not the protocol. Some vendor reports have merged the two into a non-existent "Universal Cart Protocol". A W3C workshop listing has also rendered the acronym as Universal Communication Protocol.

Recent developments

W3C and GS1 host a workshop titled E-commerce for Humans and AI Agents in Zurich on 8 and 9 September 2026, hosted by Google, with MCP, UCP and ACP on the agenda and a programme committee including OpenAI, Visa, Airbnb and Block. On 27 August 2026 Google added hotel booking to AI Mode with ten partners, while flights still complete on the airline's site. The gap between what the protocol specifies and what agents are permitted to conclude remains the open question.

Timeline

  • 29 September 2025: OpenAI and Stripe publish the Agentic Commerce Protocol alongside Instant Checkout in ChatGPT
  • 13 November 2025: Google deploys agentic checkout for the holiday season with Wayfair, Chewy, Quince and selected Shopify sellers
  • 8 January 2026: Microsoft launches Copilot Checkout with PayPal, Shopify and Stripe
  • 11 January 2026: Google announces UCP at the National Retail Federation conference with Shopify, Etsy, Wayfair, Target and Walmart; specification published to GitHub under Apache 2.0 as version 2026-01-11; Target and Walmart enable checkout in Gemini and AI Mode; Mastercard announces Agent Pay
  • 13 January 2026: Google responds to surveillance pricing criticism, stating merchants cannot show prices above those on their own sites
  • 11 February 2026: Shopping ads introduced in AI Mode
  • 2 March 2026: Google publishes the Merchant Center help page covering the native_commerce attribute and payment flow
  • 5 March 2026: Mastercard and Google introduce Verifiable Intent for agent payments
  • March 2026: Cart and catalogue capabilities added; Merchant Center onboarding simplified
  • 24 April 2026: Amazon, Meta, Microsoft, Salesforce and Stripe join the UCP Tech Council, taking it to ten seats of a possible sixteen
  • 19 May 2026: Universal Cart unveiled at Google I/O
  • 20 May 2026: Google Marketing Live extends UCP to hotels, food delivery, Canada, Australia and the United Kingdom, adding Affirm, Klarna and multi-item carts
  • 21 May 2026: Originality.ai dashboard finds 26 detectable implementations across more than 3 million sites scanned
  • August 2026: US Federal Trade Commission issues a policy statement on undisclosed personalised pricing
  • 25 August 2026: Specification version 2026-08-25 published
  • 27 August 2026: Google adds hotel booking to AI Mode with ten partners
  • 1 September 2026: Productrise publishes a price comparison between AI Mode and standard search
  • 8 September 2026: W3C and GS1 workshop on e-commerce for humans and AI agents opens in Zurich

Summary

Who. Google developed UCP with Shopify, Etsy, Wayfair, Target and Walmart, endorsed by more than 20 companies including Adyen, Mastercard, Stripe and Visa. A Tech Council of ten members, expanded in April 2026 to include Amazon, Meta, Microsoft, Salesforce and Stripe, steers its technical direction.

What. An open-source specification, licensed Apache 2.0, defining how AI agents discover a business's commerce capabilities, build carts, complete checkout, exchange payment tokens and receive order lifecycle updates, over REST, MCP, A2A or an embedded transport.

When. Announced on 11 January 2026 at the National Retail Federation conference as version 2026-01-11, with capability and geographic expansions through March and May 2026. The published specification stood at version 2026-08-25 as of September 2026.

Where. Merchant profiles are published at /.well-known/ucp. Google's reference implementation runs through Merchant Center on AI Mode, Gemini, standard search results and YouTube, initially in the United States, extending to Canada, Australia and the United Kingdom.

Why. The protocol collapses the N x N integration problem that made agentic shopping impractical beyond controlled demonstrations. For the marketing community it converts product feed quality into transactability on conversational surfaces, moves the purchase away from the merchant's own site, and raises unsettled questions about pricing transparency, attribution and the governance of a standard whose dominant contributor also owns the largest surface running it.