The World Wide Web Consortium today published "W3C and the State of the Web in the AI Era," a discussion paper from its Strategy Team that proposes a nine-point declaration on the value of the web, a new Agentic Web Working Group, and a list of work items for more than a dozen W3C groups. The paper was prepared by Philippe Le Hegaret, W3C VP Technical Strategy, and is dated as finalized on October 20, 2026. W3C's news post carries a publication date of October 21, 2026, and the paper will be presented at a Web and AI Interest Group session on October 29 during TPAC 2026.

In Short

The group that writes the rules browsers and websites follow has written down what it thinks AI agents are doing to the web, and what it wants to change. It matters to anyone who publishes content, runs a website or sells online, because the paper covers crawling, consent, payments, identity and accessibility when software rather than a person is doing the browsing. Nothing in it is a standard yet: these are early recommendations that W3C wants feedback on before groups turn them into actual work.

What the paper is, and what it is not

Two documents make up the release. The first is a short news item on w3.org, dated 21 October 2026 and filed under the Technical Strategy group. It states that Le Hegaret "wrote 'W3C and the State of the Web in the AI Era', a document putting together the observations and findings of the W3C Strategy Team about how the W3C technical agenda for the web needs to evolve based on the rise of AI agents." The second is the paper itself, hosted at w3.org/2026/10/w3c-and-state-of-web-in-ai-era.html. Its header reads "Prepared by Philippe Le Hegaret, W3C VP Technical Strategy, finalized on 20 October 2026," and its revision stamp shows version 1.5, last edited at 08:33 UTC on October 21.

Its status matters for how the content is read. This is neither a W3C Recommendation nor a consensus statement of the W3C Membership. According to W3C, the paper "is intended to foster discussion in the technical community at TPAC - the most important W3C community event of the year." It "does include some early recommendations that we expect to socialize during TPAC and seek community feedback." The nine-point declaration is labelled "a proposal." Where the paper says what W3C "needs" or "should" do, it is the Strategy Team's view, not an adopted position.

The paper closes with a disclosure that few standards documents carry: "this report was developed with AI assistance, its human editor takes full responsibility for its content."

Feedback channels are listed in both documents: the public-webai@w3.org mailing list and the issues tracker of the w3c/webai-roadmap repository on GitHub. The paper links to the TPAC 2026 event page and to a W3C calendar entry for the October 29 session. Neither document sets a closing date for comments.

The paper also positions itself as a sequel. It refers to a 2024 Team report on the risks and opportunities of machine learning on the web, linked to w3.org/reports/ai-web-impact/, and says that "in the two years since," AI agents "have advanced from merely reading the web to interacting with it. Every major AI platform now embeds an AI-agent driven web browser."

The numbers W3C chose to cite

A short statistics section opens the analysis, and it comes with its own warning. "The figures below come from vendors' own networks (Cloudflare, DataDome, HUMAN), each measuring a different slice of traffic, so they are not directly comparable," the paper states, adding that "Asia-Pacific adoption is underrepresented."

None of the figures are W3C measurements. According to the paper, citing Cloudflare:

  • In 2026, for the first time, more than half of the traffic reaching sites on Cloudflare's network was not initiated by human interactions with the website.
  • About 2.5 billion people use generative AI regularly (attributed to "Cloudflare, July 2026," linked to Cloudflare's agentic internet bot report).
  • Daily requests from AI agents grew by more than 1,700% in the year to September 2026.

A Chinese security provider, Ruishu Information, is cited for logs from its own protection network covering early 2025 through Q2 2026: bots at about 68% of traffic and AI agent-driven traffic rising from below 1% to 8-12%. The link for that figure points to an article on doit.com.cn, not to Ruishu itself.

DataDome's network is cited for AI accounting for 1.7% of all requests in June 2026, up 82% in a year, and for AI training making up 52% of crawler requests that month. The next sentence - that some heavily crawled categories "lost up to 40% of their human traffic in under a year, while Google still sends about 88% of referral traffic" - carries no link of its own, so the paper does not show which vendor produced it.

The most granular figures come from HUMAN Security for June 2026. Comet generated 47.6% of agentic traffic, Claude 20.8%, Atlas 16.5% and ChatGPT Agent 7.0%. Ecommerce drew 43.8% of that traffic, media 41.3% and travel 13.5%. "Some 79% of agent visits landed on product and search pages, against only 2.3% on checkout and payment," according to the paper. The claim that "a large portion of AI users don't check the sources" links to an F-Secure consumer AI survey from April 2026.

These vendor snapshots have moved fast. PPC Land reported in October that Meta's Muse took a third of agentic browser requests in September on DataDome's network - an agent absent from the June list W3C reproduces. Earlier, Cloudflare Radar data for the week to June 5 put bots at 57.4% of HTML traffic, and HUMAN reported automation growing eight times faster than human traffic in April.

The broken bargain with crawlers

The paper's diagnosis starts with what it calls long-held assumptions. "The implicit contract of content providers with search engines - crawl my content, send me visitors - has yet no systematic equivalent for AI systems," it states. Websites want to control, and sometimes prevent, consumption "for a variety of reasons, including privacy, intellectual property, and business models."

Answer engines and crawlers reduce click-through, according to W3C, and "server-side rules fall short of controlling requests from AI crawlers or agents." That phrase links to two sources: the IETF AI Preferences vocabulary draft (draft-ietf-aipref-vocab) and a third-party blog post about AI crawlers on git.kernel.org. The robots.txt file, still the main signal sites use, is mentioned later only as "robots.txt evolution at IETF."

Cost is the second strand. The paper quotes Bernadette Meehan, Wikimedia Foundation CEO, speaking at the United Nations General Assembly in September 2026: "the toll of scraping and the behavior of some of the big technology and frontier AI companies takes a toll on our infrastructure." Days after that speech, Wikimedia linked AI agent traffic it attributed to OpenAI to a May 2026 partial disruption of its Wikidata Query Service.

The paper then turns the problem around. Agents, it argues, would benefit from "clearer semantics and explicit descriptions alongside existing HTML and accessibility information." Common HTML "falls short for AI Agents (token bloat and noise extraction errors) and agents currently prefer text (lightly formatted with markdown) and structured data (json, yaml, csv)."

Synthetic content is the third strand. Generated text, images, audio and video "are cheap and appear credible to a large portion of users." The paper cites Article 50 of the EU AI Act, which requires machine-readable marking of AI output, "as of August 2026" - a date PPC Land covered when the Commission released free AI labelling icons in July. Yet "there is no way to guarantee that content was not machine-generated, which raises the stakes for provenance, identity and credentials."

Why the browser survived

One prediction the paper explicitly reverses concerns the browser. "A year ago the common bet was that agents would bypass the browser for APIs and MCP servers," it states. "It is however unlikely that MCP will ever provide endpoints at the same scale as websites."

The reasoning is practical. Service providers keep relying on websites, according to W3C, "because the web browser already solves sandboxing, authentication, discovery, trust (HTTPS and origins), identity segmentation, and, most importantly, a place for the human to step in." All major AI platforms "provide a web browser or a way to interact with one."

A diagram shows a human reaching the web through two paths - a browser and AI agents - that are also linked to each other. The model W3C describes is one where "the web browser and the AI agents, both acting as web user agents, need to cohabit and interact with each other, while properly handling user consent/delegation, privacy, and liability."

That view sits close to a proposal PPC Land covered in February, when Google's Chrome team put forward WebMCP, a way for websites to expose structured tools to agents inside the browser rather than through separate MCP servers. WebMCP appears throughout the W3C paper as one of the open questions for the proposed working group.

Eight risks

The paper lists eight categories of risk to users and the ecosystem.

Security comes first. Agents with access to private data that interpret untrusted content "offer an exfiltration path similar to cross-site scripting," the paper states. The difference is that "an attacker no longer necessarily needs to inject executable JavaScript. Malicious instructions can be carried by ordinary text in a web page, document, or tool response." Prompt injection and misaligned agents, according to W3C, "undermine the same-origin protections the web relies on."

Privacy and consent follows. Data handled by agents crosses contexts and is used to train models; confirmation dialogs risk prompt fatigue; speaker identification and inference from audiovisual metadata "amplify tracking." Media recordings of users can be reused to create deepfakes.

On accessibility, the paper warns that "optimizing ARIA for agents may break the human experience," and that generated alt text "may be inaccurate and should not entirely replace authored descriptions or author intent." AI may also "amplify the existing accessibility debt in existing large codebases."

The remaining five are shorter. Under trust and provenance, "disclosure, provenance evidence and usage preferences are different things." Under centralization, agents "locked to or favoring partner-approved sites, dependency on specific models, and vendor MCP tool registries all threaten one interoperable web." Publisher sustainability gets one line: "Less human traffic means less incentive to publish openly, with a disproportionate effect on less-resourced creators." Equity and bias notes that models underperform for minority languages, scripts and cultures. And on sustainability, the paper concedes that "W3C still lacks a framework to evaluate the environmental impact of its standards."

Opportunities, with conditions

The opportunities section is framed with a condition: AI can make the web "more capable, more accessible and more personal if it is built on the web's existing guarantees."

Its examples include agents working inside a person's active sessions, on-device inference that "keeps personal data on the device," and personal storage with "delegated, revocable authorization." Accessibility gains include generated audio descriptions and sign language, real-time captioning with richer metadata, translation and adaptive layouts.

Structured data gets particular attention. Knowledge graphs bring advantages to retrieval-augmented generation, according to the paper, and "JSON-LD, RDF, DCAT and ODRL become more valuable as inputs and guardrails for agents." JSON-LD is already the format most sites use for schema markup. Verifiable Credentials and decentralized identifiers "can identify agents and express whom they act for" - work PPC Land has followed as W3C advanced DIDs v1.1 and, earlier this month, as W3C pushed signed, revocable ID barcodes.

The nine-point declaration

The centrepiece is "a proposal for a declaration of the value of the web in the AI area" (the paper's wording). The nine points, in the paper's own text:

  1. "The web is for all people - including those who choose to use agents. Agents serve people."
  2. "An agent acting for a person is a user agent. It owes that person loyalty, transparency and safety, as a browser does."
  3. "People stay in control. Consequential actions need real human consent; people can see what was done, undo where possible, and choose which agent acts."
  4. "One interoperable, world-wide web. No agent lock-in nor AI-only side-channels that replace the human web."
  5. "The web's security model is not optional, but agents are a new composant of the model." Origins, sandboxing and credential isolation "apply to agents as they apply to scripts."
  6. "Creators have a voice in how their work is used. Open publishing needs a fair, machine-readable bargain model for training and reuse."
  7. "Accessibility for people comes first. Semantics, alt text and author intent are not to be repurposed for machines to the detriment of humans."
  8. "Trust must be verifiable. Provenance and credentials let people know who and what they are dealing with."
  9. "The web must be sustainable. AI features added to the web should be necessary, efficient and transparent about their resource costs across their whole lifecycle."

The declaration "would extend the Ethical web Principles and the Ethical Principles for Web Machine Learning rather than replace them," according to the paper. Point 4 is the most commercially pointed: it rules out "AI-only side-channels that replace the human web," which reads as a direct counterweight to the separate agent-only endpoints some platforms have built. Point 6 is the closest the paper comes to the compensation question publishers raise - and it stops at "a fair, machine-readable bargain model" without saying what the bargain is.

What W3C groups are saying

The community section is candid about participation. "TPAC has plenty of agentic-web proposals, while nearly half of W3C groups have not answered the AI roadmap survey," the paper states.

The roadmap survey went to 48 groups, and half responded. Most reported "an unchanged mission with rising relevance." According to the paper, the clearest priority shift came from the Linked Web Storage (LWS) group, which raised the need for authorization and delegation. The Timed Text Working Group and the Media and Entertainment Interest Group created the AIRFOT task force for AI-sourced captioning requirements. ARIA participants "cautioned against bending human-centred semantics to suit agents," and the Sustainable Web group flagged lifecycle impacts "without reaching consensus against AI."

At TPAC 2026 breakouts, the agentic web is "the dominant thread," centred on the interface model ("HTML-as-is vs new markup vs WebMCP"), consent for consequential actions, agent alignment and neutrality, and agent identity for commerce. Feedback on the Browser Testing and Tools Working Group charter asked to expand the scope of WebDriver BiDi to agentic use cases.

A map of gaps

A table sorts existing W3C work into seven themes and names the main gap for each.

  • Agents on the web: the proposed Agentic Web WG (WebMCP, agent identity, permissions, transparency), webSkills, and two community groups. The gaps: the declarative versus imperative model, human handoff, and tasks across navigation.
  • AI in the platform: the WebML WG (WebNN), built-in AI APIs, WebGPU, WebAssembly, Web Speech and Generative UI. The gaps: testing non-deterministic behavior, cross-engine support, and user control of where models run.
  • Identity and trust: the DID, VC, Federated Identity, DID Methods and LWS working groups plus four agent-focused community groups, including the Agent Identity Registry Protocol CG and the Agent Trust Protocol CG. The gaps: agent identity profiles, delegated authority, and user intent and consent.
  • Content, provenance and rights: Publishing, AIRFOT, the AI Content Disclosure CG, the AI Computed Provenance CG, TDMRep, a proposed Digital Policy WG built on ODRL, and the Agent-to-Web Framework (A2WF) CG. The gaps: fragment-level metadata, separating disclosure from provenance and training preferences, and "commerce for content."
  • Data and semantics: JSON-LD, RDF and SPARQL, Dataset Exchange, LWS, and the AI Knowledge Representation CG.
  • Payments: the Web Payments WG and Web Payment Security IG. The gap: concrete agentic-payment work items, and the split of work with EMVCo, FIDO and IETF.
  • Horizontal review: the TAG, Privacy, Security IG, accessibility groups, internationalization and Sustainable Web. The gaps: AI-specific review guidance and an environmental evaluation framework.

Policy, without taking sides

On regulation, the paper draws a line. Policymakers "are already regulating AI content, training data and agent liability," and W3C "should offer them standards that can carry those rules, without taking positions on the regulation itself."

The natural hooks, according to W3C, are AI content labelling through the Content Disclosure CG, training-use reservations (TDMRep, robots.txt evolution at IETF, ODRL policies), agent identity and accountability, and environmental reporting. W3C's role is described as explaining the web's architecture, pointing to standards that can implement policy goals, and flagging "where proposed rules would fragment the web or weaken user protections." Positions would be built through a Member-facing forum, with TPAC breakout #43 as the starting point, and coordinated with IETF, ISO/IEC, C2PA, EMVCo and FIDO. A single message set derived from the declaration would be "reused across regions, so W3C speaks with one voice."

Seven recommendations

The Strategy Team lists seven recommendations:

  1. Refine the declaration with the Web and AI Interest Group and the TAG.
  2. Charter the Agentic Web WG "with explicit scope for security and privacy, agent identity and delegation, and the WebMCP-HTML-ARIA relationship" (TPAC breakout #22).
  3. Protect accessibility semantics: ARIA and APA guidance that instructions aimed at agents "must not degrade the accessibility tree," and guidance against prompt injection via ARIA.
  4. Advance a content-use bargain, understanding how TDMRep, ODRL and IETF work "help in balancing the different interests."
  5. Clarify provenance by separating disclosure, provenance evidence and training preferences, "at resource and fragment level."
  6. Close survey gaps, prioritizing horizontal-review groups.
  7. Refine threats, with guidance on testing non-deterministic behavior and on user control over where models run.

Work items for individual groups

The Strategy Team says it "will submit these proposals to each group for discussion." The list is long and specific. The Verifiable Credentials groups would publish an agent use-case note on identity, delegation and responsibility. The Web Payments WG would "name specific agentic-payment work items from the September e-commerce workshop" - apparently the Zurich event that W3C and GS1 announced in June for September 8-9. The Web Payment Security IG would develop payment requirements for AI agents, coordinating with EMVCo, FIDO and KYAPay at IETF.

Elsewhere, the Publishing Maintenance WG would capture AI disclosure, training-permission and alt-text needs as EPUB use cases. The RDF and SPARQL WG would publish a short note on knowledge graphs as agent inputs. The ARIA WG would draft guidance "against agent-oriented misuse of ARIA and prompts in aria-label" - a reference to hidden instructions placed in accessibility attributes.

Paired requirements

A further proposal asks groups whose technologies agents already use to document two lists side by side: what an agent needs to act reliably, and what the person needs to stay safe. "Where they conflict, the person's needs win," the paper states. For the Web Payments WG, that pairs "payment intent, agent mandate and limits, merchant-side signals" with "spending caps, revocation, clear receipts and dispute paths." For forms, it pairs stable field semantics with "review before submit; no silent autofill of sensitive data." For authentication, an agent would present "delegated authority without holding credentials," while the person gets "proof that a human approved; per-agent, revocable permissions." The TAG could add agent considerations to its self-review questionnaires.

Security and privacy actions

The Security Interest Group gets six actions. The first is a family of threat models: one for the web as a foundation, one for agent interactions, a specific analysis of WebMCP, and an "AI in the Browser" model for developer-facing capabilities such as the Prompt API. Threats to consider include "prompt injection, the private-data / untrusted-content / exfiltration trifecta, confused deputies, spoofed tools (no 'padlock' for tools), agents approving their own actions." Other actions cover security requirements for human approval "resistant to prompt fatigue," agent identity threats, facilitated threat-modelling sessions for WebMCP, built-in AI APIs and agentic payments, and AI-assisted security review with human sign-off.

The Privacy Working Group gets nine. It would "test whether W3C's privacy principles still hold when the user agent is an AI agent." The list includes defining meaningful consent for delegated actions ("how long consent lasts, and how to avoid prompt fatigue"), guidance on cross-context data flows including "an 'incognito' mode with no agent memory," and user control over where models run.

Two items touch the advertising stack directly. Item 5 asks the group to consider fingerprinting "from model-backed APIs and agents," including built-in AI APIs and "agent-specific behavior that can identify users." Item 8, "anti-abuse without tracking," proposes reviewing anonymous-credential approaches such as PACT (TPAC breakout #29) "as an alternative to CAPTCHAs and invasive bot detection." For an industry that relies on bot detection to keep fraud out of ad inventory, that is a signal of where W3C's privacy specialists want the tools to go.

A short final list assigns the declaration to the TAG and the Web and AI IG, the WebMCP-HTML-ARIA discussion and human-handoff patterns to the proposed Agentic Web WG, and the ODRL basis for training and reuse preferences to the proposed Digital Policy WG.

What the documents leave out

Several things are absent. Neither document gives a date for chartering the Agentic Web WG or the Digital Policy WG; both remain "proposed." No closing date for feedback appears beyond the October 29 session. The "content-use bargain" has no proposed mechanism, price or payment model, and no AI company is named as having committed to any of the principles. The statistics are entirely third-party, and one sentence (the 40% human traffic loss and 88% Google referral share) has no visible source.

The paper also carries rough edges consistent with a working draft. Its table of contents lists a "Proposed next steps for W3C groups" section but not the "Strategy Team recommendations and next steps" heading that precedes it. The paired-requirements table lists "Web Applications WG" twice in one cell. The declaration is introduced as covering "the AI area," and the EU law is referred to as the "EU Artificial Act." The news post calls the October 29 meeting the "Web and AI Interest Group session"; the paper calls it the "web and AI IG session."

Why this matters for marketing

For publishers and advertisers, the paper matters less for what it decides than for what it treats as settled. W3C's strategy team says plainly that the crawl-for-traffic contract has no replacement for AI systems, that server-side rules fail to control AI crawlers, and that heavily crawled categories have lost human traffic. It also says the browser, not a separate agent channel, remains the place where agents and people meet - which keeps ordinary websites, and the ads on them, in the path of agent traffic.

The proposals that follow will shape the plumbing. Machine-readable training preferences at fragment level, provenance separated from disclosure, agent identity tied to verifiable credentials, payment mandates with spending caps, and bot detection that does not rely on tracking would each change how sites decide which automated visitors to serve. None of it exists yet as a standard. TPAC is where the groups start deciding whether to take the work on.

Timeline

Summary

Who: The World Wide Web Consortium's Strategy Team, in a paper prepared by Philippe Le Hegaret, W3C VP Technical Strategy, addressed to W3C Members, working groups and the wider web standards community.

What: "W3C and the State of the Web in the AI Era," a discussion paper that cites vendor data on AI and agent traffic, lists eight categories of risk, proposes a nine-point declaration on the value of the web, maps gaps in W3C work across seven themes, recommends chartering an Agentic Web Working Group, and sets out proposed actions for more than a dozen groups, including the Security Interest Group and the Privacy Working Group.

When: The paper was finalized on October 20, 2026, and published by W3C on October 21, 2026. It will be presented at the Web and AI Interest Group session on October 29, 2026, during TPAC 2026.

Where: Published on w3.org, with feedback invited through the public-webai@w3.org mailing list and the w3c/webai-roadmap repository on GitHub.

Why: According to the paper, AI agents have moved "from merely reading the web to interacting with it," breaking the crawl-for-traffic contract with publishers and raising security, privacy, accessibility and trust problems. W3C wants to position itself "as the venue where AI and web stakeholders discuss the risks and opportunities of this evolution of web user agents."