Shopify has quietly set boundaries for ‘buy-for-me’ AI bots on merchant sites

Shopify now includes a warning in the code that powers merchant storefronts, telling bots what they can and can’t do. The message appears in each site’s robots.txt file — a standard tool websites use to give instructions to automated crawlers like search engines. The new line states: “Automated scraping, ‘buy-for-me’ agents, or any end-to-end flow that completes payment without a final review step is not permitted.” The change was spotted over the last few days and appears across Shopify storefronts, including Alo Yoga, Allbirds and Brooklinen. The change is visible by appending /robots.txt to any merchant’s URL. 

Related Insights

Generative AI

Mythbuster: Here’s what ‘agentic’ AI actually means for advertisers, agencies and publishers Read More

The change comes at a time when major retailers like Amazon and Walmart are leaning into agentic AI, a nascent technology where bots do everything from recommending products to purchasing them on a customer’s behalf. Shopify has made several moves in the AI space, including partnering with startups like Perplexity and reportedly piloting a shopping feature with OpenAI. But the updated language suggests it wants tighter control over how automated agents operate within its ecosystem.

“It’s really a note for developers who will be poking around,” said Juozas Kaziukėnas, an independent e-commerce analyst. “Shopify is trying to be upfront, saying, ‘We think you’re going to be doing this, trying to build automated checkout on top of our merchants, but we don’t want you to do this.’”

In a post on X, Ilya Grigorik, Shopify’s distinguished engineer and technical advisor to the CEO, said, “Some of you might have noticed we updated the default robots.txt on Shopify storefronts. This change doesn’t add or remove any rules for bots or agents. All we added is a comment for curious humans with a pointer to http://shopify.com/checkout-kit for native integration that delivers a full-featured checkout experience. We offer pre-made SDKs for popular platforms, and a low-level protocol for advanced app & agentic checkout integrations.”

When reached for comment, Shopify directed Modern Retail to Grigorik’s X post.

The move is likely not an outright rejection of agentic AI. The added language directs “legitimate integrators” to use its official Checkout Kit. In other words, the change shows Shopify is thinking ahead, drawing early boundaries between controlled integration and unregulated automation. Shopify merchants could theoretically override the robots.txt file, as Shopify is a content management system, Kaziukėnas said. But the default setting suggests the platform is trying to protect its ecosystem by discouraging unauthorized AI scraping and checkout automation. 

Truly agentic AI may still be years off, but retailers are already laying the groundwork to make their bots more autonomous. As Modern Retail previously reported, Amazon is testing a “buy-for-me” feature that can purchase items from third-party websites for customers. Walmart has also launched a generative assistant, Sparky, that executives say could evolve into a full-fledged personal shopping agent that doesn’t need human inputs to complete tasks. Ultimately, these efforts aim to turn AI from a helper into an actor.

But platforms like Shopify that power a wide array of merchants may see such automation as a threat, particularly when it comes from unverified tools. “Shopify is the biggest pool of DTC brands,” Kaziukėnas said. “A lot of experimental startups have built automation on top of Shopify. And this is Shopify saying, ‘We don’t want to participate.’”

The move echoes recent efforts from cybersecurity company Cloudflare, which announced tools to block AI bots and monetize scraping. 

“The internet as a whole is trying to figure out what the rules of engagement are for AI,” Kaziukėnas said. “Shopify is trying to do the same thing.”