Google's Universal Commerce Protocol (UCP): How AI Agents Sell Your Products in AI Mode and Gemini

What the popular summary gets right, and what it misses

The short version going around in Slack channels and sales decks: Google built a protocol that lets AI agents sell your products inside AI Mode and Gemini, you flip a switch in Merchant Center, Google approves you, Shopify stores get it for free automatically, and it's US-only for now. Parts of that hold up. Parts don't.

Universal Commerce Protocol (UCP) is real, it is live, and it does connect your catalog to AI Mode and Gemini purchasing surfaces. But "enable it in Merchant Center" undersells what's actually required: this is a developer-level integration (checkout endpoints, authentication, a published UCP profile) layered on top of a clean Merchant Center account, not a toggle. "Shopify stores auto-enabled" is partly true for catalog visibility and overstated for checkout. And "US-only for now" was accurate at launch in January 2026, but Google has already announced expansion plans and started testing outside the US, so calling it US-only as of October 2026 is out of date. Here's what's actually documented, as of October 2026, with sources.

What UCP actually is

UCP is an open-source specification, Apache 2.0 licensed, maintained by a dedicated organization (not a Google-only repo) at github.com/Universal-Commerce-Protocol/ucp, with the full spec published at ucp.dev. The project describes its own goal as providing a standardized common language so AI agents, apps, payment service providers, and businesses can talk to each other without custom one-off integrations for each pairing.

Google announced UCP on January 11, 2026, at the National Retail Federation's Big Show, alongside Shopify, Etsy, Wayfair, Target, and Walmart as initial development partners (TechCrunch). The governance structure that's public on GitHub now goes well beyond those five names. The project runs on vertical-specific "Tech Councils" that set technical direction, and the Shopping Tech Council's published maintainer list includes engineers from Google, Shopify, Amazon, Target, Microsoft, Meta, Stripe, Salesforce, Etsy, and Wayfair. Separate Food and Lodging Tech Councils exist too, with DoorDash, Square, Toast, and Uber Eats on the food side and Expedia, Booking.com, Marriott, and Trip.com on lodging. Google retains one seat that sits on all three councils as a standing Governing Council member, which is worth noting: UCP is genuinely multi-company, but Google isn't a passive bystander in its direction either.

That matters for how you read the word "Google's" in front of "Universal Commerce Protocol." Google initiated it, Google runs the consumer surfaces (AI Mode, Gemini) that make it worth implementing, and Google's own merchant documentation at developers.google.com/merchant/ucp is the main onboarding path most retailers will use. But it isn't a proprietary Google API the way, say, a Google Ads API is. It's closer to how RSS or OAuth works: an open spec that happens to have one company driving most of the early adoption.

UCP, Universal Cart, AP2, A2A: how the pieces fit

These names get used interchangeably in coverage, and that's a real source of confusion, so it's worth separating them plainly.

UCP is the protocol merchants implement on their own servers: the API contract for checkout sessions, cart state, catalog lookups, order status, and identity linking. It's the plumbing.

Universal Cart is the shopper-facing product Google built on top of that plumbing. Google introduced it at I/O 2026 in May, alongside the UCP expansion into hotels and food delivery, describing it as a cross-retailer cart that lets someone collect items from multiple UCP-connected merchants inside Gemini or AI Mode, track price changes, and check out, rather than bouncing between separate retailer carts. Universal Cart is the reason a merchant would bother implementing UCP at all; it's the shelf space UCP earns you. If you're also working on getting your brand mentioned inside Gemini conversations generally, Universal Cart eligibility runs on a completely separate track from that, since one is about being cited in a response and the other is about being transactable inside one.

AP2 (Agent Payments Protocol) is Google's separate, earlier payments-specific standard, maintained in its own repository under the google-agentic-commerce GitHub organization. UCP doesn't replace AP2, it calls it: the UCP spec defines an "AP2 Mandates Extension" and treats AP2 as, in the project's own words, "the standard for secure, agent-led payment transactions" for the fully autonomous end of the spectrum, where an agent transacts without a human confirming each step.

A2A (Agent2Agent) and MCP (Model Context Protocol) are transport layers. UCP is explicitly "transport agnostic," meaning a merchant can expose UCP capabilities over a plain REST API, over MCP, or over A2A, and the protocol itself doesn't care which.

Put together: a shopper uses Universal Cart inside Gemini, which talks to a merchant's UCP-compliant checkout endpoint, which may hand off payment authorization through AP2 if the flow is agent-initiated, over a transport the merchant chose. None of this requires reading a spec document to use as a shopper. For a merchant, it means UCP is the one integration you build, and AP2/A2A/MCP are options within it rather than three more things to separately implement.

How a merchant actually turns this on

Start with the waitlist. Google's guide says merchants must "join the waitlist to get in contact with Google for UCP implementation," and that "your integration must be approved by Google before you can go live on AI Mode in Google Search and Gemini" (Google for Developers). Join it early, because the technical work below only pays off once Google picks up your application.

This is the part where "enable it in Merchant Center" needs correcting. Per Google's own guide, the sequence looks like this:

First, your Merchant Center account itself has to be in order: complete, current product feed, shipping settings, return policies, and business contact information. Google's FAQ is specific that incomplete or stale data here blocks everything downstream.

Second, you build and publish a UCP profile, a machine-readable document that declares which capabilities your business supports (checkout, identity linking, promo codes) so Google's systems can discover and negotiate with you automatically rather than through a manual integration call.

Third, you implement authentication on your own endpoints. Google's requests carry an Authorization: Bearer header, and UCP traffic identifies itself through a UCP-Agent: Profile header and a User-Agent string starting with Google/UCP, so you can distinguish it from ordinary site traffic in your logs.

Fourth, you pick an integration path. Native checkout means the full purchase, including payment, completes on Google's surface: you implement four REST endpoints (create, retrieve, update, and complete a checkout session), and Google Pay is the payment handler, with your payment processor needing to support Google Pay tokenization. The alternative is a cart-based or embedded path, where Google hands the populated cart back to your own site to finish the purchase, closer to how a standard "buy on Google" redirect works today.

Fifth, and this is the step a lot of summaries skip: "Your integration must be approved by Google before you can go live on AI Mode in Google Search and Gemini," per the FAQ. There's no published turnaround time or public checklist for what triggers rejection, which mirrors the lack of a stated review timeline on OpenAI's merchant side, covered in our ChatGPT merchant setup guide.

A few operational details worth knowing before you start: you're required to return a real-time out_of_stock error if inventory runs out mid-session rather than letting a stale feed oversell, and for cross-border orders you return specific error codes (address_undeliverable, address_unverifiable) for addresses you can't fulfill to, instead of silently failing. You also can't geo-restrict UCP traffic at the network level; the FAQ states plainly that you can't limit the protocol to specific countries by blocking requests, and have to handle any geographic limits through your own auth logic or order validation instead. None of this is "flip a switch." It's a scoped but real API project, closer in weight to adding a payment gateway than adding a pixel.

Shopify, and everyone else

The popular claim that Shopify stores are "auto-enabled" is half right. Shopify built Agentic Storefronts with, in its own words, "Catalog, Cart, and Checkout MCPs powered by the Universal Commerce Protocol," and Shopify's marketing specifically says merchants "get your products in AI channels automatically." That claim is about catalog visibility, your products becoming discoverable to UCP-based search, which does appear to happen without a manual opt-in step for many Shopify merchants, similar to how Shopify syndicates catalogs to multiple AI surfaces at once (a pattern also described for ChatGPT in our ChatGPT merchant setup post).

Completing a transaction is a different claim, and the evidence for full zero-touch automation is thinner. Shopify's own developer tooling for UCP (the ucp-cli package, published on Shopify's GitHub) notes that "Shopify-powered merchants support unauthenticated catalog access" for search and discovery, but "checkout requires a Catalog JWT, sign in to the Shopify Developer Dashboard to obtain one." That's a lightweight step compared to building REST endpoints from scratch, but it isn't nothing, and we couldn't find a Shopify statement promising full UCP checkout is live for every merchant with no action required.

For other platforms, the picture is thinner still. Adobe announced in February 2026 that Adobe Commerce was "committing to agentic commerce standards," without a specific UCP go-live date we could confirm. Salesforce sits on UCP's Shopping Tech Council as a named co-developer, which signals intent, not a shipped auto-enablement for Salesforce Commerce Cloud merchants. We found no official BigCommerce or WooCommerce statement confirming automatic UCP enablement at all, only third-party community modules (a Magento 2 implementation from an agency called Magebit, for instance), which is a meaningfully different thing from a platform vendor turning it on for you. If you're on anything other than Shopify, treat UCP as something you or a developer has to implement against the spec directly, the same way you'd treat any new payment integration, until your platform vendor says otherwise in writing.

Country availability: more complicated than "US-only"

At launch in January 2026, UCP's native checkout was scoped to US-based retailers, with Google Pay as the payment handler and PayPal support described as "coming soon." That's the root of the "US-only" claim, and it was true on day one.

It stopped being the full picture by May 2026. At Google I/O that month, alongside the Universal Cart launch, Google announced UCP-powered checkout would expand to Canada and Australia "in the coming months," with the UK following after that, and added hotel booking and food delivery as new verticals alongside retail (PPC Land's coverage of the expansion lists the specific partners added in each vertical). By late September, reporting also pointed to Google testing direct in-Gemini purchases with Flipkart specifically in India, described as a test rather than a general rollout. Google's current FAQ doesn't publish an explicit country allowlist as of this writing, only stating that "at launch" UCP integrations power AI Mode in Search plus the Gemini web and mobile apps. Net: US-only was accurate in January, Canada/Australia/UK were promised by May, and India is being piloted. If you sell primarily outside the US, don't treat this as closed to you, but don't plan a launch date around international availability either, since no firm go-live dates for those markets were published as of October 2026.

Fees, and what nobody is saying

Neither Google's merchant overview nor its FAQ mentions a transaction fee, commission, or revenue share for UCP checkout, native or embedded. That's consistent with how OpenAI has handled the equivalent question for ChatGPT's Agentic Checkout, also undisclosed as of this writing per our earlier reporting. Take the silence at face value rather than assuming "free" or assuming a hidden cut; neither is documented, and pricing pages for agentic commerce in general are still being written across this whole category.

UCP vs OpenAI's ACP

Both protocols converge on a similar shape: merchant-hosted checkout sessions, create/update/complete/cancel operations, webhook-driven order updates, and a tokenized payment handoff rather than the platform directly holding card data. That structural overlap is real enough that one payments executive quoted in trade coverage this month described the two specs as close to interchangeable in practice. Where they differ is scope and governance.

The practical read: if you're already building toward getting cited by ChatGPT and Google AI Overviews, you're likely going to end up implementing something UCP-shaped and something ACP-shaped separately, because they're run by different companies with different approval processes, even though the underlying work (clean product data, a checkout API, webhook handling) rhymes closely enough that doing one well makes the second one faster.

What happens to orders, returns, and customer data

On this point the two protocols and Google's own messaging are consistent: you stay the merchant of record. Google's FAQ states it directly: "You are the Merchant of Record. You retain full ownership of your customer relationships and data." Order status flows back to Google through webhooks you publish (shipped, delivered, returned), rather than Google's systems managing fulfillment. Returns and disputes run through your existing policies, which is also why your return policy has to be current in Merchant Center before you can even start the UCP setup process.

One detail worth flagging for anyone doing a privacy review: Google's FAQ states it retains order data "indefinitely until user deletion request," with your own retention obligations running on a separate track per whatever compliance regime applies to you. That's a meaningfully different data-retention model than a typical payment gateway, and it's worth a conversation with whoever owns privacy policy language at your company before you go live, not after.

The adoption gap nobody's advertising

Here's the part that belongs in any honest October 2026 writeup: UCP is better specified than it is adopted. An Originality.ai scan covered by PPC Land in May 2026 found only 26 sites out of more than 3 million scanned with a publicly detectable UCP implementation, four months after launch, and notably couldn't find a public /.well-known/ucp endpoint on the primary domains of Google, Shopify, Etsy, Wayfair, Target, or Walmart themselves, the same companies listed as co-developers. Search Engine Journal reported in July that an estimated 70% of top retailers remained effectively invisible to agentic commerce entirely. And reporting this month on the wider agentic-commerce picture points at trust, not technical readiness, as the real bottleneck: survey data cited put consumer willingness to let an AI agent complete a purchase on their behalf at roughly 3% of US adults, with about a third of active AI users refusing outright to authorize agent spending.

None of that means skip it. It means UCP in October 2026 is closer to "worth being positioned for, with low competitive pressure to move fast" than "your competitors are already converting customers through it and you're behind." It also means UCP shouldn't be the first thing you tackle if you haven't done the basics covered in generative engine optimization for beginners: clean structured data, crawlable product pages, and consistent entity information matter for whether a UCP-connected product gets surfaced at all, before checkout plumbing even comes into play. The protocol itself has shipped four spec releases since January, each with breaking schema changes, most recently in August, which is itself a signal this is still early and moving.

What's still genuinely unclear

A few things we could not pin down from public documentation, and you should treat as open questions rather than settled facts if someone tells you otherwise with confidence: the exact commission or fee structure, if one ever gets introduced, isn't published anywhere we found. Firm go-live dates for Canada, Australia, and the UK weren't published as of this writing, only "coming months" language from May. Whether Shopify's "automatic" catalog visibility extends to full checkout with zero merchant action, or whether the Catalog JWT step is universally required, isn't stated in one authoritative place. And whether the real-world adoption number has moved meaningfully past the 26-site figure from May wasn't something we could verify with a comparably rigorous scan; treat that number as a May 2026 snapshot, not a current one.

FAQ

Is UCP only for Google surfaces like AI Mode and Gemini?

The protocol itself is platform-neutral and open source, and Microsoft added UCP feed support to Copilot in September 2026, so the spec is already being consumed outside Google. In practice, Google's own AI Mode and Gemini are where the consumer-facing Universal Cart experience lives today, and that's the main reason most merchants are implementing it.

Do I need to apply somewhere, like OpenAI's chatgpt.com/merchants, or is it all through Merchant Center?

It runs through Google's developer documentation at developers.google.com/merchant/ucp, which requires your Merchant Center account to already have a clean, current product feed, shipping settings, and return policy before you start the technical integration. There isn't a separate standalone "apply here" form comparable to OpenAI's merchant application; the process is closer to a developer onboarding flow with a Google approval gate at the end.

Does implementing UCP mean I lose control of pricing, order data, or customer relationships?

No. Google's documentation states explicitly that the merchant remains the Merchant of Record and retains ownership of customer relationships and data. Order updates flow to Google via webhooks you control, and your own return and fulfillment policies govern the actual transaction.

Is Universal Cart the same thing as UCP?

No, and this is probably the most common mix-up. UCP is the technical protocol merchants implement on their servers. Universal Cart is the shopper-facing feature Google built on top of it, launched at I/O 2026, that lets someone shop across multiple UCP-connected retailers in one cart inside Gemini or AI Mode.

Should I prioritize UCP over OpenAI's Agentic Checkout if I can only build one right now?

That depends on where your traffic and audience actually are, not on which protocol has the bigger press cycle. Both require comparable technical work (checkout endpoints, webhooks, tokenized payment handling) and neither has disclosed merchant fees as of October 2026. If you're resourcing this as a single project, start with whichever platform, Google Search and Gemini, or ChatGPT, already sends you meaningful traffic today, and treat the other as a near-term follow-on rather than a parallel build, since the underlying product-feed and policy cleanup work carries over almost entirely between the two.

If you're starting from zero, the most useful first move isn't the checkout API at all. It's making sure your Merchant Center feed, return policy, and shipping settings are actually current, since every path into UCP assumes that's already true before the technical integration even begins. Get that right, read the actual guide at developers.google.com/merchant/ucp rather than a secondhand summary of it (including, eventually, this one), and build the checkout integration only once you've confirmed the current spec version, since UCP has already shipped breaking schema changes four times in its first eight months.