Can Online Stores Track AI Agent Interactions With Their Websites?

What kinds of AI interaction reach a store?

How do you track crawlers and fetchers?

In logs, not in JavaScript analytics. The main AI crawlers and fetchers, including OpenAI's, Anthropic's and Perplexity's, request pages without running JavaScript, and GA4 excludes known bot traffic, so analytics tools record almost none of them. Your server, CDN or hosting logs record every request with its user agent, IP address, path, status code and time.

To make log data reliable:

• Filter by the declared user agents that OpenAI, Anthropic, Perplexity, Google and others publish.
• Verify by IP range. The main AI companies publish the IP ranges their crawlers use, so you can separate genuine crawlers from scrapers that copy their names.
• Group by path type: product pages, category pages, reviews, policies and checkout.
• Track status codes. Crawlers hitting many 403s, challenge pages or 404s are being blocked or following dead links.

CDNs make this easier. Cloudflare's AI Crawl Control, formerly AI Audit, shows which AI services access your site, how often and on which paths, and lets you allow or block them. Other CDNs and bot management tools offer similar dashboards.

How do you recognise agentic browsers?

Agentic browsers act like shoppers. They load pages, click, fill in forms and sometimes check out. Some of them announce themselves in a way you can verify. When ChatGPT agent browses, it sends a standard Chrome user agent, but adds a Signature-Agent: "https://chatgpt.com" header and a cryptographic signature. The format is HTTP Message Signatures (RFC 9421), under a scheme called Web Bot Auth. You can verify the signature against the keys OpenAI publishes, and bot management vendors, including Cloudflare, can label these requests as verified agents.

Not every agent does this. Agent features built into a shopper's own browser use that person's device, IP address and cookies, and look like an ordinary session. Behavioural patterns, such as very fast navigation or form filling, can hint at automation, but they also match power users and accessibility tools. So treat them as clues, not identification.

Being readable matters more than being able to spot agents. Clear product data, visible prices and stock, and accessible forms help agents complete tasks correctly, as covered in how brands can make their websites readable to AI agents.

How do you track clicks and orders from AI channels?

Clicks. ChatGPT adds utm_source=chatgpt.com to many outbound links. Other assistants send referrers such as perplexity.ai, copilot.microsoft.com or gemini.google.com. Build an analytics segment or channel group for these, and track product views, add-to-cart and purchases within it. Expect undercounting, because app traffic and copied links often arrive with no referrer.

Orders. Commerce platforms increasingly record the AI channel. Shopify's agentic storefronts make products available to channels such as ChatGPT, Google AI Mode and Gemini, Microsoft Copilot and Meta, and are on by default for eligible stores. Shopify says orders from AI channels display in the admin with channel or referrer attribution. ChatGPT sends shoppers to the store's own checkout, in an in-app browser or a new tab. If the store activates direct checkout, Google's AI surfaces, Copilot and Meta can complete the purchase inside the channel through a Shopify-powered checkout. For Google's AI Mode and Gemini, product data comes through the Google & YouTube channel or Merchant Center, and those orders also appear in the admin with their channel.

How checkout on a different domain affects recommendations is covered in whether AI assistants recommend a business when checkout opens on a different domain.

What stays invisible?

• The conversation. No assistant tells you what the shopper asked, which products it compared, or why it recommended a competitor.
• Feed-based discovery. When an AI shopping surface reads your product feed, nothing happens on your site. You see what the platform reports: feed diagnostics everywhere, and, for Google's AI Mode, AI Overviews and Gemini app in the US, Canada, Australia, India and New Zealand, Merchant Center's AI performance insights, which show your brand's visibility and share of voice against similar brands.
• Research that ends without a click. A shopper may ask an assistant, then buy in a store or search your brand a week later.
• Agents in the shopper's browser, as above.

Fill these gaps with direct testing. Ask shopping questions in each assistant, in clean sessions, for your key products and categories, and record which products appear, what prices and stock they show, and which sources they cite. Check that prices and stock match your site. The problem of invented discounts is covered in how to check whether AI assistants invent coupon codes for your store.

How should a store set up AI tracking?

1. Keep raw logs at the server or CDN for at least 90 days, with user agent, IP, path, status and time.
2. Build a weekly crawler report: requests by AI company and by path type, plus error rates.
3. Verify agent signatures where your CDN or bot tool supports it, and label signed agent sessions.
4. Pass a flag into analytics for requests identified as AI agents, using server-side tagging, so you can see what those sessions viewed.
5. Create an AI referral channel in analytics, with conversion tracking.
6. Check platform order attribution for AI channels monthly.
7. Review feed diagnostics and AI performance insights in Merchant Center and any AI merchant programme you join.
8. Run a monthly shopping question test and compare the answers with your catalogue.

What privacy rules apply?

Crawler traffic from company IP ranges is not personal data about shoppers. Agentic sessions and fetches made on behalf of real people can be, especially when they carry the shopper's IP address or cookies. Keep logs no longer than you need, restrict access, and describe the processing in your privacy notice. Do not try to link agent sessions to individuals beyond what your normal analytics consent allows.

What might an illustrative case look like?

Consider an illustrative outdoor gear store that saw ChatGPT referrals in analytics but assumed agents never touched its site. Its CDN dashboard showed thousands of weekly requests from OAI-SearchBot and PerplexityBot, most to product pages, and a steady stream of ChatGPT-User fetches of its returns policy. Signed ChatGPT agent sessions appeared a few times a day, mostly on size guides, and several failed at a size selector built as a custom widget with no labels. The store fixed the selector, added a sizing table in plain HTML, and set up a weekly crawler report. Monthly tests showed assistants quoting its current return window, and agent sessions reached the cart more often.

What do people ask about tracking AI agents?

Can Google Analytics see AI crawlers?

Almost never. The main AI crawlers do not run JavaScript, and GA4 filters known bots. Use server or CDN logs.

Should we block AI agents from checkout?

Only if they cause problems, such as fraud or inventory holds. Blocking verified agents may lose sales people asked the agent to make.

Do we know which prompt led to an order?

No. Platforms attribute the channel, not the question.

Is a signed agent request trustworthy?

A valid signature shows the request came from the service that holds the key. It does not show the purchase is legitimate, so keep normal fraud checks.