Price Discrimination When Both Sides Run Agents

Why Agent-to-Agent Pricing Became a Live Issue in 2026

Two trends collided over the past two years, and the collision is still noisy. On one side, retailers and travel companies spent the past decade building pricing engines that adjust the number a customer sees based on dozens of behavioral signals — a practice regulators now call surveillance pricing. On the other side, a wave of AI shopping agents arrived that can compare, negotiate, and check out on a person’s behalf in the time it takes a human to open a second browser tab. Put those two trends in the same transaction and you get something genuinely new: a pricing algorithm reading signals from a buyer that isn’t a person at all, and often can’t be read the way a person can.

The Federal Trade Commission’s interim staff report on surveillance pricing, published in January 2025 after issuing 6(b) orders to firms including Mastercard, Accenture, McKinsey, PROS, and Revionics, documented a fairly mature industry of vendors selling retailers the ability to set individualized prices from location data, browsing history, device type, and purchase patterns. The report stopped short of declaring the practice unlawful, but it put a spotlight on a business already worth real money to the companies running it. Delta Air Lines added fuel to that spotlight a few months later, when its CEO told investors on an earnings call that the airline intended to expand AI-driven, individualized fare pricing from roughly 3 percent of domestic pricing to something closer to 20 percent by the end of 2025. Three U.S. senators sent Delta a letter within weeks demanding details on how those fares were calculated and whether any protected characteristics fed the model.

Meanwhile, the buyer side of the transaction started running its own software. ChatGPT’s Instant Checkout, built on OpenAI’s Agentic Commerce Protocol with Stripe and initial partners including Etsy and a slate of Shopify merchants, let a chat conversation turn into a completed purchase without the user ever loading a storefront. Perplexity shipped an agentic browser called Comet that could navigate a retail site and complete a purchase on a user’s behalf. Amazon did not take that gracefully: in November 2025 it sent Perplexity a cease-and-desist letter demanding Comet stop making purchases on Amazon’s marketplace, arguing the agent violated its terms of service and degraded the shopping experience Amazon had built for humans and its own AI assistant, Rufus. Perplexity refused, calling the move anti-competitive, and the dispute became one of the first public fights over who gets to buy what, through which software, at what price.

None of this is a side story anymore. It is the shape commerce is taking: a pricing algorithm on one side of the table, a purchasing agent on the other, and a growing set of protocols trying to referee what each side is allowed to know about the other.

How a Seller’s Pricing Engine Tries to Read a Human Buyer

Before agents entered the picture, the segmentation playbook was already sophisticated. Retail and travel pricing platforms build a composite willingness-to-pay score from signals that, individually, look mundane: what device and operating system you’re on, whether you arrived from a paid search ad or a coupon aggregator, how many times you’ve searched the same route or product this week, whether your session shows the hesitation pattern that correlates with price sensitivity, your loyalty tier, your ZIP code, and sometimes your purchase history with that retailer or with data brokers the retailer buys from. None of these signals require reading your mind — they require reading your trail, and a human buyer leaves a long one.

Economists sort this into three degrees, and the vocabulary matters because it shapes which countermeasures actually work.

• First-degree (personalized) pricing tries to charge each buyer close to their individual maximum willingness to pay, built from a personal signal set like browsing history, device fingerprint, and past purchases.
• Second-degree (versioning) pricing doesn’t try to read the individual at all; it offers several bundles — basic, plus, premium — and lets the buyer sort themselves by which one they pick.
• Third-degree (group) pricing charges different prices to identifiable groups — students, seniors, a specific metro area, members of a loyalty program — without pretending to know anything about the individual beyond their group membership.

In the United States, all three are broadly legal outside pricing based on a protected class such as race or, in some states, on facts a lender can’t lawfully use in underwriting. The Robinson-Patman Act constrains discriminatory pricing between business buyers of the same goods, but it has almost no bite on consumer-facing personalization. The European Union treats this territory more cautiously: the GDPR’s restrictions on profiling and the Digital Markets Act’s transparency obligations for large platforms give EU regulators tools that their American counterparts mostly lack, which is part of why European airlines and retailers tend to be more conservative about how visibly personalized their prices get.

What Breaks When the Buyer Is Software, Not a Person

An agent checking prices doesn’t behave like a person, and that’s the whole point of building one. It doesn’t hover over a button for four seconds while deciding. It doesn’t scroll past three unrelated products on the way to the one it wants. It often runs from a cloud data center rather than a residential internet connection, arrives with no cookie history because the session is freshly spun up, and can query five competing sellers within the same second — something no human shopper does, and something pricing engines have historically treated as a fraud or scraping signal rather than a legitimate customer behavior.

That mismatch cuts two ways. A pricing engine that can’t compute a willingness-to-pay score defaults to one of two postures: it either falls back to a flat, unpersonalized list price, or it treats the absence of a normal human trail as suspicious and applies whatever multiplier it reserves for bot-like or unverified traffic, which is frequently the high end of its pricing range rather than the low end, since unverifiable automated requests get bundled with fare-shopping scrapers and chargeback risks the merchant wants to price against. Which posture a given merchant takes depends on its own risk model, and that is precisely why two shoppers using two different agents on the same day can land on two different prices for the identical seat or the identical mattress.

Agent builders have responded the way ad-fraud detection taught an earlier generation of engineers to expect: by making automated traffic look more human. Randomized request pacing, simulated viewport and scroll behavior, and routing through residential rather than data-center IP ranges are all techniques borrowed almost directly from a decade of anti-bot cat-and-mouse in digital advertising. The difference this time is that the “bot” is doing something the person actually asked it to do, which raises a genuine question merchants, regulators, and agent builders are all still arguing about: is a shopping agent fraud-adjacent traffic to be filtered, or is it simply a new, legitimate way for a customer to show up?

The New Segmentation Variable: Detecting the Agent Itself

The Amazon-Perplexity dispute is the clearest public example of a merchant choosing to block rather than price agentic traffic, but blocking is really just the most extreme point on a spectrum that also includes throttling, added friction such as CAPTCHAs, and outright differential pricing. A useful analogy sits in a completely different corner of the internet: Cloudflare’s 2025 “pay-per-crawl” program, which lets publishers charge AI crawlers for access to content instead of blocking them outright. It’s not a commerce transaction, but it’s the same underlying instinct — once a business can reliably tell that a request is coming from an autonomous agent rather than a person, it treats that fact as a pricing lever in its own right, separate from anything the agent’s behavior might otherwise signal.

Retailers and travel sellers facing detected agent traffic tend to land on one of two opposite strategies, and which one they pick says a lot about who they think is on the other end of the request.

Strategy one: price the agent up. If a merchant assumes agentic checkout traffic mostly represents corporate procurement, travel-management platforms, or price-insensitive convenience buyers who value speed over savings, it has every incentive to charge that channel more, the same way many airlines and hotels have long charged a premium for phone or corporate-desk bookings relative to a price-sensitive shopper willing to dig through a comparison site themselves.

Strategy two: price the agent down. If a merchant assumes agentic traffic represents comparison-shopping bargain hunters who will simply take their business to whichever seller quotes the lowest number in the next half-second, it has an incentive to win the sale defensively, quoting its sharpest price the instant it detects a comparison agent rather than risk losing the transaction entirely to a competitor’s engine.

Both strategies are live in the market today, sector by sector, and sometimes merchant by merchant within the same sector. Nothing forces consistency, which is exactly why the four-buyer example below produces such a wide spread from a single starting price.

The Protocols Trying to Referee the Match

A large share of the friction between agents and pricing engines comes down to a trust problem: a merchant has no reliable way to know whether an automated request represents a real person who authorized a real purchase, or a scraper, a scalper bot, or a compromised account. Three protocols launched in quick succession in the second half of 2025 to solve exactly that.

Google’s Agent Payments Protocol, released as an open standard in September 2025 with more than sixty partners including Mastercard, PayPal, Coinbase, and American Express, uses cryptographically signed “mandates” — verifiable records that a specific person authorized a specific agent to spend up to a specific amount on a specific task. OpenAI’s Agentic Commerce Protocol, built with Stripe and launched the same month, powers Instant Checkout inside ChatGPT and gives participating merchants a standardized way to receive an order, confirm identity, and process payment without building a custom integration for every AI assistant that might send them a customer. Visa’s Trusted Agent Protocol, announced in October 2025, focuses specifically on letting merchants distinguish an authenticated shopping agent from anonymous bot traffic at the point of checkout, using attestation data card networks are positioned to verify.

None of these protocols set prices. What they do is give a merchant a legitimate identity signal to replace the guesswork of “is this a bot,” which matters because a merchant that can verify an agent is acting on behalf of a real, authenticated person can choose to treat that request the way it treats a logged-in loyalty member rather than the way it treats an anonymous scraper. That’s the same trust gap that agentic wallets already had to solve on the payment side, where a wallet needs a verifiable way to prove an AI agent has real spending authority before a counterparty will release funds or goods against it. Commerce protocols like AP2 and ACP are effectively extending that same authentication logic from “can this agent pay” to “can this agent be trusted enough to receive a fair quote.”

Being authenticated doesn’t mean being priced favorably, though. A merchant can verify exactly who your agent represents and still choose to charge that verified account its full personalized rate based on loyalty tier, past spend, or declared corporate affiliation. Protocol trust removes the “is this a bot” penalty; it does not remove personalization itself.

A Worked Numeric Example: One Airline Seat, Four Ways to Buy It

Picture a single nonstop coach seat on a domestic route with a published base fare of $340. The airline’s pricing engine applies an adjustment of up to plus or minus 15 percent based on a composite willingness-to-pay score built from roughly forty signals, plus a separate $16 “unverified automation” risk loading it applies to bookings it flags as likely bot traffic, regardless of what that traffic’s willingness-to-pay score comes out to.

• Buyer A — human, high-intent signals. A returning visitor who has searched this exact route six times this week from a corporate email domain. Score pushes the fare up by the full 15 percent: $340 × 1.15 = $391.
• Buyer B — human, price-sensitive signals. A first-time visitor who arrived via a discount-code aggregator, cleared cookies, and is browsing on a device the airline’s data associates with lower average spend. Score pulls the fare down by the full 15 percent: $340 × 0.85 = $289.
• Buyer C — unmasked shopping agent. A headless browser hitting the booking site directly from a data-center IP address, with no cookie history and a request pattern the engine’s fraud model flags as automated. With no behavioral score to compute, the engine defaults to its most conservative treatment and applies the full high-intent multiplier as a precaution, then layers on the $16 unverified-automation charge: $391 + $16 = $407.
• Buyer D — protocol-authenticated agent. An agent operating through a signed AP2-style mandate, carrying only the minimum required attributes and no declared loyalty tier, routed with realistic request pacing. The engine can verify it isn’t fraud-adjacent traffic and has no behavioral signal to score, so it falls back to the unpersonalized list price: $340.

Four buyers, the identical seat, a $118 spread — a 34 percent difference between the cheapest and most expensive outcome — driven entirely by what the airline’s pricing engine could infer about who, or what, was asking. The agent didn’t need to negotiate anything or find a secret discount code. The gap came entirely from signal visibility: whether the requester looked like a price-insensitive human, a price-sensitive human, an unverified bot, or a verified, signal-free agent.

Degrees of Price Discrimination, Translated for the Agent Era

The classic economic categories still apply once you add agents to the transaction; what changes is which signals feed each category and what a buyer’s agent can realistically do about it.

Common Mistakes Buyers and Procurement Teams Make

Assuming an unmasked agent is invisible to the pricing engine. A headless script hitting a booking API from a data-center IP with no cookie history is one of the easiest patterns for a fraud model to flag, and being flagged is usually worse for the price than being unrecognized. Invisibility is not the same as anonymity, and most default agent configurations look far more conspicuous than a human browsing casually.

Treating IP-rotation and header-spoofing as a free engineering trick. It’s a terms-of-service and, in some jurisdictions, a legal exposure decision, not just a technical one. The Amazon-Perplexity dispute exists precisely because a merchant decided an agent’s method of accessing its site crossed a line its terms of service drew, regardless of whether the agent’s underlying purchase intent was legitimate.

Comparing sticker price only. A cheaper agent-sourced quote that comes with a stripped-down fare class, a non-refundable room type, or the loss of loyalty-point accrual isn’t automatically the better deal; the full cost of a restricted offer sometimes exceeds a slightly higher unrestricted one.

Treating one cheap quote as repeatable. Quotes from dynamic pricing engines are frequently session- and timestamp-specific, and repricing can happen within seconds of a repeated request from the same signal set, which is one reason airlines and hotels don’t guarantee a quoted fare survives a second look.

Believing “the agent always gets a discount.” Whether detected agent traffic gets priced up or down depends entirely on what a given merchant assumes that traffic represents, and that assumption varies by industry, by merchant, and sometimes by the day of the week a demand-forecasting model is recalibrated.

Skipping the audit trail. Procurement and expense-reporting teams that can’t produce a timestamped record of what an agent was quoted, and when, have no way to answer a later question about why a particular price was paid, which matters more each year as state-level algorithmic-pricing disclosure requirements expand.

Practical Checklist Before You Let an Agent Negotiate for You

1. Confirm whether your agent uses an attestation protocol such as AP2, ACP, or TAP, and whether the merchant you’re buying from actually honors it.
2. Decide deliberately whether your agent should declare your loyalty or account identity or stay anonymous for a given purchase — you generally can’t have both benefits on the same quote.
3. Pull at least two independent quotes a few minutes apart to see whether the merchant’s engine reprices in response to repeated requests from the same signal set.
4. Total the real cost of each offer — fees, minimum baskets, refund and change restrictions — rather than comparing only the headline number.
5. Keep timestamped logs of every quote your agent captures, especially for business purchases where you may need to justify the price paid later.
6. Avoid IP-rotation or header-spoofing configurations that violate a merchant’s terms of service; treat that as a compliance call, not a technical shortcut.
7. Set a human-review threshold for larger purchases; agentic checkout protocols are built around a person authorizing the mandate, and reviewing bigger spend keeps that intent intact.
8. Re-test your agent’s pricing outcomes every few months. Detection logic and segmentation models change often enough that a configuration that saved money in the spring can cost money by the fall.

Key Takeaways

• Personalized and group-based pricing remain broadly legal in the United States; agents don’t change the legal baseline, they change what signals a pricing engine has to work with.
• Removing your behavioral trail doesn’t guarantee a lower price — unverified automated traffic often gets treated as a fraud risk and priced at the high end, not the low end, of a merchant’s range.
• Merchants split into two camps on detected agent traffic: price it up, assuming it represents price-insensitive bulk buyers, or price it down, assuming it represents bargain-hunting comparison shoppers.
• Attestation protocols like AP2, ACP, and TAP solve a trust problem, not a pricing problem — they replace the “is this a bot” penalty with a verified identity that can still be personalized on its own merits.
• A single seat or product can carry a 30-percent-plus price spread across buyer types with an identical underlying cost basis, driven entirely by signal visibility.
• Masking your agent’s identity too aggressively can violate a merchant’s terms of service, which is the exact dispute at the center of the Amazon-Perplexity conflict.

Frequently Asked Questions

Is algorithmic price discrimination legal in the United States?

Yes, in most consumer contexts. Personalized and group-based pricing are broadly legal outside pricing that relies on a protected characteristic such as race, and outside a few specific statutes governing pricing between business buyers. The FTC’s 2025 surveillance-pricing study raised concerns and recommended continued scrutiny, but it did not establish a ban on personalized pricing.

Do AI shopping agents actually get better prices than humans?

Sometimes, but not reliably. An agent that looks like unverified bot traffic can trigger a fraud-risk premium rather than a discount, while an agent operating through a trusted attestation protocol with no personal signals attached often lands on the plain, unpersonalized list price — which can be cheaper or more expensive than what a specific human would have been quoted, depending on that human’s own signal profile.

Why did Amazon try to block Perplexity’s Comet browser?

Amazon argued in a November 2025 cease-and-desist letter that Comet’s automated purchasing violated its terms of service and interfered with the shopping experience it had built for human customers and its own AI assistant. Perplexity disputed the claim and continued operating the feature, calling Amazon’s move anti-competitive.

What is the Agent Payments Protocol (AP2)?

AP2 is an open standard Google released in September 2025, backed by more than sixty partners including Mastercard, PayPal, and American Express, that lets an AI agent carry a cryptographically signed “mandate” proving a real person authorized it to spend up to a specific amount on a specific task.

Will price discrimination get worse as more shopping becomes agent-to-agent?

It’s more likely to get more precise than more extreme. As attestation protocols mature, merchants gain a reliable way to know who an agent represents, which removes the blunt bot penalty but opens the door to segmenting authenticated agent traffic just as finely as merchants already segment logged-in human accounts.

References

1. Federal Trade Commission, “Surveillance Pricing: A Study of Personalized Pricing Practices,” Interim Staff Report, January 2025.
2. Delta Air Lines, Q2 2025 earnings call commentary on individualized fare pricing expansion.
3. Letters from U.S. Senate members to Delta Air Lines regarding AI-based fare pricing, July 2025.
4. Amazon cease-and-desist correspondence to Perplexity AI regarding the Comet browser agent, November 2025.
5. Google Cloud, “Announcing the Agent Payments Protocol (AP2),” September 2025.
6. OpenAI, “Introducing Instant Checkout and the Agentic Commerce Protocol,” September 2025.
7. Visa, “Introducing the Trusted Agent Protocol,” October 2025.
8. Cloudflare, “Pay Per Crawl: A New Model for AI and Content,” 2025.