Google Pay rebuilds checkout for AI agent purchases

TL;DR:

• Google Pay is overhauling its payment infrastructure for purchases made by AI agents rather than humans, introducing a Universal Commerce Protocol (UCP) and a new server architecture.
• The aim is to replace visual, UI-dependent checkouts with a stable API backend agents can use, removing the need for bespoke integrations per merchant.
• New cross-device biometric checks let an agent request human approval for a transaction, establishing a “human-in-the-loop” model — while routing transactions through Google raises data and lock-in questions.

Google is preparing its payment rails for a shift it expects to be significant: transactions initiated by autonomous AI agents booking flights, ordering supplies or shopping on a user’s behalf. Because such agents cannot reliably navigate the multi-step, visual checkout pages built for humans, Google is replacing that model with an API-driven backend designed for machines — positioning Google Pay as a clearinghouse for agent-driven commerce.

What is being built, and the trade-offs

The UCP is a specification standardising how agents communicate with payment and merchant systems — initiating transactions, confirming inventory and handling fulfilment in a common language. A new Merchant Commerce Platform server sits in the middle, abstracting backend complexity for developers while, by Google’s design, centralising a large volume of agent transaction data. Dynamic callbacks and expanded WebView support let agents complete payments inside third-party apps, including social platforms where conversational commerce is growing.

That centralisation is the strategic catch. As AI News notes, CIOs must weigh the convenience of a universal standard against reliance on a proprietary protocol and a single data-aggregation point — a familiar platform lock-in calculus. There is also a marketing shift: businesses will need to present pricing and inventory as machine-readable data, effectively “SEO for machines”, or risk becoming invisible to agents that cannot parse their catalogues.

Looking forward

For UK enterprises, the security model is the most immediately practical element. Google’s cross-device biometric authentication lets an agent programmatically request human verification — a prompt on a phone to approve a purchase arranged on a laptop — creating a kill-switch and audit trail for high-value transactions. Defining when an agent may act autonomously versus seek approval becomes a genuine governance task, encoding business policy into software behaviour. The deeper signal is architectural: firms still treating their digital presence as websites for human consumption are building for the wrong customer.