Third-party cookies are finally dying, and something stranger is replacing them: AI agents that browse, click, and buy on behalf of your customers. Identity resolution vendors are scrambling to keep up, and the ones who figure it out first will own the next decade of martech spend. The question for brands isn’t whether to adapt. It’s which vendor bet gets you there without a compliance disaster.
The Old Playbook Just Stopped Working
For fifteen years, identity resolution meant stitching cookies, device IDs, and email hashes into a single customer graph. That model assumed a human was doing the clicking. It assumed browsers would keep cooperating. Neither assumption holds anymore.
Chrome’s cookie deprecation has been a moving target for years, but the direction of travel is clear: fewer third-party signals, more first-party accountability. Meanwhile, a genuinely new complication has emerged. AI shopping agents — think ChatGPT with browsing, Perplexity’s shopping features, or agentic checkout flows from Visa and Mastercard pilots — are now completing purchases without a human ever loading a page. If your identity graph only recognizes browser fingerprints and session cookies, it has no idea an agent just converted a customer on your site.
Gartner has estimated that by the end of the decade, a significant share of digital commerce interactions could be initiated or completed by autonomous agents rather than humans directly clicking through a funnel — a shift that breaks nearly every identity model built for the cookie era.
What “Agent-Driven Web” Actually Means for Identity Vendors
Let’s be specific, because the phrase gets thrown around loosely. Agent-driven web traffic includes: AI shopping assistants completing transactions, browser-based agents (like Copilot’s Actions or Google’s Project Mariner-style tooling) filling forms and comparing prices, and API-to-API commerce where an agent queries your product feed directly, bypassing your front end entirely.
None of that generates a traditional cookie. None of it produces a clean device fingerprint tied to a human session. So identity vendors are pivoting toward three things instead:
- Authenticated first-party signals — logins, loyalty IDs, hashed emails collected with consent, rather than passive tracking.
- Agent fingerprinting — new methods to detect and classify non-human traffic, distinguishing a legitimate shopping agent from a scraper or fraud bot.
- Probabilistic-to-deterministic bridges — using AI models to infer identity confidence scores when deterministic matches aren’t available, then reconciling that against verified first-party data later.
This is a real architectural shift, not a rebrand. Vendors that were essentially cookie-matching businesses with a dashboard are being forced to become identity infrastructure companies, closer to what a CDP or data warehouse provides than what a DMP used to offer.
Who’s Moving Fastest, and Why It Matters to Your Stack
Hightouch has leaned hard into adaptive resolution models that reconcile identity across warehouse-native data rather than relying on external cookie pools — a move we broke down in our review of Hightouch’s adaptive identity resolution. LiveRamp continues to push its authenticated traffic solutions, betting that publisher-level login data will outlast anything cookie-based. Databricks, meanwhile, is folding identity resolution directly into its lakehouse architecture through CustomerLake, which we’ve covered in detail comparing it to traditional CDP approaches and assessing whether the agentic version is actually worth the migration.
The common thread: identity resolution is moving in-house, into the warehouse, and away from third-party black boxes. That’s good news for data governance. It’s less convenient if your team was relying on a vendor to handle the messy plumbing for you.
Why This Is a Compliance Problem, Not Just a Data Problem
Here’s the part legal teams should be losing sleep over. When an AI agent transacts on behalf of a user, who gave consent? The user consented to the agent acting for them, sure, but did they consent to your brand collecting behavioral data from that interaction? Regulators haven’t fully answered this yet, and that ambiguity is exactly why boards are paying attention.
We’ve already argued that identity resolution has become a board-level risk decision, and the agent-driven web only raises the stakes. The FTC has signaled increasing scrutiny of AI-mediated data collection, and the UK’s ICO has published guidance emphasizing that automated decision-making still triggers the same consent obligations as human-initiated data capture. Brands assuming that “the agent did it, not the user” absolves them of consent obligations are making a bet regulators are unlikely to honor. Check current guidance directly from the FTC and the ICO before finalizing any agent-data policy.
If your privacy policy doesn’t currently address AI agent interactions, you have a gap that’s only going to get more expensive to close the longer it sits open.
Fraud Detection Gets Harder When “Non-Human” Isn’t Automatically Bad
Traditional bot detection treats non-human traffic as suspicious by default. That logic breaks down when a legitimate ChatGPT shopping agent is placing a real order for a real customer with a real credit card. Vendors now need to distinguish “malicious bot” from “authorized agent acting on consented instruction,” and that’s a much harder classification problem.
This overlaps directly with creator vetting and influencer fraud detection, where AI has already reshaped the playbook. If you haven’t looked at how AI fraud detection tools price and differentiate for creator vetting, the underlying tech (behavioral pattern recognition, anomaly scoring) is the same infrastructure now being repurposed for agent traffic classification. Our broader buyer’s guide to AI fraud-detection platforms is a useful reference point when evaluating vendor claims here, since marketing copy tends to overstate how mature agent-detection really is.
What Brands Should Actually Do About It
Stop waiting for a perfect standard to emerge. There isn’t one coming soon, and vendors are iterating in real time. Instead:
- Audit your first-party data collection. If consent capture still assumes a human clicking “accept,” update it before agent traffic scales further.
- Ask vendors directly how they classify agent traffic. Get specifics, not marketing language. Can they distinguish OpenAI’s browsing agent from a scraper? How confident is the model, and how is that confidence scored?
- Reassess attribution alongside identity. Agent-driven conversions complicate attribution models just as much as identity graphs. Our piece on attribution versus incrementality is relevant here, since agent traffic tends to break last-click models entirely.
- Push identity into the warehouse where possible. The vendors moving fastest are the ones building resolution logic on top of Snowflake or Databricks rather than an external black box. It’s not just an architecture preference. It’s a governance and portability advantage.
- Build a kill-switch policy for agent interactions you can’t verify. The same governance principles from AI agent kill-switch standards apply directly to identity and fraud edge cases.
None of this is theoretical anymore. eMarketer and Statista have both tracked accelerating adoption of AI shopping assistants, and that curve isn’t flattening. Check eMarketer’s latest consumer AI adoption data and Statista’s commerce forecasts if you need numbers to justify budget internally. The trend line is the argument.
A Word on Vendor Lock-In
Every identity vendor pitching an “agent-ready” solution wants you to believe they’ve solved this. Few actually have. Treat these claims the way you’d treat any premature category creation, with skepticism and a request for a technical deep dive, not a slide deck. The vendors worth trusting will happily show you their agent-classification methodology. The ones who dodge that question are selling vaporware with a 2026 label slapped on it.
Frequently Asked Questions
What is identity resolution in the context of AI agents?
It’s the process of matching a customer’s identity and behavioral data across touchpoints, extended to account for AI agents acting on that customer’s behalf, such as shopping assistants completing purchases or browsing agents comparing products without direct human clicks.
Do third-party cookies still matter for identity resolution?
Their relevance keeps shrinking. Most identity vendors have already shifted primary weight to first-party, authenticated signals like logins and hashed emails, treating cookies as a supplementary rather than foundational signal.
How do vendors detect AI agent traffic versus fraudulent bots?
Leading vendors use behavioral pattern analysis, request-header fingerprinting, and confidence scoring models that assess whether traffic matches known agent signatures (like verified AI shopping assistants) versus unauthorized scraping or fraud patterns. This detection is still maturing and varies significantly between vendors.
Does consent law cover purchases made by AI agents on a user’s behalf?
Regulatory guidance is still catching up, but both the FTC and UK ICO have signaled that automated or agent-mediated interactions don’t eliminate standard consent obligations. Brands should assume existing consent frameworks apply until clearer rules are published.
Should brands move identity resolution in-house or keep using third-party vendors?
It depends on scale and technical resources, but the trend favors warehouse-native resolution (via Snowflake or Databricks-based tools) for greater control and portability, while smaller teams may still benefit from managed vendor solutions during the transition.
Next step: Before your next identity or CDP renewal, ask the vendor for a live demo of their agent-traffic classification, not a roadmap slide. If they can’t show it working today, budget for a re-evaluation in two quarters rather than locking into a multi-year contract now.
Frequently Asked Questions
What is identity resolution in the context of AI agents?
It’s the process of matching a customer’s identity and behavioral data across touchpoints, extended to account for AI agents acting on that customer’s behalf, such as shopping assistants completing purchases or browsing agents comparing products without direct human clicks.
Do third-party cookies still matter for identity resolution?
Their relevance keeps shrinking. Most identity vendors have already shifted primary weight to first-party, authenticated signals like logins and hashed emails, treating cookies as a supplementary rather than foundational signal.
How do vendors detect AI agent traffic versus fraudulent bots?
Leading vendors use behavioral pattern analysis, request-header fingerprinting, and confidence scoring models that assess whether traffic matches known agent signatures versus unauthorized scraping or fraud patterns. This detection is still maturing and varies significantly between vendors.
Does consent law cover purchases made by AI agents on a user’s behalf?
Regulatory guidance is still catching up, but both the FTC and UK ICO have signaled that automated or agent-mediated interactions don’t eliminate standard consent obligations. Brands should assume existing consent frameworks apply until clearer rules are published.
Should brands move identity resolution in-house or keep using third-party vendors?
It depends on scale and technical resources, but the trend favors warehouse-native resolution for greater control and portability, while smaller teams may still benefit from managed vendor solutions during the transition.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →