Amazon Buy for Me and Shop Direct in 2026: What Happens When Amazon's Agent Buys From Your Website

Shop Direct puts products from other retailers' websites into Amazon's search results. Buy for Me goes a step further: the shopper taps a button on Amazon, and Amazon's AI agent places the order on the retailer's website with the shopper's name, address and card. The retailer ships it and deals with any return. Amazon takes no fee for it today.

On 22 October 2026 the programme is US-only and large on paper. In March Amazon counted over 100 million products from more than 400,000 merchants, with "tens of millions" of them buyable through Buy for Me, but it has published no order figures. A store can be included without having asked, because Amazon also takes product data from public websites, and leaving means sending an email. Joining by product feed is possible, but the one syndicator that addresses the question says feed products do not get the Buy for Me button yet.

This guide is for brands and merchants with their own online store, on any platform, who sell to US customers and have noticed orders placed by Amazon, or want to decide whether to stay in. For how Amazon's programme compares with ChatGPT, Google, Copilot and Meta, start with our agentic commerce overview.

The Short Version

• You are the seller. Amazon acts as the shopper's agent. Your shipping and returns terms apply; Amazon's A-to-z Guarantee does not.
• You may already be in. Amazon's product data can come "directly from publicly available information on merchant websites". To leave, you email shopdirect@amazon.com.
• The orders look unusual: a forwarding email address per order, one item, card digits the shopper may not recognise, no promo code. Tune fraud rules and support first.
• It is free, for now. Merchants "do not currently" pay.
• Amazon is stricter at home. Agents on amazon.com must identify themselves, and its robots.txt disallows 99 named bots, most of them AI.

What Shop Direct and Buy for Me Are

Amazon's announcement of 11 March 2026 describes Shop Direct as "an AI shopping experience that shows products not currently sold in Amazon's store when customers search for items." The products appear in ordinary search results and in Amazon's shopping assistant, which was called Rufus until 13 May 2026 and is now Alexa for Shopping. On a branded search, Amazon said in November 2025, the assistant shows either a "Buy for Me" button or a "Shop Direct" button. Store names are shown so that "customers know who they're buying from".

• Shop Direct: the shopper is told they are leaving Amazon and lands on your product page. The checkout is yours, as with any referral.
• Buy for Me: the shopper confirms delivery address, taxes, shipping and payment method on Amazon's checkout page. Amazon's AI then completes the purchase on your website "using the customer's encrypted payment and shipping information." The shopper tracks the order on Amazon, in a "Buy for Me Orders" tab.

According to the announcement, only US customers can use either, on Amazon.com, the app, mobile web and the assistant.

From Beta to 400,000 Merchants

In April 2025 Amazon wrote that "brands have the choice if they want to participate"; the current merchant FAQ describes something closer to opt-out. And the numbers count a catalogue, not orders. Amazon says only that it "has referred customers millions of times" to other stores, and gives no order count, conversion rate or revenue for Buy for Me.

How a Buy for Me Order Reaches You

Amazon's merchant FAQ sums it up: "You receive orders through your site's checkout process, and you remain the seller of record."

The parties. The Buy for Me Terms of Use tell the shopper that "we are acting as your agent when we make purchases at your direction, and that the Merchant is the seller of the product(s)." The purchase is "subject to the Merchant's terms and policies", shipping, returns and warranties included, and "subject to confirmation by the Merchant".

The data. You receive the shopper's name, shipping and billing addresses, phone number and an email address. The email is normally a relay: Amazon "may provide a secure, unique email address for each order", forwards your messages to the shopper, and routes the shopper's replies back to your address. Amazon's shopper FAQ also mentions the "email address on file", so do not assume you will never see a real address.

The payment. You charge the shopper's own card: "You will only be charged by the Merchant for the Order Total." Card details are protected "similar to how digital wallets work", so the last four digits in your confirmation email "may look different from your physical card." Amazon shows the shopper an estimated total first. If your total is more than USD 15 above it, the shopper is asked to review it before the purchase goes ahead.

The basket. "Currently, this service only supports orders of a single item." Promo codes are not supported, though discounts your checkout applies automatically are kept.

The customer. Yours. The shopper FAQ says "Amazon's return policy and the A-to-Z guarantee do not apply", and Amazon's help page for shoppers sends them to the brand "for charges, shipping, returns or refunds". Keep sending your normal confirmation and tracking emails; Amazon forwards them.

Amazon's side. Amazon "receives order information", and says it prohibits using it "to make sourcing, inventory level, and pricing decisions for products in our store, including for offerings of Amazon's private brand products." That limits the use; it does not stop Amazon receiving the data. On fees: "Merchants do not currently have to pay to be part of this experience and Amazon does not get a referral fee for Buy for me purchases." The FAQ goes on: "We continue to experiment with ways for merchants to participate in Shop Direct."

After a Shop Direct click, Amazon says it collects no data about what the shopper does on your site and shares nothing about the shopper with you.

How to Recognise and Handle These Orders

In Analytics

Amazon documents one tag, and only for Shop Direct visits: the FAQ says &utm_source=AMZN_US_ShopDirect "will appear in the URL". Give it a channel of its own, so these visits are not lumped into referral or direct traffic.

Buy for Me orders carry no documented tag. You recognise them by what they contain, taken together: a per-order relay address, a single item, card digits the customer may not recognise. Two further signals are reported rather than documented by Amazon. Modern Retail reported in January 2026 that such orders came from addresses at buyforme.amazon, a domain whose public DNS routes its mail through Amazon SES. And Cloudflare's verified bot directory lists "Amazon Buy For Me" with the HTTP user agent Agent/AmazonBuyForMe, an agent that "places orders on e-commerce websites at the direction of customers." Amazon's own programme pages publish no user agent string.

In practice: tag orders whose email ends in the reported domain, log each checkout session's user agent next to the order, and review tagged orders by hand for a few weeks. A hosted platform can tag with an order rule or an app; a custom or headless stack needs a small change in its order pipeline.

In Fraud Rules and Bot Protection

A fraud rule that scores an email that does not match the name, a new email address on every order, or card digits that do not match will see all three on every Buy for Me order. If it declines automatically, you are declining Amazon's shoppers.

Amazon's programme pages say nothing about fraud screening, chargebacks or who absorbs a dispute. The charge is yours, so the cautious working assumption is that a dispute reaches you through your payment provider like any other. Ask Amazon in writing before you count on anything better.

A CAPTCHA, a bot score or a firewall rule in the checkout path can also stop the agent. Cloudflare lists it as a verified bot, so on Cloudflare, check how your settings treat verified bots. Make the choice on purpose, not through a rule written for scrapers. Our agentic payments article covers how agents prove who they are at the edge.

In Customer Service and Returns

Tell your support team before the first ticket arrives:

• The customer bought from you, not from Amazon. Amazon has told them to contact you, and its A-to-z Guarantee and return policy do not apply. Yours does.
• A reply to the relay address reaches the customer, and their replies come back to you.
• The card digits in your confirmation may not match their card. Their payment method was still charged.
• They could not enter a promo code. Decide in advance whether you honour one afterwards.

A first reply your team can adapt:

Thank you for your order. You placed it with us through Amazon's Buy for Me, so we are the seller and our own return policy applies. Reply to this email and your message comes straight to our team.

Two side effects: Amazon's forwarding "may help reduce duplicative promotional emails" to repeat Buy for Me buyers, so your marketing may not reach them; and Amazon's product data is "refreshed regularly", not live, so a store whose prices or stock change by the hour is more exposed to orders placed against stale data.

Joining Through a Feed

Since 11 March 2026 a merchant can send Amazon a product feed through Feedonomics, Salsify or CEDCommerce, by asking its account representative there, or email shopdirect@amazon.com if its syndicator is not one of the three. Amazon also announced that "Additional feed syndicators and an Amazon merchant portal with a merchant-direct feed are coming soon." We found no later announcement of the portal by 22 October 2026.

Amazon has published no feed specification. Salsify and CEDCommerce describe the usual fields: identifiers, titles, descriptions, brand, categories, images, pricing, availability and product URLs. CEDCommerce says the provider "submits the enrollment" once the merchant gives it permission. Salsify says "Amazon and Salsify do not charge any fee or commission for participating in Shop Direct."

Feedonomics, in a post published on 26 March 2026 and updated on 9 September 2026, adds what matters most. It says "the program is currently limited to U.S. merchants", that it is "currently in a beta phase", and that "Buy for Me is not yet offered through this feed-powered beta release." Our reading, which neither company states, is that feed products get the Shop Direct link while Buy for Me runs on products Amazon gathered from public websites. The same post says shoppers will "Soon" be able to use Buy for Me.

So a feed buys control, not Buy for Me orders. Without one, Amazon builds the listing from your public pages, may "combine product descriptions" across stores that sell the same product, and "decides whether, when, and how to display this information". With one, the price, stock and description come from you.

Opting Out, and What It Costs You

The only documented way out is an email. The merchant FAQ: "If you do not wish for your website to participate in this service or wish to provide feedback, you can contact us at shopdirect@amazon.com and we'll respond within 2 business days." There is no form, no switch and no portal, and two business days is a reply time, not a removal date. Name every domain you run, ask whether Shop Direct links and Buy for Me can be handled separately, keep Amazon's reply as your record, and search Amazon for your brand a few days later.

Do not rely on robots.txt instead. Amazon's crawler page says nothing about Shop Direct, and notes that its user-triggered fetcher, Amzn-User, "may not follow all robots.txt directives". No Amazon page says which crawler gathers Shop Direct data, or that blocking one removes a store. Cloudflare lists AmazonBuyForMe as the agent's robots.txt token, but Amazon has not said the agent honours it. Blocking the agent at your firewall may stop its checkouts; nothing Amazon publishes says it would remove your listings.

What leaving costs is the part nobody can price for you. You give up a free place in Amazon's results when shoppers search for your brand, and the visits that come with it. With no Amazon figures to go on, measure first: a few weeks of the AMZN_US_ShopDirect segment and of tagged Buy for Me orders will tell you more than any announcement. What you keep by leaving is control over how your products and prices appear.

Stay In or Opt Out?

No Amazon data settles this. Here is how we would weigh it, by type of store.

• Own products, stable prices, a simple checkout. Stay in and measure, after fixing fraud rules and support. A feed gives you control of price and stock, though on Feedonomics' account it brings the Shop Direct link rather than Buy for Me for now.
• Prices or stock that change often, or trade pricing behind a login. The gap between Amazon's estimate and your checkout is the risk. Send a feed so Amazon's data is current, or opt out.
• Sales built on promo codes, bundles or multi-item baskets. Shop Direct visits reach your full checkout. Buy for Me orders are one item with no code, so check your margin on a single item, shipping included.
• Tight control of presentation. Amazon "may adjust or summarize information for display" and decides what to show. If that is unacceptable, opt out, or at least feed your own data.
• A fraud or bot stack you cannot change quickly. If your checkout will block these orders anyway, you are in the programme without taking its orders. Fix that first, or leave until you have.
• Wary of Amazon learning your demand. Amazon receives order information and says it bars using it for sourcing, inventory and pricing decisions. Whether that promise is enough is a business judgement.
• Outside the US. Every Amazon page limits the programme to US customers, and Feedonomics says the programme is "currently limited to U.S. merchants". If you ship to US customers from elsewhere, ask Amazon whether your store is in scope.

If the Terms or the data restriction decide it for you, read them with your adviser; we are engineers, not lawyers.

Amazon's Own Rules for Agents on amazon.com

Amazon runs an agent on other merchants' checkouts, and sets conditions for everyone else's on its own site. Since a revision dated 30 May 2025, its Conditions of Use have contained "Agent Terms" (the page now says "Last updated: August 14, 2026"). An agent may use Amazon only if "at all times, it identifies itself", and must carry Agent/[agent name] in its user agent string. It may not mimic human keystrokes or navigation, may not solve or get around CAPTCHAs, and must stay away once Amazon asks it to. Amazon's robots.txt gives Disallow: / to 99 named bots, most of them AI crawlers and assistants, among them GoogleAgent-Shopping, ChatGPT-User, Perplexity-User, Claude-User and Copilot.

The contrast is worth noticing: Amazon's Buy for Me pages do not tell merchants how its own agent identifies itself. The Agent/AmazonBuyForMe string comes from Cloudflare, in the format Amazon demands of others.

eBay's Ban

Since 20 February 2026 eBay's User Agreement has banned automated access, naming "buy-for-me agents, LLM-driven bots, or any end-to-end flow that attempts to place orders without human review", "except with the prior express permission of eBay". eBay's robots.txt adds: "Checkouts are strictly for human users." It is not a ban on every AI tool: ChatGPT-User and Claude-User are only kept out of certain paths, while AmazonBot is disallowed almost everywhere.

Amazon v. Perplexity

Amazon sued Perplexity on 4 November 2025 over the agent in Perplexity's Comet browser, under the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act. The appeals court put the core of the dispute down to Perplexity's choice not to send a user agent string that would tell Amazon an AI agent was active, and so let Amazon block it.

The Ninth Circuit held that, on the facts before it, "It is the user who 'accesses' Amazon's computers", and that the assistant "is a tool, not a person for statutory purposes." It added: "We do not establish a new legal regime governing agentic AI." A footnote says the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users." Amazon's amended complaint takes that route, alleging that each use of the agent in the Amazon Store "breaches the contract between Amazon's customer and Amazon". As of 22 October 2026 the case is pending and no injunction is in force.

For a merchant, the lesson is narrow. The appeal decided one element of one statute on one record; it did not make shopping agents lawful everywhere. It pointed site owners to their terms of service, so restricting agents on your own store starts with your terms and your bot policy, and a lawyer should write the terms.

PA-API 5 Retirement for Affiliates and Comparison Tools

This does not touch a Shop Direct listing. It hits the comparison and affiliate tools that send shoppers to Amazon. The Product Advertising API 5.0 has been deprecated and replaced by the Creators API, and calls now return HTTP 403 with "Product Advertising API is deprecated. Please migrate to Creators API". Amazon first set 30 April 2026 as the cut-off, then 15 May 2026; no page we found says on which day calls began to fail.

Migrating means OAuth 2.0 tokens instead of AWS Signature Version 4 signing, https://creatorsapi.amazon/catalog/v1/* instead of https://webservices.amazon.com/paapi5/*, an x-marketplace header, and at least 10 qualifying sales in the past 30 days to get access at all. The Associates Program Policies, updated on 14 April 2026, also bar using program content "to, directly or indirectly, develop or improve large language or multimodal models".

Where to Get Help

We build the plumbing these orders need on a store that does not get it from its platform: order tagging for Buy for Me orders in a custom or headless order system, an analytics channel for AMZN_US_ShopDirect, fraud and bot rules reviewed so the agent's orders are not declined by accident, and product feeds to the syndicators Amazon works with. Our AI agent development and MCP integration service is where that work starts.

Write to office@c9group.dev with your platform, the countries you sell to, and whether you have already seen orders with relay addresses (describe them; do not send customer data). If the decision turns on Amazon's terms or your own, we handle the engineering and point you to an adviser for the legal side: we are engineers, not lawyers.