Ninth Circuit Clears AI Shopping Agents as MCP Turns Stateless
A federal appeals court ruled that AI agents shopping on a user's behalf are not unauthorized intruders under anti-hacking law, and the Model Context Protocol's July revision dropped session IDs entirely so agent servers can run on ordinary load-balanced infrastructure. Google widened access to its AI search performance report, and French publishers took Google to their competition regulator over AI Overviews' hit to referral traffic.
This Week's Signals
Ninth Circuit Rules AI Shopping Agents Are Not Hackers
Why it matters for your score
The court held that an agent acting on a user's instruction is legally the user, not unauthorized access under the Computer Fraud and Abuse Act, and vacated Amazon's injunction against Perplexity's Comet shopping agent. If you sell to consumers, a blanket ban on agent traffic just got harder to defend in court, and businesses that choose to welcome agents instead of fighting them start with an advantage.
MCP Drops Session IDs, Becomes a Fully Stateless Protocol
Why it matters for your score
The 2026-07-28 specification removes the Mcp-Session-Id header and the initialize handshake, so a tool server exposed over MCP can now sit behind an ordinary round-robin load balancer instead of pinned sessions. If your product exposes data or actions to agents through MCP, this is the update to test against before an agent client built on the new spec sends a request your server does not expect.
Google Widens Access to Its AI Search Performance Report
Why it matters for your score
More Search Console properties can now see impressions from Google's generative AI search features, broken down by page, country, and device, though clicks and queries are still withheld. It is the closest thing to real measurement most sites have had for AI Overviews visibility, worth checking even though the numbers stay partial.
French Publishers File Antitrust Complaint Over Google AI Overviews
Why it matters for your score
The Alliance de la presse d'information générale asked France's competition authority to intervene, citing independent measurements of 33 to 38 percent traffic loss and a controlled study showing AI Overviews cut outbound clicks by nearly 40 percent, arguing Google used their content without the compensation its 2022 commitments require. Whatever the regulator decides, it previews the negotiating position publishers and other content owners are organizing around against AI answer engines that quote them without sending traffic back.
Emerging Audit Signals
Courts and regulators, not platform terms of service, are increasingly the ones deciding what an AI agent may do on someone else's website.
Protocol specs keep shedding statefulness: MCP's stateless rewrite treats every agent request as disposable and self-describing, the same shift the web made to scale decades ago.
AI-search measurement is arriving in pieces: platforms will show impressions before they show clicks, so treat early reporting as directional, not complete.
Publishers are converting AI-driven traffic loss into a legal and negotiating case rather than absorbing it as a cost of doing business.
What to do this week
- 1
Open Search Console and check Search > Performance for a Generative AI search type filter on your property; if it is live, note which pages are surfacing in AI features even without click data, and cross-check the gaps with Faro's /tools/aeo-citation-monitor to see where you show up in AI answers outside Google.
- 2
If you or a vendor run an MCP server, test it against the 2026-07-28 specification: confirm nothing depends on the retired Mcp-Session-Id header or the initialize handshake, since new agent clients will not send them.
- 3
Revisit your bot-blocking rules and terms of service for shopping or research agents acting on a customer's behalf; a blanket block is harder to defend in the US after this ruling, so decide deliberately which agents to welcome instead of blocking by default.