Skip to content
Free score
AI shopping agents

OpenAI's Merchant Feed Terms: what retailers agree to before sharing a ChatGPT feed

OpenAI's 13 Oct 2026 feed terms bar merchants from blocking its crawlers and agents and waive TDM opt-outs. What changed, who it affects, what to check.

By the ConversionVector teamUpdated 11 min read

Contents

Direct answer: Since 13 October 2026, a retailer that shares a product feed with OpenAI agrees to three things for as long as the terms run. It must not block OpenAI's crawlers, through robots.txt or any other machine-readable instruction. It must let OpenAI's agents visit and interact with its sites, including by allowlisting their signed Web Bot Auth traffic. And it must not use any text and data mining (TDM) opt-out against OpenAI. The obligations cover the retailer's affiliates too. If your business blocks AI training, or your firewall blocks ChatGPT's agents, settle that before you apply to OpenAI's merchant programme.

This guide sets out what changed, who it applies to, how it sits with OpenAI's own crawler documentation, and a checklist to run before you sign. It also includes a robots.txt check of the retailers in our Agent Commerce Index.

Last verified: 25 October 2026. These are contract terms and they change, so read the current version yourself. This guide is not legal advice.

What changed on 13 October 2026

OpenAI's Merchant Feed Terms of Service now carry the line "Updated: October 13, 2026". We compared the live page with the archived copy from 9 October 2026, which was headed "Published: June 15, 2026".

ClauseBefore (15 June 2026 version)After (13 October 2026 version)
CrawlingNothing on crawler accessMerchant will not, and will not allow its affiliates or anyone acting for them to, "prevent or disallow crawling by OpenAI's and its Affiliates' web crawlers, including through robots.txt files or other machine-readable tags or instructions"
AgentsNothing on agent accessMerchant will "permit OpenAI's and its Affiliates' agents to visit and interact with" its websites, "including by allowlisting OpenAI's and its Affiliates' signed Web Bot Auth traffic"
TDM opt-outsNothing on opt-outsMerchant does not "exercise or reserve any rights under any text and data mining exception, opt out, or similar mechanism" against OpenAI, and if it does, it agrees those rights "will have no effect" with respect to OpenAI
Affiliates"Affiliate" defined only for OpenAIDefined for each party. Merchant affiliates may submit content, and the merchant is responsible for their acts and omissions
Agents submitting for youMerchant responsible for "the acts and omissions of any such agent"The same, now "in connection with the submission"

The rest of the document was unchanged apart from small wording edits. An independent tracker, AI Docs Watch, recorded the same change on 14 October 2026.

When does it apply to existing feed partners? Section 10 of the terms says changes that materially affect a merchant's rights take effect "at least 15 days after being posted or otherwise made available", and are not retroactive. That points to late October 2026 at the earliest for merchants who signed the earlier version. That is our reading of the clause, not OpenAI's statement.

Who the terms apply to

The terms govern any merchant that submits product content to OpenAI "itself or through its agent(s)", including through feeds. In practice there are three routes into ChatGPT shopping, and only some of them involve signing these terms:

RouteWho it is forMerchant Feed Terms?
Direct product feedMerchants who apply through OpenAI's merchant page. OpenAI's Get Started guide says feed onboarding "is currently available to approved partners"; other applicants are on a waitlistYes
Shopify or Etsy catalogueOpenAI says these catalogues are "already integrated" with no application needed. Shopify's ChatGPT help page requires the Shopify Agentic Storefronts Supplemental Terms insteadNot directly; the platform's terms apply. Check them separately
Open web crawlAny store whose product pages OAI-SearchBot can reachNo feed is shared, so no feed terms

Two more points from OpenAI's own pages:

  • Market. "Shopping is currently live for ChatGPT users in the U.S." The feed specification says the standard upload "currently targets the US" and that other markets need OpenAI to confirm "the integration and its allowed countries and currencies". A UK, EU, Canadian or Australian retailer selling to US shoppers is the likely applicant outside the US today.
  • A feed is optional. Asked "Do I need a product feed if ChatGPT already crawls my site?", OpenAI's merchant page answers "No, but feeds give you greater control over how your products appear".

The three obligations in plain English

1. Do not block OpenAI's crawlers

The clause is not limited to the search crawler. It covers "OpenAI's and its Affiliates' web crawlers", and OpenAI's crawler overview lists four: OAI-SearchBot (ChatGPT search), GPTBot (content that "may be used in training"), OAI-AdsBot (ad landing pages) and ChatGPT-User (user-initiated visits). The wording also goes beyond robots.txt to "other machine-readable tags or instructions". We read that as reaching robots meta tags, X-Robots-Tag headers and Content Signals lines aimed at those crawlers, but the terms do not list examples.

There is an obvious tension here. The same crawler overview still says "Each setting is independent of the others", and gives the example of allowing OAI-SearchBot while disallowing GPTBot to opt out of training. The feed terms contain no such carve-out. A retailer that shares a feed and keeps Disallow: / for GPTBot should get a lawyer's view on whether it is in breach.

2. Let OpenAI's agents in, including signed traffic

This is about your firewall as much as your robots.txt. ChatGPT's Cloud browser, the agent that browses sites for ChatGPT Work users, signs its requests with Web Bot Auth, an HTTP Message Signatures (RFC 9421) scheme. OpenAI's allowlisting guide for ChatGPT Work's Cloud browser gives the Signature-Agent value "https://chatgpt.com", the key directory at https://chatgpt.com/.well-known/http-message-signatures-directory, and the identifiers in Cloudflare (bot tag chatgpt-agent, detection ID 129220581), Akamai and HUMAN ("ChatGPT Agent") and Vercel. The same page says that at launch the Cloud browser "cannot sign in to websites or complete payments".

OpenAI's advertiser crawler guidance adds a detail that matters for feeds: "For product feeds, also allow OAI-SearchBot to crawl the product image URLs", and "a 403 response can block feed processing". Image CDNs often sit behind different bot rules from the storefront.

3. No TDM opt-out against OpenAI

Clause (c) is the one with the widest reach. It applies to "any Merchant or its Affiliates' website(s), Merchant Content or other content, data, or materials", not only the products in the feed. A TDM reservation in your website terms, a noai instruction or an ai-train=no signal would, under the terms, have "no effect" with respect to OpenAI.

This matters most in the EU. Directive (EU) 2019/790, Article 4(3) makes the commercial TDM exception conditional on the use not being "expressly reserved by their rightholders in an appropriate manner, such as machine-readable means". Article 53(1)(c) of the AI Act requires providers of general-purpose AI models to have a policy to "identify and comply with" such reservations. Clause (c) asks the merchant to give that reservation up as far as OpenAI is concerned. In the UK, the statutory TDM exception (section 29A of the Copyright, Designs and Patents Act 1988) is limited to non-commercial research, so the position is different again. Take legal advice for each market you trade in.

The affiliates point

All three obligations cover "Merchant and its Affiliates", meaning any entity that controls, is controlled by or is under common control with the merchant. For a retail group, one brand's feed could commit sister brands and the parent's other sites to the same crawler, agent and TDM positions. Map the group's domains before anyone applies.

What our robots.txt check found

On 25 October 2026 we fetched robots.txt for the 240 retailers listed in our Agent Commerce Index (Q4 2026) and read each file under the RFC 9309 matching rules. This is our own observation; individual stores are not named.

FindingRetailers
robots.txt returned and readable218 of 240
No robots.txt we could read (403, 429, other errors or an HTML page)22
Name GPTBot in their own group21
Disallow GPTBot from the whole site3 (2 by name while allowing OAI-SearchBot; 1 through a block on all crawlers)
Disallow OAI-SearchBot or ChatGPT-User1 (the same all-crawler block)
Carry a Content Signals line2, neither with ai-train=no

So for most of these retailers, robots.txt is not where the new terms bite. Only 3 of 218 would need to change it before sharing a feed.

The firewall is the bigger problem. In the Index's basket test, only 8 of 116 stores let a page-fetching agent reach checkout, against 96 for an agent browsing like a person. A retailer that signs the feed terms is agreeing to let OpenAI's agents in, and many stores are not set up to do that today. Our guide to blocking AI shopping agents explains where those blocks usually sit.

One configuration to look for if you use Cloudflare: with Training set to Disallow and Bot Preference Sync on, Cloudflare's managed robots.txt adds Disallow: / for GPTBot, a Content-signal: search=yes, ai-train=no, use=reference line and a statement that those restrictions are reservations under Article 4 of the EU Directive. The same setting also turns on edge blocking for AI training crawlers. All of that conflicts with the feed terms. None of the 218 files we read carried Cloudflare's managed block.

Checklist before you apply

  1. List every domain in scope. Include affiliates' sites, country sites, image and media hosts, and any headless or app domains.
  2. Read robots.txt on each one for all four OpenAI tokens. Look for named groups for GPTBot, OAI-SearchBot, OAI-AdsBot and ChatGPT-User, and for a User-agent: * block that catches them. Our AI access checker compares what robots.txt says with what the server returns. Spec checks ACC-02 to ACC-04 in our scoring specification cover the OpenAI tokens.
  3. Find other machine-readable instructions. Robots meta tags and X-Robots-Tag headers aimed at OpenAI's crawlers, Content Signals lines, and anything your CDN injects. Cloudflare's managed robots.txt is the common one (see above).
  4. Check the firewall, not only robots.txt. Fetch product pages and image URLs as each OpenAI agent and look for 403, 429 or challenge pages (spec check ACC-10). Add an allow rule for OpenAI's signed agent using your CDN's identifier, and make sure proxies keep the Signature, Signature-Input and Signature-Agent headers.
  5. Look for TDM reservations. Website terms, a TDM policy page, ai-train=no signals, or a reservation registered elsewhere. Decide with your lawyer whether you can give them up for OpenAI.
  6. Check price and stock parity. The terms warrant that pricing information "is and will remain complete, correct and current", and section 3 lets OpenAI ask you to fix "discrepancies between the Merchant Content and information displayed on Merchant properties". Compare feed prices with the price in the HTML an agent receives on the product page.
  7. Get a sign-off. The crawler and TDM points touch legal, security, SEO and content licensing. One team should not agree to them alone.

Other clauses worth reading

These were already in the June version, but retailers seeing the terms for the first time should know them:

  • Licence. A "worldwide, royalty-free license" to reproduce, modify and display Merchant Content, plus access "for purposes of a search index and improving the OpenAI Services".
  • No obligation to show you. "Nothing in these Terms requires OpenAI to use or surface any Merchant Content."
  • Liability. OpenAI's total liability is capped at $1,000. The merchant indemnifies OpenAI against third-party claims about its content.
  • Ending it. Either side can end the terms on 30 days' written notice, and the merchant can stop sending content at any time. Termination does not require OpenAI to "modify, delete, or cease providing" any service.
  • Publicity. The merchant "may not make any public statement regarding the relationship" unless the law requires it.
  • Law. California law, with arbitration in San Francisco.

Feed or crawl: making the call

Your positionLikely route
You already allow all OpenAI crawlers and have no TDM reservationA direct feed adds control over how products appear. The terms change little for you
You block GPTBot or reserve TDM rights as a matter of policyStay on the crawl route: allow OAI-SearchBot and ChatGPT-User, keep the training opt-out, and do not submit a feed until legal has reviewed the terms
You sell on Shopify or EtsyYour catalogue already reaches ChatGPT through the platform. Review the platform's agentic terms rather than applying separately
Your firewall blocks AI agents todayFix access first. A feed does not help if the agent cannot load your product page or checkout

Whichever route you take, ChatGPT shoppers still finish on your site: OpenAI's merchant page says "purchases are completed on merchant-owned websites or apps". Our overview of agentic commerce for retailers puts this in the context of the other AI channels.

Common mistakes

  • Treating the feed application as a marketing form. It commits the whole group to crawler, agent and copyright positions.
  • Assuming the GPTBot opt-out survives. OpenAI's crawler page says the settings are independent; the feed terms do not.
  • Fixing robots.txt and forgetting the edge. Cloudflare's managed robots.txt and AI bot policies can reinstate a GPTBot block and an ai-train=no signal. Bot management can also block signed agents.
  • Forgetting the image host. OpenAI says a 403 on product image URLs can block feed processing.
  • Letting a feed agency sign for you. The merchant is responsible for the acts and omissions of any agent that submits on its behalf.

Sources

Questions

What changed in OpenAI's Merchant Feed Terms on 13 October 2026?
OpenAI added a clause to section 3. A merchant that shares product content must not block OpenAI's crawlers through robots.txt or other machine-readable instructions, must let OpenAI's agents visit and interact with its sites, including by allowlisting their signed Web Bot Auth traffic, and must not exercise any text and data mining opt-out against OpenAI. The obligations also cover the merchant's affiliates and anyone acting for them. The previous version, dated 15 June 2026, had no such clause.
Can I block GPTBot and still share a product feed with OpenAI?
On a plain reading of the terms, not without a conflict. The clause covers OpenAI's web crawlers without listing exceptions, and OpenAI's crawler documentation names GPTBot as one of them. OpenAI's crawler page still says the GPTBot and OAI-SearchBot settings are independent, but the feed terms are the contract you sign. Ask your lawyer how the two fit for your business; this is not legal advice.
Do the terms apply to Shopify and Etsy sellers?
OpenAI says Shopify and Etsy catalogues are already integrated and need no application. Those sellers reach ChatGPT through their platform, under the platform's own terms, such as Shopify's Agentic Storefronts Supplemental Terms. The Merchant Feed Terms govern merchants that submit product content to OpenAI themselves or through an agent such as a feed provider.
Do I need a product feed to appear in ChatGPT shopping?
No. OpenAI's merchant page says a feed is not needed if ChatGPT already crawls your site, but that feeds give more control over how products appear. A retailer that wants to keep a training opt-out can stay on the crawl route, as long as OAI-SearchBot can reach its product pages.
Where is ChatGPT shopping available?
OpenAI says shopping in ChatGPT is live for users in the US and will expand to more regions over time. Its feed specification says the standard upload targets the US, and other markets need OpenAI to confirm the integration first. Direct feed onboarding is open to approved partners, and other applicants are on a waitlist.

Published . Last updated . More in AI shopping agents and the guide library.

Related guides