The Record Is Not the Relationship

The cold open

Here’s the question as it ran: if an agent chooses the brand, who owns the customer relationship? Options: The consumer. The brand. The agent platform. The data holder. Core thesis at launch: the interface mediating intent may capture more power than the party fulfilling the transaction.

Booking Holdings filed its 2025 annual report in February. In the risk factors is a description of AI assistants that “may satisfy user intent without directing users to our services,” and a warning that agents “may further evolve into full-service booking platforms, increasing competitive pressure and disintermediating OTCs.” A company that spent two decades standing between hotels and travellers is telling its shareholders, in the required form, how something might come to stand between it and travellers.

The same filing prices the position it is worried about losing. Booking took 14.5% of everything booked through it in 2025, on gross bookings of $186.1bn. It also spent 30.4% of its revenue on marketing. So the interface is worth roughly one dollar in seven of everything that passes through it, and holding the interface costs about a third of what it earns. That is the shape of the asset this week’s poll is about: extremely valuable, and rented.

Last week’s essay closed by putting a marker on this poll, specifically on the fourth option. The marker was that “the data holder” is last week’s winner wearing ownership clothing, and that whoever holds the record of what was promised and what happened has a claim on the relationship whether or not anyone granted them one. I want to withdraw half of that. Holding the record turns out to be the weakest of the four claims, and the reason why is the whole essay.

The vote

The poll closed with 19 votes.

The consumer finished first on 31%, the brand and the agent platform tied on 26%, and the data holder came last on 15%. At nineteen ballots first place is about one vote clear of second, so the order is not the finding. The spread is.

What the tallies cannot show is that the four options are not four candidates for one thing. They are four different senses of the word own, and the poll only looks like a disagreement because all four use the same verb. The consumer owns the intent: they decided what they wanted, and nobody can have that decision without them. The brand owns the fulfilment: it made the thing, it carries the warranty, it takes the return. The agent platform owns the interface: it received the request and it will receive the next one. The data holder owns the record: the file that says this happened.

Pick the sense and you have picked the winner, which is why a room of people who do this for a living splits four ways on a question that has an answer. So the useful move is not to argue about the word. It is to find the one sense of ownership that does something the others cannot.

Interface Capture

Interface Capture: the party that receives the intent accumulates the relationship — whoever fulfils the transaction, and whoever signs the contract — because it is the only party that can open the next conversation without asking permission.

The test that separates the four options is not who was present at the sale. It is who can start the next one unilaterally. Run it and the ordering is not close. The consumer can always begin again, with anyone, at no cost. The agent platform can begin again, because the conversation is the product and it never ended. The brand can begin again only if it holds an address it is permitted to use. The data holder, in most configurations, holds a file and no channel at all.

Shopify publishes the list that settles the brand’s half of this, which saves everyone an argument. In Google AI Mode and Gemini’s direct checkout, some checkout blocks do not load. Among the named types: “Loyalty or rewards experiences,” and “Blocks that collect customer consent during checkout for data usage and communication preferences.” Client-side measurement is gone as well — the checkout “fires only server-to-server pixels (started, completed), so none of the standard or custom client side pixels fire.”

Read that list again as instruments rather than features. Loyalty is how a merchant recognises someone it has met before. The consent block is how a merchant earns the right to write to them afterwards. The pixel is how a merchant learns what actually happened. Those three are not a random sample of a checkout. They are a checkout’s entire apparatus for converting a buyer into a customer, and they are precisely the parts that do not load.

It would be comfortable to file that as a data problem, and it isn’t. Under the Agentic Commerce Protocol that OpenAI and Stripe publish, the merchant receives the buyer’s real name, email address, phone number and shipping address — the spec’s own worked example carries all four, and settlement, refunds and chargebacks stay with the merchant and their payment provider. The record arrives, in full, to the right party. What does not arrive is the permission. OpenAI’s help page for that checkout, since withdrawn, said it “asks merchants to not sign users up for marketing emails from their ChatGPT orders,” and told Etsy buyers that an order would link to an existing Etsy account only if they clicked through from the confirmation email or their ChatGPT order history.

That is the distinction the whole week turns on. A record is a description of something that already happened. A relationship is a standing permission to make something happen again. They arrive through different doors, they are governed by different rules, and an agentic checkout currently delivers the first and withholds the second. Which is not a betrayal by anyone. It is what mediation is, and it has happened three times already in living memory, in public, with the paperwork filed.

Food delivery. DoorDash’s standard restaurant agreement says the customer data belongs to DoorDash. The restaurant that cooked the food receives, per the Second Circuit’s description, “the customer’s first name, last initial, and the order contents,” and may use even that only to fulfil the order. What the platform does with the rest is on the record too: it can identify customers who regularly order pizza and then show them promotions for new pizza restaurants. New York City legislated against exactly this, requiring platforms to hand each restaurant its customers’ full names, phone numbers, email addresses, delivery addresses and order contents, disaggregated, monthly. On 5 August 2026 the Second Circuit struck the law down on First Amendment grounds.

Marketplaces. Amazon’s seller policy is explicit: contact details received to fulfil an order may be used only to fulfil it, must be deleted afterwards, may not be used to contact the customer except through Amazon’s own intermediated messaging, and may not be shared. A separate clause forbids the seller from prompting the customer toward any external site. The FTC alleges that nearly 98% of Amazon sales flow through the Buy Box — one slot, selected by Amazon.

App stores. Users pay Apple, and Apple remits 70% to the developer. The detail worth keeping is from the link-entitlement fight: Apple required external payment links to be static, which meant, as the Ninth Circuit put it, the link “could not identify the user or automatically log that user into their account after clicking the link.” That is not a tax on the transaction. That is a direct attack on recognition — the one thing that turns a repeat buyer into a customer. (The commission question there is not settled: the Ninth Circuit affirmed contempt in December 2025 but reversed the permanent ban on commissions and remanded, so nobody should be quoting a zero-commission steady state.)

And here is the recursion that convinced me this is a structural category and not a framing. Amazon sued Perplexity over its shopping agent, and the harm Amazon pleaded was not theft of data. It was “disrupting Amazon’s customer relationships,” and preventing Amazon “from controlling access to the Amazon Store and, therefore, the quality of the Amazon shopping experience.” That is a hotel’s complaint about an online travel agency, filed by the largest intermediary in American retail, about an agent standing in front of it. Everybody in this chain describes the party above them exactly the way the party below them describes them.

Two federal appeals courts then decided the two halves of the question a day apart, and the interface won both, in opposite directions. On 4 August 2026 the Ninth Circuit vacated Amazon’s injunction against Perplexity, holding that the assistant “is a tool, not a person for statutory purposes” and that it was the user, not the agent company, who accessed Amazon — so a platform cannot treat a consumer’s agent as an intruder. On 5 August the Second Circuit held that a city cannot compel a platform to hand over the customer record. Put them together: the position is neither compellable nor defensible. The incumbent interface cannot be made to share what it holds, and cannot keep the next interface out. So it does not stay put. It transfers to whoever is standing in front of it next, and nothing in either opinion puts a floor under that.

Run the four

The consumer. The answer that is right in law and mostly unexercised in practice. The Ninth Circuit put it plainly on 4 August: however advanced the assistant is, “it is a tool, not a person for statutory purposes,” and it is the user who accesses the merchant’s systems with the agent’s help. So when an agent shops, the shopper is the consumer, full stop — and the consumer can switch interfaces at zero cost, which none of the other three can. The catch is that ownership you never exercise is indistinguishable from ownership someone else holds. Defaults have always decided this, and an agent is a default with a memory.

The brand. Owns the only thing on the ballot that cannot be manufactured by whoever is holding the interface: the thing being bought. That is a genuinely strong position and it is strong in a narrow place. Interfaces are substitutable and now, after August, hard to defend at the door. Preference is not substitutable. The brand’s problem is that it scores on the column this poll did not ask about — it holds the reason someone chooses, and not the channel that carries the next choice.

The agent platform. The mechanism answer. It holds the intent, accumulates the record and is the only party that can reopen the conversation without permission, because the conversation was never a transaction that ended. It also holds something none of the others can inspect. OpenAI’s documentation says a product appears in a ChatGPT carousel when the model “perceives it to be relevant to your intent,” considering context such as memory and custom instructions — its own illustration is that if you have said you dislike clowns, it may leave out clown costumes. Merchants do not see that memory: “Your chats stay with ChatGPT and are not shared with retailers.” Advertisers see less again, receiving “aggregate information about how their ads perform such as number of views or clicks.”

The data holder. The answer that looks most sophisticated and is the weakest of the four, because it confuses custody with ownership. A record without a channel is an archive. DoorDash is the case that proves the point from the other side: it is powerful not because it holds the file but because it holds the file and the channel, which is why it can market a rival restaurant to a restaurant’s own regulars. And the role is not even stable. The EDPB’s guidance is that “if one party in fact decides why and how personal data are processed that party will be a controller even if a contract says that it is a processor” — you cannot allocate it by agreement. So “the data holder” is not a seat at the table. It is a description that lands on whoever is actually deciding, which brings us back to the interface.

What the protocol already says

I should say where the protocol I work on lands on this question, because it does not land where I voted.

AdCP’s Trusted Match data-protection analysis assigns the GDPR controller role to the publisher or platform, and the stated ground is the poll’s exact question: the publisher “is the first party,” they “have a direct relationship with the user,” they collect consent, they hold both context and identity. The brand’s buyer agent is a processor. On AI-assistant surfaces the design principle is more explicit still — “TMP provides inputs; the platform controls the experience,” and “The platform handles selection.” Selection there is not an auction and is not ranked by price: “the platform ranks by relevance to the conversation.”

Then there is the part my own research turned up that I did not enjoy finding. There is no selection-outcome message. The words selected, loss and feedback do not appear anywhere in the 891-line Trusted Match specification, and the repository defines no selection_rationale, decision_lineage or decision_provenance field. A buyer agent submits offers and receives nothing back saying whether its offer was used or passed over. Its entire return path is the exposure token, which exists to close the frequency-capping loop — it records that an ad ran, and carries no account of a decision. The impression itself is defined and reported by the party doing the selecting: it occurs “when the platform’s LLM incorporates a creative manifest into its response to the user,” against a definition that, as the documentation itself notes, no industry body has ratified the way viewability was ratified.

So a brand buying that surface supplies ingredients into someone else’s answer, never learns why it was chosen or passed over, and receives as evidence a number generated by the chooser. That is not a criticism of the spec. It is an accurate description of what mediation is, written down honestly by people building the thing rather than selling it, and I would rather have it in a public document than in nobody’s. But it means the protocol already answers this week’s poll, and it answers it against me. It is also last week’s finding arriving one layer up: the Evidence Premium said proof is worth a premium because almost nobody can produce a number the counterparty accepts. Here the counterparty is the one generating it.

My vote

I voted The brand, and I have an interest to declare: I co-lead AdCP’s Signals and Measurement working group, which means I am arguing against a reading my own working group’s documentation takes.

The case is narrow and I still think it is real. Interface capture captures the default, not the demand. Agents are efficient substitute-finders for interfaces, and August made that cheaper rather than dearer. What they cannot substitute is the thing being bought, and a brand that is genuinely preferred is bought through whichever interface is in front of the customer this year. Being chosen through someone else’s window is a worse position than owning the window, and it is not the same as being disintermediated.

The concession is larger than the case, as it was last week. Every mechanism in this essay runs the other way. The blocks that do not load in an agentic checkout are the brand’s blocks. The record arrives without the permission. The protocol assigns the first-party role to the interface. The two August decisions say the position cannot be compelled open and cannot be defended shut, which is a description of an asset in motion, and the brand is not one of the parties it moves between. Honestly stated: I voted for the party with the best claim in equity and the worst claim in mechanism. “Who owns the relationship” sounds like a question about desert and is a question about capability, and on the capability test the brand finishes behind both the consumer and the agent platform. Not narrowly.

Nor does the usual remedy work. A brand cannot contract its way back in: the EDPB guidance above is explicit that the role follows the facts, and there is no clause that makes you the first party to a conversation you were not in. What is left is not a negotiation, it is a build. Anthropic put out a reference blueprint in September 2026 for commerce agents a business runs on its own surface: a shopping agent embedded in the brand’s own app that searches, compares, plans, fills the cart, answers policy questions and remembers what a customer tells it, with the memory sitting on the brand’s side. That is the only structural answer to interface capture I know of that isn’t a complaint to a regulator — not to be absent from other people’s interfaces, but to hold one of your own, where the memory accrues to you. It is also a far harder product than a feed, and most brands will not build it, which is roughly what the last three examples in this essay would predict.

The small test I would run on my own side of this: look at the last hundred orders and ask how many of those customers you could contact tomorrow without asking anyone. If the honest number is much lower than the order count, you have a record, and someone else has the relationship.

What next week tests

No. 16 closes the season and asks where agentic market power concentrates: setting objectives, controlling access, executing trades, or verifying outcomes. The four options are this season’s own questions wearing different clothes — objectives was Week 1, access was Weeks 2 and 7, execution Weeks 3 and 4, verification Weeks 5 and 6 — so the room will be ranking its own arguments without being told that is what it is doing. On this week’s evidence I expect controlling access to be undervalued, for the same reason “the data holder” was: access sounds like a gate and behaves like a relationship.

The reading here is checkable, and not by waiting for anyone’s announcement. Three tells, in rising order of how much they would change my mind. First: whether the line in Shopify’s unsupported-features list moves, specifically whether the consent block starts loading in an agentic direct checkout. That is a published, dated document, and it is the cheapest possible concession for a platform that wanted to make one. Second: identity linking going from an optional capability to an expected default. Google’s Universal Commerce Protocol currently carries it as a capability a platform may negotiate, which is the honest design; watch whether merchants can require it. Third, and the one that would actually move me: a commerce or advertising protocol shipping a selection-outcome message — a field that tells a losing brand it was considered and passed over, and on what basis. Nobody has built that, in any of the specs I have read this month. Until somebody does, the brand’s evidence that it was chosen is a number produced by the party that chose, and my vote is a position about where preference sits rather than a claim about who holds the customer.