Guide

    Agentic commerce for European brands: GDPR, PSD2 and checkout

    What European brands need for agentic commerce: GDPR for shopper data, PSD2 strong customer authentication at payment, and a checkout they control.

    The Apirro team

    European brands can sell through AI assistants if three things hold: shopper personal data is handled under GDPR, payments still meet PSD2 strong customer authentication, and the order completes in a checkout the brand controls. Product data and agent endpoints carry little personal data; most compliance work sits at checkout and payment.

    GDPR: keep personal data where it belongs

    Catalogue search and cart building can work without personal data. Collect names, addresses and payment details only at checkout, under your existing privacy notice, lawful basis and processor agreements. If a provider processes agent traffic for you, make sure it has a data processing agreement and states where data is hosted.

    PSD2: strong customer authentication still applies

    Under PSD2, most online card payments in the EEA and UK need strong customer authentication, usually 3-D Secure. An agent cannot simply skip it. Practical patterns are handing the shopper to your checkout to authenticate, or using payment provider tools for delegated or merchant-initiated payments where the rules allow.

    Payment authorisation protocols such as AP2 help show what a shopper approved, but they do not replace SCA obligations. Ask your payment provider how it handles agent-initiated payments.

    Checkout: keep control

    A signed cart handoff keeps the order, payment, consumer rights information and records in your own checkout. That also makes it easier to meet EU consumer rules such as clear pricing, delivery costs and withdrawal rights.

    Protocol choices in Europe

    MCP and UCP endpoints mostly expose product data, which carries little regulatory weight. Checkout features inside specific assistants, including ACP-based checkout in ChatGPT and agent checkout in Google surfaces, roll out by market, so check availability for the countries you sell in.

    Apirro serves brands across Europe with Agentic Commerce Infrastructure and signed cart handoff to your checkout. The demo page shows a sandbox store where checkout is always blocked.

    FAQ

    Does an AI agent need my customers' personal data?

    Not to search products or build a cart. Personal data is needed at checkout, which stays under your existing GDPR controls.

    Can an agent pay without 3-D Secure?

    Generally not for customer-initiated payments in the EEA and UK. Exemptions and delegated approaches depend on your payment provider and the transaction type.

    Is this legal advice?

    No. This is a practical overview. Confirm your obligations with your legal adviser and payment provider.

    See an agent shop a live example store

    Open the demo

    More guides