How can I separate AI shopping agents from bots?

Declared crawlers often stay outside ordinary analytics because they do not execute the tracking tag or are filtered. An AI agent operating a browser can look like a person and remain in session reports. Separate known automation, human referrals from assistants and uncertain browser-agent activity before interpreting conversion changes.

The benchmark

Automated visitors send a user-agent string, but not every tool identifies itself distinctly. The source distinguishes these families:

A December 2024 Vercel analysis reported that major non-Google-backed AI crawlers did not execute JavaScript. This is historical infrastructure evidence, not a permanent capability limit. GA4 separately excludes known bots using the IAB list and does not expose a removed-volume counter. The source cites Shopify's September 21, 2026 announcement of human-session reporting by default; verify current filter availability in the store.

HUMAN Security's April 2026 customer-traffic report attributed roughly 71% of activity among its top 10 agents to browser-style agents; ecommerce received 38.20% of agentic traffic in that dataset. Those percentages describe its observed customer population, not all web traffic. Browser-agent products and plan access change; the diagnostic method does not depend on a particular launch date or subscription tier.

The rule

Exclude verified nonshopping automation from the human-shopping KPI, measure actual people arriving from assistants as referred revenue, and retain a separate suspected-agent segment when identification is uncertain.

A shopping agent comparing 10 product pages for one person can generate many views and perhaps sessions for one eventual order. That may lower a session-based conversion rate without indicating a worse experience. But unusual behavior alone does not prove an AI agent. Keep the full metric beside the adjusted view so the team can see the effect of classification choices.

The steps

1. Compare available filters. Inspect the same Shopify session report with and without its human/bot filter. See the bot-filter method. The “human” category means the platform classified it that way, not that every visitor was independently verified.

2. Locate suspicious concentrations. The source supplies this ShopifyQL query against the July 2026 session schema; validate field support in your report before use:

   FROM sessions
   SHOW sessions, bounce_rate, sessions_that_completed_checkout
   WHERE human_or_bot_session = 'human'
   GROUP BY session_country, landing_page_path
   SINCE -30d UNTIL today
   ORDER BY sessions DESC
   LIMIT 50
   

   Start with high-volume rows showing high bounce and no completed checkouts.

3. Combine signals. Look for very low engagement, few sessions per user, thousands of visits without conversions, unusual geography, direct product-page landings and no scroll event. GA4's enhanced-measurement scroll event occurs when 90% of the page becomes visible. These are practitioner clues, not a documented agent-detection algorithm. Geography alone is insufficient.

4. Inspect request evidence. Standard GA4 and Shopify reports do not expose the raw user-agent evidence needed here. Use accessible server logs or a service that observes requests and compare against provider-published verification information. A claimed bot name alone can be spoofed.

5. Keep referrals separate. Check whether your ShopifyQL version supports agentic_referring_channel. Google’s current documentation confirms the “AI Assistant” default channel and ai-assistant medium. It excludes Google AI Overviews and AI Mode, which remain under Organic Search; do not put them in the assistant total by assumption. An assistant referral identifies an arrival source, not necessarily automated browsing.

6. Report uncertainty. Present the platform-filtered conversion rate, the unadjusted reference and the size of the suspected segment. Record changes monthly in the operating log.

The pitfall

Filters do not settle identification. One apparel brand's 12-month GA4 review found roughly 5% of users with bot-like behavior: engagement below 25% against a 54% average, just 18 conversions, and weekly spikes above 5,000% in two Latin American countries. Removing the identified traffic changed conversion from 1.04% to approximately 1.17%. This was a bot network, not proof of AI-shopping-agent activity. It illustrates traffic growth without sales growth.

Blocking everything associated with AI creates the opposite risk. User-triggered retrieval may serve someone comparing your products. Review AI crawlers and robots.txt before blocking useful discovery paths.

What to tell your team

“Sessions rose 18% and orders 2%. The difference concentrates in direct product visits without scrolling. We classify this as probable automation and show both the full and adjusted metrics.” These figures are fictional; probable does not mean verified.

Sources

• OpenAI bots.
• Perplexity bots.
• Google user-triggered fetchers.
• Vercel, December 2024 crawler analysis.
• GA4 known-bot exclusion.
• Shopify session-measurement announcement.
• HUMAN Security, April 2026.
• Claude in Chrome announcement.
• ShopifyQL July 2026 session schema.
• GA4 enhanced measurement.
• channel rules.