Experian's Agent Trust Splits AI Shoppers Into Verified Humans and Reportable Waste

Experian launched Agent Trust on April 30, 2026, binding AI shopping agents to verified human identities through a real-time Agent Trust Token and an Agent Registry. Built with Visa, Cloudflare, and Skyfire, it splits inbound AI traffic into requests cryptographically tied to a verified consumer and everything else. Add a verified-human-behind-agent field to attribution before unverified bot traffic gets bucketed as buyer intent.

What Agent Trust actually does

The framework runs on three pieces. A Human-to-Agent Binding layer connects a verified consumer to an authorized device and an authorized agent. An Agent Trust Token issues a real-time pass on identity and fraud risk per request. An Agent Registry scores agents over time based on behavior. Experian wraps it under a label called "Know Your Agent," which is the obvious sequel to KYC and not subtle about it.

Kathleen Peters, Experian's Chief Innovation Officer, framed the pitch in the press release: "Agentic commerce will not scale without trust. What's required is verifying the agent, the human behind it, and their intent to purchase." That third clause is the one analytics teams should pay attention to. Verifying the agent is plumbing. Verifying the human is identity. Verifying intent is attribution, and that is where this lands inside marketing rather than fraud.

Why most analytics stacks aren't wired for this yet

Today, AI agent traffic shows up in GA4 and most server-side stacks as one of three things: a bot you're filtering, a session you're crediting like any other human visit, or some inconsistent mix depending on how the agent identifies itself. There is no field that says "this request came from an authenticated agent acting on behalf of a verified consumer named Jane, on her registered device."

Without that field, you get two specific failure modes. One: you over-count agent traffic as buyer intent, then optimize bid strategies and creative rotation against signal that isn't there. We dug into the scale of this in Agent Traffic Grew 7,851%. The numbers there were already ugly before this protocol existed. Two: you under-count it by hard-blocking everything that looks like a bot, including paying customers who happen to be checking out through ChatGPT or Comet. Both failure modes show up in your last-click report as someone else's win.

The Visa, Cloudflare, Skyfire scaffolding

Agent Trust does not work alone. It plugs into Visa's Trusted Agent Protocol, which Visa open-sourced on GitHub. TAP cryptographically binds every agent request to a specific merchant site and the exact page the agent is on, so a token approved for the checkout flow on retailer A cannot be reused on retailer B. Cloudflare provides the network-layer enforcement, the same Cloudflare we wrote about in Cloudflare letting AI agents buy domains. Skyfire contributes the KYAPay interoperability standard so payment can settle in agent-native ways.

If you squint, the stack starts to look like card networks again. Experian is the bureau, Visa is the rail, Cloudflare is the firewall, Skyfire is the wallet. Not a coincidence. Visa cited 4,700% growth in AI-driven traffic to US retail sites. McKinsey is projecting agentic commerce will orchestrate $900 billion to $1 trillion of US B2C retail by 2030. That is too much money to leave running on raw user-agent strings.

What I'd be auditing this week

Three things, and they don't need a formal project.

First, look at your bot filtering rules. If you're blocking anything that doesn't pass a CAPTCHA or doesn't look like a browser, you're going to start blocking authorized agents acting for paying customers. That cost shows up as cart abandonment that isn't really cart abandonment. Check your Cloudflare bot management settings, and any CAPTCHA in your funnel, against the agent traffic patterns you've actually seen in the last 30 days.

Second, add a custom dimension to your analytics for agent traffic: present, verified, unknown. If you are on GA4, that's a custom event parameter. If you are on Snowplow or a server-side stack, it's a column. Default it to "unknown" today. Once Visa TAP and Experian Agent Trust signals start flowing through CDNs, you can flip qualifying sessions to "verified." You want the field in place before the data shows up, not after.

Third, segment your existing reports by traffic origin. Pick your top conversion event and look at how much of the volume in the last 90 days came from sources that are likely agent-driven (ChatGPT referrals, Copilot, Perplexity, Comet, Operator). If that share is meaningful, your benchmarks for next quarter are wrong unless you isolate it.

Verified human behind agent is the next attribution tier, and the analytics stacks that don't have a column for it by Q3 are going to be reporting blended garbage that nobody can act on.

The trust gap nobody booked into the forecast

One slightly off-script thing worth flagging. Experian's announcement quoted research saying 85% of consumers would trust agents to place orders and execute payments. That is the optimistic read. We covered the other read in Exploding Topics' AI shopping trust gap piece, where about a third of consumers said they would authorize zero spend to an AI agent without a human approval step. Both numbers can be true. They probably are. The interesting question is what fraction of the 85% will actually bind their identity to an Experian token versus opt out, and that fraction is the realistic ceiling on how much agent traffic ever gets to the "verified" tier of your reporting.

I think most teams will overcomplicate this. The thing to do isn't to wait for a perfect spec. It is to add the column, tag what you can, and watch the verified share grow as merchants start adopting TAP-compatible plugins through summer. From what I have seen, Sept 1 is roughly the first date at which a CMO is going to ask for a verified versus unverified ratio with a straight face, and the teams who have nothing to show will be the ones explaining why the agent line item in their dashboard is still a single bucket.

One number worth tracking

If you only track one new metric this quarter, make it your verified-agent share of agent-attributed sessions. Start it at zero. Whatever it reads on Sept 1 is roughly how serious your stack is about this transition. Teams that get above 20% by end of Q3 will have negotiating leverage with their attribution vendor. Teams stuck near zero will be told the data limitation is on their end, and they will be right about that.

The reason Experian got into this slot ahead of Equifax and TransUnion is that the bureau model has always been about turning identity verification into a fee-per-lookup business. Agent Trust is the same business with a new fact pattern. Whether agentic commerce ever clears the McKinsey number doesn't really change the marketing job. Either you can tell which traffic is real, or you can't, and that column is going into your stack one way or the other. The only choice is whether you build it before September or get told to build it after.

Notice Me Senpai Editorial