Shipping promises, chargebacks and state privacy requests generate most of the work AI agents can take from US e-commerce operations: delay notices, evidence packs, request handling and returns within policy. Fraud decisions, large chargeback calls and privacy denials stay with people. Federal consumer rules, state privacy laws such as the CCPA as amended by the CPRA, and PCI DSS apply.
What do US e-commerce operations leaders spend their time on?
Promises about shipping. Federal rules require online sellers to ship within the time they state, or within a default period if they state none, and to tell customers about delays and give them the option to cancel. At scale, with stock shortages and carrier disruption, keeping track of which orders have slipped and who must be told is a real workload.
Chargebacks. Card disputes, including "friendly fraud" where a customer disputes a purchase they made, cost revenue and fees. Operations decides which disputes to fight, gathers evidence within the card network's deadlines, and tracks outcomes.
State-by-state rules. Sales tax, privacy rights and consumer protection rules vary by state. Privacy requests from California and a growing number of other states arrive with deadlines and verification requirements. Returns peak after the holidays, and every returned item needs inspection, restocking and refund.
Where can AI agents help?
- Shipping-delay notices (depth 3). The agent watches open orders against the promised ship date, sends delay notices with the option to cancel from approved templates, and cancels and refunds when the customer chooses. It records every notice.
- Chargeback evidence packs (depth 2). The agent gathers the order, delivery confirmation, customer communications, IP and device data, and prior orders into the format the card network expects, and drafts a recommendation to fight or accept. A disputes analyst decides.
- Privacy request handling (depth 2 and 3). The agent verifies the requester against the account, locates their data across systems and prepares the response. Routine access responses can go at depth 3 once certified; deletions and any denial are held for a person.
- Returns within policy (depth 3). The agent checks the return against the policy and the item's condition grade, issues the refund under a value limit, and holds exceptions.
- Sales tax exception checks (depth 1). The agent flags orders where the tax calculation looks inconsistent with the delivery address and the business's registrations.
Shipping-delay notices are a good first capability. The rule is clear, the evidence is in the order system, and missing a notice is a compliance failure with many affected customers at once. The agent does the counting reliably; people decide what to do about the stock.
What stays with people, and why?
Fraud decisions stay human. Cancelling orders and closing accounts affect real customers, and false positives cost sales and trust.
Chargeback acceptance above a set value stays with an analyst, as does any decision to contest a dispute where the evidence is weak. Fighting disputes you should lose wastes time and can harm your standing with the card networks.
Privacy request denials and deletions stay with people. A wrong deletion is irreversible, and a wrong denial is a breach of the customer's rights. This is also where the question of jobs comes up: our piece on whether AI agents will replace jobs in operations argues that the work shifts toward judgement and exceptions rather than disappearing.
Which rules apply in the United States?
Federal rules on mail and internet order merchandise require sellers to have a reasonable basis for their shipping promises, to notify customers of delays and to offer cancellation and a prompt refund. Federal consumer protection law prohibits unfair or deceptive practices, which reaches misleading AI-written product claims and fake reviews.
State privacy laws such as California's CCPA as amended by the CPRA give consumers rights to know, delete, correct and opt out of the sale or sharing of their personal information, with deadlines and verification duties. A growing number of states have similar laws with differences in detail. Colorado has passed an AI act aimed at high-risk systems making consequential decisions; most e-commerce operations agents will not be in scope, but check any agent that decides on access to services. There is no single federal AI law.
Card data must be handled under PCI DSS v4.0, and agents should never see full card numbers. Sales tax obligations depend on each state's rules for remote sellers.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Weeks 1 to 4: start with shipping-delay notices. The rule is fixed, the data is in the order system, and customers benefit. Write the templates with counsel.
Weeks 5 to 8: shadow chargeback evidence packs on live disputes. Compare the agent's recommendation and evidence with the analyst's, and track the outcomes.
Weeks 9 to 13: certify delay notices at depth 3 and start privacy request preparation in shadow. Follow deploying AI agents: train, shadow, certify, widen. For how customers' own AI assistants may soon place orders, read what agentic commerce is. Our brief on operations agents in UK e-commerce shows how statutory return rights change the work.
Questions people ask
Can the agent cancel orders when a shipping promise is missed?
It can cancel and refund when the customer chooses cancellation in response to the delay notice. It should not cancel on its own initiative.
Which state privacy laws should the agent handle?
All the states where you have customers and meet the thresholds. Build the request flow once with per-state rules for deadlines and verification.
Can AI write our product descriptions?
It can draft them. A person should check claims about performance, materials and safety, because misleading claims are a consumer protection risk regardless of who wrote them.