Age gates, consent walls and geo-redirects vs AI agents

Why content gates matter for AI agents

AI agents don’t click “I’m over 21” or “Accept all cookies” the way a person does, and agents that read raw HTML can’t click at all. When the server answers with a gate instead of the storefront, the agent sees a page with no products, no prices and no links to follow.

Three gates cause most of the trouble:

• Age gates on alcohol, tobacco, CBD and adult stores that render only the verification form in the HTML.
• Cookie-consent walls that withhold page content until consent is given, as opposed to a banner over a normal page.
• Geo-gates: IP-based redirects from / to a country path, to another domain, or to a “not available in your region” page. AI agents often run in US data centers, so a store that redirects US traffic sends every agent to the same place regardless of where the shopper is. Google’s guidance on locale-adaptive pages warns that crawlers may not see all locale versions for the same reason.

What the scanner checks

The scanner fetches the homepage from a US region, follows redirects (each hop goes through its SSRF guard), and inspects the final HTML.

Signal	How it’s detected	Counts as
Age gate	Text like “are you over 21”, “verify your age”, “enter your date of birth” or “age verification” in the first 5,000 characters of visible text	Fail when the homepage has under 1,200 characters of text (the gate is the page); partial otherwise
Consent wall	A consent-manager script (OneTrust, Cookiebot, Didomi, Usercentrics, TrustArc)	Fail when the homepage has under 400 characters of text; otherwise reported as information only
Region block	“Not available in your country/region” or “we don’t ship to your…” near the top of the page, or HTTP 451	Fail
Locale redirect	/ redirects to a same-origin path like /us or /en-gb	Partial
Cross-domain redirect	/ redirects to a different domain (ignoring www.)	Partial

The result is pass when none of these apply, fail if any fail condition is met, and partial otherwise. If the homepage can’t be loaded, the result is inconclusive.

How to fix content gates for AI agents

1. Render content first, gate second. Server-render the real homepage and product pages, then show the age gate or consent prompt as a client-side overlay. The gate still works for people; agents and crawlers get the content.

   <body>
     <main><!-- full storefront: products, prices, links --></main>
     <dialog id="age-gate"><!-- shown by JS on first visit --></dialog>
   </body>

2. Don’t force IP-based redirects from /. Serve a default region at the homepage with HTTP 200, offer a visible country and currency selector, and declare the other versions with hreflang alternates:

   <link rel="alternate" hreflang="en-us" href="https://your-store.com/" />
   <link rel="alternate" hreflang="en-gb" href="https://your-store.com/gb/" />
   <link rel="alternate" hreflang="x-default" href="https://your-store.com/" />

3. If you must redirect, make it stable. Redirect to a fixed default such as /us, never to a “not available” page for crawlers and agents.

4. Keep the consent banner a banner. Load your consent manager without withholding the page markup; blocking analytics scripts until consent doesn’t require hiding the content.

Verify with curl -L https://your-store.com/. The output should contain product links and prices, not just a form or a message.

How to fix it on Medusa

• What the starter does: the DTC starter storefront’s middleware redirects / to /{countryCode}, which this check reports as partial. The redirect goes to a stable country path, so most agents still reach the catalog.
• To pass: serve a default region at / with HTTP 200, or return a 200 page that links to each region, and rewrite instead of redirect in the middleware.
• Other Next.js storefronts: the same applies to any middleware.ts that redirects by x-vercel-ip-country or a similar geo header.
• See Is Medusa agent-ready? for the full starter checklist.

Common mistakes

• An age-gate app that replaces the whole <body> in the server response.
• A consent “wall” that renders the page only after the consent cookie exists.
• Redirecting US IPs to a .com while serving the brand’s home market on a ccTLD, so every agent lands on the wrong catalog and currency.

Sources

• Google: locale-adaptive pages
• Google: localized versions and hreflang
• Google: JavaScript SEO basics
• RFC 7725: HTTP 451 Unavailable For Legal Reasons