More of Your Business
Is Going Automated. Three Things to Check.

The browser is starting to do the clicking

Google recently expanded Gemini in Chrome on Android, including an "auto browse" feature for Google AI Pro and AI Ultra subscribers in the U.S. that can handle multi-step tasks like updating recurring orders, booking parking and organizing travel.

That sounds like a consumer feature. It's also a website change. We've spent years designing sites around a person reading, deciding and clicking. Increasingly, some of those interactions will happen through software acting for that person. That puts more value on things that were already good practice: clear page structure, plain language, predictable forms, accurate product and service information, and fewer strange steps between intent and completion.

The takeaway: Don't redesign your website for robots. Just make sure a customer, human or otherwise, can clearly understand what you offer and how to take the next step.

Read the Google announcement

SMS is becoming the backup plan, not the security plan

Microsoft began making passkeys the default authentication experience in Entra ID on September 1, 2026, for users enabled for SMS or voice. Those users are being nudged toward passkeys, and Microsoft plans to retire its own SMS and voice delivery for Entra authentication on February 1, 2027. Organizations that still need those methods will need a customer-managed telecom provider.

There's a larger point here than Microsoft. The familiar "password plus a text message" setup has lasted a long time because it's easy. It's also increasingly a target for phishing and social engineering. Passkeys, Windows Hello for Business and FIDO2 hardware security keys are much harder to steal that way.

The takeaway: If your company still treats text-message MFA as the finish line, it's worth moving the line.

Read Microsoft's guidance

"Personalized" pricing is getting a harder look

The FTC is asking for public comment on a proposed enforcement policy around personalized pricing, specifically businesses using personal information to calculate what an individual customer might be willing to pay. This isn't a new blanket ban on dynamic pricing. But the FTC is making its concern pretty clear: if customer data is being used to change the price someone sees, failing to disclose what's happening may run into existing consumer-protection law.

There's an important line here for marketing teams. Personalization can be useful. Different messaging, better recommendations and more relevant experiences can make things easier for a customer. Quietly changing the economics of the deal based on what you know about that individual is a different decision.

The takeaway: The more your systems personalize automatically, the more important it becomes to know exactly what they're changing, and whether you're comfortable explaining it to the customer.

Read the FTC announcement

Walk one customer path without filling in the blanks.

Pick your most important action: request a quote, make a purchase, schedule something, contact sales. Start from your homepage and try to complete it using only what the site actually tells you. If you have to already know where to go, the path isn't clear enough.

Find out who is still using SMS for MFA.

Not who can use something stronger. Who actually is. For Microsoft environments, start moving those users toward passkeys, Windows Hello for Business or another phishing-resistant method before it becomes a rushed migration later.

Write down what your automation is allowed to decide.

AI, ad platforms, CRMs and personalization tools can increasingly make choices without someone manually approving every one. Pick the important systems and ask a simple question: what is this allowed to change on its own? If nobody knows the answer, that's the part to fix.