The traffic that isn't coming back
A Canadian recipe blogger, a used-car listing site in Winnipeg, a home-inspection franchise's local SEO page — none of them are competing for human attention anymore, not entirely. They're competing to be the paragraph an AI agent extracts, summarizes, and never sends anyone to read in full. That's a different business than the one they built.
For twenty years, the deal underneath most of the commercial web was simple enough that nobody had to write it down: search engines crawl your site, humans search, search engines send some of those humans to you, and you turn that visit into an ad impression, a subscription pitch, an affiliate click, or a sale. It wasn't a generous deal — publishers have complained about Google's share of the value for most of those twenty years — but it was a working one. Crawlers respected robots.txt, sites allowed crawling because the referral traffic was worth more than the cost of being indexed, and the whole system assumed a human would eventually land on the page.
That assumption is the thing breaking. Half of consumers are now using AI-powered search in some form, according to McKinsey's research on AI search adoption, and the firm estimates the shift could touch $750 billion in revenue by 2028. Semrush's tracking of search results shows AI-written pages already appearing in a meaningful share of top rankings, with growth that's uneven rather than steady — some sectors seeing sharp jumps, others barely moving. Read together, those two data points establish something specific: this isn't a hypothetical future state. It's a redistribution of traffic that is already underway, unevenly, across different categories of website.
What "zero-click" actually costs
The mechanism matters more than the label. A zero-click search is one where the AI-generated answer satisfies the user on the search or chat surface itself — no visit to the source, no ad impression on the publisher's page, no chance for a paywall to intercept the reader. The user got what they came for. The publisher got nothing, even though the publisher's content is very likely what the answer was built from.
Multiply that by scale and the arithmetic changes. WorkOS's analysis of AI agent behavior makes a point that's easy to underestimate: a single human action can translate into orders of magnitude more HTTP requests than a human browsing session, because an agent doesn't read a page — it fetches it, parses it, and moves to the next one in a fraction of the time a person would spend scrolling. Fortune's reporting on the same shift, drawing on traffic analysis, describes AI agent traffic growing by close to 8,000% and bots now outnumbering humans in overall web traffic — a claim from a single outlet's analysis that should be read as directional rather than precise, but the direction is consistent with everything else in this pack. A separate technical comparison from the developer community puts the contrast in plainer terms: a human visitor might view five or ten pages before leaving; an AI agent can request hundreds of pages or API endpoints in seconds.
None of these figures are independently audited by a neutral third party, and the growth-rate numbers in particular come from vendors with a commercial interest in the AI-agent narrative. That caveat matters. But the underlying claim — that traffic composition on the modern web is shifting from mostly human to increasingly automated — doesn't depend on any single number being exactly right. It depends on advertising, analytics, and security systems that were all designed around the assumption of a human clicking, scrolling, and eventually converting. When the visitor is a script instead of a person, every one of those systems is measuring the wrong thing.
Three businesses, three different exposures
Picture three Canadian small businesses watching the same shift from different positions, because the impact isn't uniform.
The first is a travel booking site whose entire funnel — search, compare, book — is exactly the kind of task an AI agent can now execute end to end, on a user's behalf, without the site's interface ever loading in a browser a human is looking at. If the agent can complete the booking through an API or a structured data feed, the site's carefully designed comparison page, its upsells, its ad placements next to the results — all of that becomes irrelevant. The transaction still happens. The site just isn't part of the experience anymore.
The second is a product review site funded by affiliate links. Its entire business model depends on a human reading the review, trusting it, and clicking through to buy. If an AI answer synthesizes five review sites into one paragraph and hands the user a recommendation, the affiliate click — the only monetization event in that entire chain — never happens. The content still got used. It just didn't get paid for.
The third is a professional services firm — an accounting practice, a law office — whose website exists mainly so people can find their phone number and confirm they're legitimate. For this business, zero-click search might not hurt much at all, because the visit was never the point; being findable and being trusted was. This is the case that complicates any blanket claim about the death of the referral-traffic model: some businesses were never really playing that game to begin with, and they have far less to lose.
That range — from existentially exposed to barely affected — is the honest picture, and it's the reason sweeping claims about "the web" losing its business model deserve skepticism. The web isn't one business model. It's thousands of them, and this shift is redistributing risk unevenly across all of them.
The infrastructure response, and its limits
The industry response so far is technical rather than legal, and it's worth naming plainly: robots.txt extensions, Cloudflare's AI Crawl Control, Really Simple Licensing, and content-provenance standards like C2PA are all attempts to make AI usage of a site's content machine-readable — declarable, trackable, potentially billable. The logic is that if a crawler has to identify itself as an AI agent rather than pretending to be a browser, a publisher can decide, site by site or page by page, what it's willing to allow and what it wants paid for.
That's a real improvement over the current default, where much of this crawling happens without any negotiation at all. It is not a solved problem. Adoption of these standards is voluntary, uneven, and dependent on the crawling AI company choosing to respect them — which is precisely the same trust assumption robots.txt has always rested on, and robots.txt has never been legally enforceable. A licensing standard that a major AI lab simply doesn't observe protects nobody. The honest read is that this is infrastructure for a negotiation that hasn't fully started, not a settled framework publishers can rely on today.
The governance question underneath the traffic question
Canadian organizations deploying AI agents of their own — not just worrying about being crawled by someone else's — inherit a version of the same problem from the inside. The Canadian Centre for Cyber Security's guidance on agentic AI is direct about this: agentic systems that act autonomously across interconnected tools, data, and environments introduce security risks specifically because of that autonomy, separate from whatever risk the underlying AI model carries on its own. An agent booking travel, comparing prices, or filling out a form on a company's behalf is making decisions and touching systems at a machine's pace, and the audit trail for those decisions is often thinner than it should be.
That's the practical intersection of the two problems in this article. The same speed and scale that make agents attractive to deploy — and threatening to publishers whose traffic they bypass — is the speed and scale that makes them hard to govern once they're live inside an organization's own systems. A Canadian business adapting its content strategy to survive zero-click search should be asking the same question about the agents it deploys internally: who owns this, what can it actually touch, and how would we know if it started doing something we didn't authorize.
What adapting actually looks like
There's no version of this that doesn't cost something. Businesses whose model depends on affiliate clicks or ad impressions from human visits have a narrowing set of choices: negotiate licensing terms with AI platforms directly, shift toward subscription or direct-sale relationships where the value exchange doesn't depend on a click, or accept a structurally smaller top of funnel and build a business that doesn't need as much of it. None of those are free, and none of them are guaranteed to work — licensing revenue from AI platforms is not yet a proven substitute for lost ad revenue at scale, for anyone.
For technical and security teams, the practical starting point is less about the business model and more about visibility: knowing which of your own systems already have AI agents connected to them, who's accountable for each one, and what access controls exist if that agent behaves differently than it was scoped to. That's the same discipline zero-click search should be pushing publishers toward from the outside — know what's touching your assets, and don't assume it's asking permission.
The web was built on the premise that value gets created by getting someone to click. Agents don't click, and the businesses built entirely on the assumption that they would are the ones that need to decide, now, what they're worth to a visitor who never actually shows up.
What Leaders Should Do Security and technology leaders should treat AI systems and autonomous agents as governed identities, not informal tools. In practical terms, they should:
- Inventory critical ai dependencies.
- Assign an accountable owner for each agent or ai-enabled workflow.
- Document access controls, authentication, logging, approval boundaries, and revocation paths.
- Test fallback options and incident response playbooks.
- Include ai availability, jurisdictional risk, and auditability in procurement.