We checked 658 small online stores before Black Friday. Here is what an AI shopping assistant would find.

Shops tagged in OpenStreetMap with their own website, in 22 cities: Toronto, Vancouver, Calgary, Ottawa, Edmonton, Winnipeg, Halifax, Victoria (Canada, Quebec left out); Austin, Portland, Seattle, Denver, Minneapolis (United States); Bristol, Manchester, Edinburgh, Leeds (United Kingdom); Melbourne, Sydney, Brisbane, Adelaide, Perth (Australia). We left out shops tagged with a brand, any web address listed for three or more shops, social pages and marketplaces, and services such as hairdressers and repairs. That left 12,348 shops. We checked 1,600 of them, in an order set by a fixed seed so the draw can be repeated.

Of the 1600 sites, 11 asked crawlers like ours to stay out, so we read nothing else on them; 411 did not answer over HTTPS, answered with an error (some sites turn automated readers away at the door), or sent us to another web address; 520 showed no sign of selling online. The other 658 are the stores on this page: the site runs on a shop platform, links to a cart or checkout, says add to cart, or links to a product page.

At most four pages a site, one request at a time and at least a second apart: the robots.txt file first and alone, then the home page, the sitemap, and one product page linked from the home page (394 of the 658 stores linked to one we could read). We followed a redirect only within the same site, and only to a page its robots.txt let us read. Email settings come from public DNS records. No browser ran any script, so each page counts as a reader of raw HTML sees it. Our crawler names itself OrbylonScan and obeys robots.txt as RFC 9309 reads it.

A price counts when the product page carries a schema.org price and its currency as JSON-LD or microdata; stock counts on a schema.org availability; a return policy on a schema.org return policy. Saying who the business is counts on a schema.org Organization, LocalBusiness or store type on the home page. Email counts when the domain has SPF and a DMARC policy of quarantine or reject.

OpenStreetMap lists the shops its volunteers mapped, so this is a sample of mapped city shops, not of every store in each country. The four countries were drawn in turn, so each has about as many sites checked as the others whatever its share of the shops, and the overall figures are a plain count across all four, not a weighted estimate for any one of them. We read one product page per store, the first one its home page links to. Passing a check means the facts are there to read; it does not mean any assistant uses them. Assistants also reach products through routes we did not measure: ChatGPT invites merchants to apply to share product data, and says catalogs on Shopify or Etsy are already integrated (chatgpt.com/merchants, read 7 October 2026). A store that fails here can still be found that way. Of the 1314 sites whose robots.txt we read, 11 tell every crawler to stay out of the home page.

SHA-256 of the sorted list of web addresses checked: e4bc6a36e767ba2282072287f50307d335256909c16010cc888597fbd6390684