EasyAIActLabelsBot: What the bot reads and how to block it

EasyAIActLabelsBot is the program behind the store check in the free AI image checker by Easy AI Act Image Labels and behind the Shopify AI Image Index. It only reads what a store shows every visitor publicly. There are four occasions: the store check, the confirmation as owner, the report for confirmed owners and the survey for the index.

What does the bot read?

Store check (someone enters a store address), per request at most:

• the store’s robots.txt, first and before any other request,
• /products.json and /collections.json, the public product and collection lists of a Shopify store, to count products, product images and collections,
• the home page and up to 3 product pages, to see whether an EU label for AI images appears there,
• up to 30 image headers: of up to 30 different delivered product images, the first 512 KB each via a range request, to count on how many copies a provenance marker (C2PA, IPTC) can be read.

Confirm ownership (someone clicks “Confirm ownership” for this store), once per click at most:

• robots.txt and /products.json?limit=1, to recognize the store as a Shopify store,
• 6 pages: the home page (only the footer counts), up to 3 legal notice or contact pages linked from the home page, and Shopify’s built-in legal notice /policies/legal-notice and /policies/contact-information.

There the bot looks for published email addresses. The person who wants to confirm only sees them masked (for example in***@shop.com) and picks one; the confirmation link goes to that address. Only the click in that email confirms the owner.

Report for confirmed owners (after the click in the confirmation email), once per report at most:

• robots.txt and /products.json (up to 20 pages),
• up to 1,000 different product images, the first 512 KB each, to read the provenance marker on every copy.

Index survey (Shopify AI Image Index, at most once per edition and store, one store after the other), per store at most the same requests as the store check. The results are on the Shopify AI Image Index page.

Only totals across many stores are analysed, every published figure covers at least 50 stores. Individual stores are never named, rated or compared. The list of stores read stays internal and is deleted after 15 months at the latest. To exclude your store, block EasyAIActLabelsBot in your robots.txt (the bot follows it) or write to the address below.

The bot fetches nothing else. It does not sign in anywhere, does not enter passwords and does not bypass any browser check.

Why does the bot read Shopify’s legal notice despite robots.txt?

Shopify’s default robots.txt blocks /policies/ for all programs. Shopify set it up that way, not the merchant, and it also hits the legal notice, which by law must be easily accessible (in Germany § 5 DDG). That is why the bot reads exactly the two pages /policies/legal-notice and /policies/contact-information despite this general block: only when someone clicks “Confirm ownership” for this store, once each, without storing them. Everything else it only reads if robots.txt allows it. If your robots.txt has its own group for EasyAIActLabelsBot, that group always applies, including to /policies/.

What does the bot store?

No copies: it reads images and pages and discards them right away.

• Store check: The result consists of numbers (products, product images, collections, whether an EU label is visible, on how many copies a marker can be read) and the addresses of the checked image copies, and stays in a cache for 10 minutes. For each checked copy, the store check shows whether a marker can be read; a missing marker says nothing about how the image was made.
• List of checked stores: I record the domain of a checked store with the time, number and last result of the checks and delete it at the latest 24 months after the last check or ownership confirmation; who checked it is not included. If your robots.txt blocks the bot, I do not record the domain. If you do not want this for your store, write to me at support@easyaiactlabels.com; I will then delete the entry and no longer store future checks (details in the privacy policy).
• Confirm ownership: The bot does not store the addresses it finds. The browser only gets the mask and an encrypted reference per address, which expires after 30 minutes. Only when someone clicks the confirmation link in the email is the confirmed address added to my list (privacy policy).
• Report: Numbers and up to 30 images in detail (file name, image address, product title, provenance data read) are stored for 7 days and can only be reached through the link in the email to the confirmed owner. The owner can delete the report earlier.

How do you block the bot?

The bot follows robots.txt (RFC 9309) and looks for the token EasyAIActLabelsBot. If there is no group for it, it follows the rules for all programs (User-agent: *). To exclude it from your whole store, add:

User-agent: EasyAIActLabelsBot
Disallow: /

In Shopify you change robots.txt through the theme template robots.txt.liquid. If robots.txt excludes the bot, the checker stops the request and tells the person who asked. A group of its own for EasyAIActLabelsBot applies to every request, including Shopify’s legal notice.

How do you recognize the bot?

Its user agent contains EasyAIActLabelsBot and a link to this page.

What about EasyAIActLabelsRadar?

A second program with the user agent EasyAIActLabelsRadar follows the topic of AI labelling: it reads public listings in the Shopify App Store, trade media and official or technical sources (such as the European Commission, C2PA, IPTC and Shopify changelogs), daily or weekly depending on the source. It does not fetch shops. It follows robots.txt and waits at least 2.5 seconds between two requests to the same server. You can block it with User-agent: EasyAIActLabelsRadar.

Contact

Questions about the bot, or a block by other means: support@easyaiactlabels.com. Operator and address: legal notice.