On Tuesday, August 4, the Ninth Circuit threw out the order that had kept Perplexity’s AI shopping agent off Amazon.com. The panel did not rule that the agent was welcome. It ruled that Perplexity was never the one visiting.
The case is Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444. Amazon sued in November 2025 under the Computer Fraud and Abuse Act — the federal anti-hacking statute — and its California counterpart, the Comprehensive Computer Data Access and Fraud Act. In March 2026 Judge Maxine M. Chesney of the Northern District of California granted Amazon a preliminary injunction, calling it a close question in a tentative ruling before issuing the written order. Perplexity appealed the next day. The Ninth Circuit stayed the injunction, heard argument in Seattle on June 11, and has now vacated it outright and sent the case back down.
Reuters called it the first federal appellate ruling on whether AI agents acting for a user may legally reach into someone else’s website. That description is right, and the reasoning is narrower and stranger than the headline suggests.
The Case Turned on Where the Screenshots Go
Perplexity’s Comet is a browser. It runs on your machine like Chrome does. Its distinguishing feature is an optional agent — the Assistant — that Perplexity describes as performing tasks at the user’s direction, including shopping on Amazon.
Here is how that works, and the mechanism decided the case. When you tell the Assistant to find something on Amazon, it takes screenshots of the browser window on your computer, sends those screenshots to Perplexity’s servers, and gets back instructions on where to click next. Your browser is the only thing talking to Amazon. Perplexity’s servers never contact Amazon’s servers at all.
An amicus brief from the Electronic Frontier Foundation, Mozilla, EleutherAI, Digital Medusa, and the Alliance for Responsible Data Collection laid this out for the court, and the panel adopted the description: what is clear, Judge Milan D. Smith, Jr. wrote, is that Perplexity does not directly communicate with Amazon’s servers.
That left one question. Does Perplexity access Amazon through the Assistant?
“A Tool, Not a Person”
The answer came out of the statute’s first word. The CFAA provision Amazon invoked punishes “whoever…intentionally accesses” a protected computer. The panel read that literally: the law contemplates access by a person. It cited the federal definition of “whoever” — individuals, corporations, companies, partnerships — and, for good measure, the Cambridge dictionary entry.
Add the Supreme Court’s definition from Van Buren v. United States, where “access” means entering a computer system or a part of one, and the chain closes. Perplexity never entered Amazon’s system. The Assistant cannot “access” anything, because it is not a whoever. What remains is the user, who accessed Amazon with the help of a tool — exactly as they would with a browser extension or an autofill feature.
Perplexity had pressed that analogy hard: this is Safari filling in your address and payment details at checkout. Amazon answered that the Assistant is different in kind, because it navigates on its own and, in Perplexity’s own marketing language, “behaves like an efficient human shopper.” The panel found the autonomy argument insufficient to make Perplexity the actor.
| Amazon’s argument | What the panel held |
|---|---|
| The Assistant acts autonomously under direction from Perplexity’s servers, so its conduct belongs to Perplexity | The CFAA punishes a “whoever.” The Assistant is a tool, and receiving screenshots and sending instructions is not gaining entry to Amazon’s servers |
| Facebook v. Power Ventures makes a developer liable for user-directed conduct after a cease-and-desist | That court assumed access without analyzing it, and Power’s own systems caused messages to be sent inside Facebook. Perplexity’s do not |
| California’s CDAFA defines “access” more broadly and does not require that information be obtained | Possibly broader, but it still asks who is accessing or causing access — so the claims “rise and fall together,” and the answer is the user |
| Blocking Comet and detecting it cost well over the CFAA’s $5,000 loss threshold in employee time | Not reached. The claim fails at “access,” so the panel declined to address the remaining elements |
The Theory That Would Have Made Shoppers Into Accomplices
The panel reinforced its reading with the rule of lenity. The CFAA is primarily a criminal statute, and courts read its provisions the same way in civil and criminal cases, so ambiguity gets construed against liability. Accepting Amazon’s interpretation, the court said, would require a reading far afield from a law Congress wrote to stop computer hacking.
Then it named the consequence, and this is the part worth pausing on. If using the Assistant on Amazon.com is Perplexity’s unauthorized access, then the customer who switched it on helped commit a federal crime — exposed, in the panel’s words, to liability under a conspiracy or aiding-and-abetting theory. Quoting its own precedent against criminalizing “a broad range of day-to-day activity” simply because a computer is involved, the court concluded it was unlikely Congress meant to put ordinary shoppers in that position.
Amazon lost the rest of the injunction test too. Its irreparable-harm evidence was declarations that the Assistant might not pick the best price, delivery method, or recommendation for a shopper — a degraded experience the panel called abstract next to the concrete customer losses in earlier cases, especially given that the shopper chose the tool. Its security case fared worse: Amazon’s own expert had been unable to fully replicate the risks he described, only one of the cited examples involved a shopping site at all, and that one was not Amazon. An injunction against conduct that probably breaks no law, the panel added, does not serve the public interest — it impairs consumer choice and limits a nascent technology.
What Amazon Actually Wanted
Strip away the statute and the dispute was about identification. Amazon told Perplexity’s CEO before Comet even launched that its AI products would not be allowed in the Amazon Store, and said so again after launch. The specific grievance recorded in the opinion is that Perplexity chose not to send a user-agent string announcing that an AI agent was active — the signal that would have let Amazon block it. The parties still dispute whether Perplexity altered that string after Amazon first managed to detect and block the Assistant.
So the fight was never really about hacking. It was about whether a retailer gets to know an agent is on its site, and whether the largest retailer on the internet can use a 1984 anti-hacking law to enforce that preference. On the second question, the answer for now is no. The panel put the alternative in a footnote: nothing here impairs Amazon’s ability to regulate access to Amazon.com through its own terms of service.
The Protection Is in the Architecture
Here is the uncomfortable implication for everyone building agents. Perplexity did not win because agents are lawful. It won because of a design choice: the traffic goes through the user’s machine, and the cloud only sees pictures of it.
Most agentic products are not built that way. An agent that runs server-side and fetches pages itself is the very fact pattern the panel distinguished in Power Ventures, where the defendant’s own systems reached into the platform and liability attached. This opinion therefore hands the industry a legal reason to keep execution on the client — a reason that has nothing to do with privacy, latency, or cost, and that will look arbitrary to any engineer who did not read the footnotes.
The amicus lineup shows who understood the stakes. Behind Perplexity: the EFF, Mozilla, the ACLU, the Knight First Amendment Institute, EleutherAI, the Software & Information Industry Association. Behind Amazon: the National Retail Federation, the News/Media Alliance, Digital Context Next, and Airlines for America. That second list is not an AI-policy coalition. It is a list of industries whose websites are being read by machines they cannot bill, and who wanted a federal statute to be the tool that stops it.
Amazon, for its part, is not finished. “We respectfully disagree with today’s decision on the preliminary injunction,” the company said. “We remain confident in our case and are evaluating our next steps.” Rehearing and a petition to the Supreme Court both remain open, and the underlying suit is live. Perplexity, which answered the original complaint with a blog post titled “Bullying is Not Innovation,” framed the ruling as a win for consumers choosing their own tools. Worth remembering: Amazon launched its own agentic shopping products in 2025. The disagreement is over whose agent gets to shop.
What to Take From This
- The CFAA is now a weak tool against user-directed agents in the Ninth Circuit. If the software runs on the user’s device and the developer’s servers never touch yours, the developer probably is not “accessing” anything under federal or California computer-crime law.
- Terms of service are the real battleground now. The court said so directly. Expect contract claims, tort theories, and AI-specific clauses to replace the hacking statute, which means the next round is fought over agreements users click through rather than over criminal law.
- The holding is architecture-dependent, not principle-dependent. Server-side agents that fetch pages themselves are not covered by this reasoning, and the panel said as much. Two products that behave identically to a shopper can land on opposite sides of the line.
- Users were the ones at risk in Amazon’s theory. The panel refused a reading that would have made switching on an assistant a potential act of aiding and abetting. That reasoning protects individuals more clearly than it protects AI companies.
- Nothing is final. A vacated preliminary injunction is not a verdict. Amazon still has rehearing, a possible Supreme Court petition, and a live case on remand — and a fuller record could change the access analysis the panel was careful to fence in.
The Takeaway
Courts have spent three decades stretching a 1984 hacking statute to cover scrapers, bots, and password sharing. This is the first time an appellate panel has been handed an AI agent and asked to name the culprit, and the answer it gave was deflationary: nobody hacked anything, a person went shopping, and the software they used is not a legal actor at all.
That is almost certainly the right reading of the statute, and it leaves the actual conflict untouched. Amazon does not want an agent it cannot identify walking its aisles, extracting prices and placing orders through a customer’s logged-in account. That is a legitimate commercial grievance. It is just not computer crime, and the court declined to pretend otherwise.
What replaces it will be less dramatic and more consequential: contract terms, detection requirements, agent identification standards, and probably legislation written by people who have watched retailers lose in court. The Ninth Circuit was blunt that it was deciding one narrow thing about one product as it existed in the record. The rest of the law governing machines that act for us is still unwritten — and after August 4, it will not be written by prosecutors.