{"id":129228,"date":"2026-06-01T05:36:29","date_gmt":"2026-06-01T05:36:29","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/06\/01\/amazon-vs-perplexity-the-cfaa-case-that-decides-whether-ai-agents-can-visit-your-website\/"},"modified":"2026-06-01T05:37:34","modified_gmt":"2026-06-01T05:37:34","slug":"amazon-vs-perplexity-the-cfaa-case-that-decides-whether-ai-agents-can-visit-your-website","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/06\/01\/amazon-vs-perplexity-the-cfaa-case-that-decides-whether-ai-agents-can-visit-your-website\/","title":{"rendered":"Amazon Vs. Perplexity: The CFAA Case That Decides Whether AI Agents Can Visit Your Website"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Amazon sued Perplexity over its Comet browser<\/a> buying on Amazon beneath person authorization. On March 10, 2026, a federal decide within the Northern District of California issued a preliminary injunction<\/a> blocking Comet from accessing Amazon\u2019s logged-in pages. Roughly every week later, the Ninth Circuit Courtroom of Appeals paused the injunction pending Perplexity\u2019s enchantment. On Might 8, 2026, Perplexity filed its appellate brief<\/a>, calling Amazon\u2019s Pc Fraud and Abuse Act concept \u201ca basic misfit\u201d for an AI agent that visits beneath specific person authorization. Oral arguments are scheduled for June 11, 2026, in Seattle.<\/p>\n

The case is the primary main authorized take a look at of agent-as-visitor rights<\/a> in america. The query on the middle of it’s who counts as a certified customer when a human delegates the go to to an AI agent. The reply on the Ninth Circuit will set the precedent for each retailer, market, reserving platform, and SaaS web site going through the identical query, and most of them might be going through it inside the subsequent 12 months.<\/p>\n

What Occurred, March By Might<\/h2>\n

The case moved by means of three distinct phases in eight weeks.<\/p>\n

In early 2026, Amazon filed swimsuit in opposition to Perplexity within the Northern District of California. Comet, Perplexity\u2019s AI-powered browser, can log right into a person\u2019s Amazon account utilizing the person\u2019s saved credentials, browse merchandise on the person\u2019s behalf, and full purchases by means of Amazon\u2019s checkout move. Amazon\u2019s grievance argued that this constitutes unauthorized entry to Amazon\u2019s laptop methods beneath the CFAA, no matter whether or not the person licensed the agent. Amazon additionally raised trademark and unfair-competition claims tied to Comet, rendering Amazon\u2019s pages inside Perplexity\u2019s interface.<\/p>\n

On March 10, U.S. District Decide Maxine Chesney granted Amazon a preliminary injunction. The order blocked Comet from accessing password-protected parts of Amazon.com, together with account pages, order historical past, and checkout. The decide accepted Amazon\u2019s CFAA concept on the preliminary-injunction stage, discovering that Amazon\u2019s phrases of service govern who is permitted to entry logged-in areas and {that a} person\u2019s instruction to an agent doesn’t prolong that authorization to the agent itself. Public-facing Amazon pages remained accessible to Comet beneath the order.<\/p>\n

Roughly every week after the District Courtroom ruling, the Ninth Circuit Courtroom of Appeals paused the injunction pending Perplexity\u2019s enchantment. The procedural impact: Comet may proceed working on Amazon\u2019s logged-in pages whereas the enchantment performed out. The appellate pause was the primary sign that the CFAA concept won’t survive scrutiny at the next courtroom, as a result of preliminary injunctions are routine, whereas appellate stays of preliminary injunctions will not be.<\/p>\n

On Might 8, Perplexity filed its appellate temporary. The temporary argued that the District Courtroom\u2019s studying of the CFAA stretches the statute far past its 1986 anti-hacking origin, that the person is the licensed occasion always, that Comet acts beneath the person\u2019s delegated authority, and that Amazon\u2019s contractual phrases can’t manufacture federal criminal-law violations out of an agent\u2019s lawful entry on the person\u2019s behalf. Mozilla, the Digital Frontier Basis, and different digital-rights teams filed amicus briefs<\/a> supporting Perplexity\u2019s place. The Ninth Circuit set oral arguments for June 11 in Seattle.<\/p>\n

Amazon\u2019s CFAA Principle In Plain English<\/h2>\n

The CFAA was handed in 1986. Its authentic goal was hacking-style intrusion, the type of unauthorized entry that appeared like crime within the period of WarGames. Over the previous twenty years, the statute has been stretched in civil litigation to cowl scraping, automated entry, account sharing, and different conduct that exists on a unique spectrum from break-in hacking. The Supreme Courtroom narrowed a few of that stretch in Van Buren v. United States<\/a> (2021), holding that an individual with permission to entry a system doesn’t violate the CFAA by accessing it for the incorrect cause. Whether or not that narrowing reaches agent-on-behalf-of-user entry is the query Amazon v. Perplexity places squarely on the desk.<\/p>\n

Amazon\u2019s concept has three components.<\/p>\n

First, Amazon\u2019s phrases of service explicitly prohibit automated entry. The phrases reserve entry to Amazon.com for natural-person shopping, not for software program brokers appearing on behalf of customers.<\/p>\n

Second, when Comet logs right into a person\u2019s Amazon account, Comet itself is the entity making the request, and from Amazon\u2019s perspective, the agent is now the customer moderately than the person. Amazon\u2019s authorization runs to the person, to not a software program agent the person has delegated to.<\/p>\n

Third, as a result of Amazon by no means licensed Comet, Comet\u2019s entry is \u201cwith out authorization\u201d beneath the CFAA. The person\u2019s instruction to Comet is irrelevant as to if Amazon licensed Comet.<\/p>\n

Perplexity\u2019s counter-argument runs the opposite route. The person is the principal. Comet is the person\u2019s agent within the legal-mechanical sense. When the person instructs Comet to log into the person\u2019s personal account and full a transaction the person is permitted to finish, Comet\u2019s entry is the person\u2019s entry, channeled by means of software program. There isn’t any unauthorized occasion within the transaction. The CFAA was not written for, and doesn’t attain, software program appearing beneath specific person delegation.<\/p>\n

The trial-court ruling sided with Amazon\u2019s studying. The Ninth Circuit\u2019s pause is the sign that the appellate panel could not.<\/p>\n

Why The Ninth Circuit Paused The Injunction On Attraction<\/h2>\n

Appellate stays of preliminary injunctions are unusual sufficient to be a sign. The Ninth Circuit applies a four-factor take a look at for staying an injunction pending enchantment, and the primary issue is probability of success on the deserves. A panel granting a keep is, in impact, signaling that the transferring occasion has an affordable shot at successful the enchantment.<\/p>\n

The panel didn’t write an opinion explaining the keep. Appellate stays at this stage hardly ever include reasoned opinions. The sign lives within the procedural reality of the keep itself.<\/p>\n

The authorized analyst\u2019s studying of why the panel may be skeptical of the District Courtroom\u2019s CFAA concept comes down to 2 doctrinal pressures. The primary is the Van Buren narrowing. Van Buren reduce the CFAA again from a software that might criminalize any laptop use in violation of a terms-of-service clause to a software that targets precise unauthorized entry. Studying Amazon\u2019s concept rigorously, the District Courtroom\u2019s ruling expands the CFAA in ways in which look extra just like the pre-Van Buren expansion<\/a> than the post-Van Buren narrowing.<\/p>\n

The second strain is the legal-agency doctrine that has ruled delegated transactions for hundreds of years. When an individual authorizes one other occasion to behave on their behalf, the agent\u2019s acts are imputed to the principal. Software program appearing beneath specific person instruction is the trendy, automated extension of the identical precept. Studying the CFAA to disregard that precept would create a federal criminal-law lure for any person who delegates on-line duties to software program, which is now most customers.<\/p>\n

Neither strain ensures the Ninth Circuit reverses, however collectively they clarify why the panel paused.<\/p>\n

Why This Decides Extra Than One Lawsuit<\/h2>\n

If the District Courtroom\u2019s CFAA concept survives appellate assessment, the doctrinal impact is simple. Each main web site will get a authorized weapon for blocking AI brokers from logged-in person accounts, even on accounts the person absolutely owns. The blueprint Amazon used in opposition to Comet turns into the usual playbook for any platform that doesn’t need its customers utilizing AI brokers.<\/p>\n

The downstream results line up class by class. Retailers can block AI shopping agents<\/a> from price-comparing on logged-in accounts. Reserving web sites can block AI journey brokers from finishing reservations on person accounts. Banks and brokerages can block AI financial-management brokers from logged-in dashboards. Marketplaces can block brokers from posting listings on person accounts. SaaS platforms can block brokers from managing subscriptions or working workflows on person accounts. In each case, the web site\u2019s terms-of-service language turns into the controlling doc, and the person\u2019s specific instruction to the agent turns into legally irrelevant.<\/p>\n

If the Ninth Circuit reverses, the doctrinal impact is the other. The CFAA will get pushed again inside its narrower 1986 lane. Web sites lose the federal criminal-law software for blocking user-delegated brokers, and the query of agent entry shifts to the contract-and-technology layer, the place it arguably belongs. Web sites can nonetheless block brokers by means of technical means, phrases enforced by civil cures in need of CFAA claims, or partnership APIs<\/a>. However they can not attain for the federal legal statute because the lever.<\/p>\n

A middle-ground consequence can be potential. The Ninth Circuit may affirm the injunction on narrower grounds, distinguish between particular sorts of agent entry, or remand for additional factual improvement. Every of these outcomes leaves the bigger query unresolved and pushes the authorized take a look at ahead into different circuits and different circumstances.<\/p>\n

Whichever manner the panel guidelines, the case is now the load-bearing precedent for agent-as-visitor entry rights in america. Each main retailer, market, and reserving web site will write its agent-access posture in opposition to the usual the Ninth Circuit units on June 11.<\/p>\n

What To Watch For At Oral Arguments<\/h2>\n

Three alerts at oral arguments are price watching particularly.<\/p>\n

The primary is how the panel handles the agency-doctrine query. If the judges push Amazon\u2019s counsel exhausting on why a person\u2019s specific instruction doesn’t prolong authorization to the person\u2019s chosen agent, that’s the mushy inform that the panel is uncomfortable with the District Courtroom\u2019s studying. If the judges as an alternative press Perplexity on why an automatic agent needs to be handled identically to a human person, the panel could also be open to the District Courtroom\u2019s framing.<\/p>\n

The second is whether or not the judges distinguish between sorts of agent entry. The case thus far has handled \u201cagent entry\u201d as one class. The panel may draw strains: brokers that full transactions versus brokers that solely retrieve knowledge, brokers that use saved credentials versus brokers that ask the person to log in every time, brokers recognized by a verified protocol<\/a> versus unidentified browser automation. A ruling that attracts these strains would form how web sites can construction their entry posture greater than a blanket affirm-or-reverse.<\/p>\n

The third is what the panel says about the way forward for the CFAA within the agentic period. The judges have a chance to put in writing a doctrinal body for the way the statute applies to AI brokers typically, and so they could or could not take it. A slim ruling on Amazon-and-Perplexity-specific details leaves the bigger query for an additional case, presumably in one other circuit, presumably with completely different details. A broader ruling units the doctrinal body for all the class.<\/p>\n

Oral arguments on the Ninth Circuit are public. The audio is often posted inside hours. The panel composition, when printed, alerts how the case will doubtless be heard. Monitoring these three alerts by means of argument day is the most cost effective manner for a web site proprietor to learn the route of journey.<\/p>\n

What To Do This Week<\/h2>\n

Three concrete strikes for any web site proprietor whose customers may need to use AI brokers on logged-in accounts.<\/p>\n

Learn your personal phrases of service for clauses about automated entry. Most phrases of service inherited their automated-access language from the pre-agent period, when \u201cautomated entry\u201d meant scraping bots and unauthorized scripts. Determine whether or not that language nonetheless says what you need it to say when the automated entry is a person\u2019s personal AI agent appearing beneath specific person instruction. In case your place is that you just need to welcome user-delegated brokers, your phrases ought to say so. In case your place is that you just need to block them, your phrases ought to say that too, and your robots.txt and access-control posture<\/a> ought to match.<\/p>\n

Audit your access-control posture in opposition to the AI agent person brokers your customers really use. The present main ones embody GPTBot, OAI-SearchBot, ChatGPT-Consumer, PerplexityBot, ClaudeBot, and Google-Prolonged for the search-and-citation crawlers, plus Perplexity Comet, ChatGPT Atlas, and the assorted Gemini surfaces for the user-delegated browsers. In case your robots.txt<\/a> or internet software firewall blocks any of those by default, your customers could already be hitting the wall on their very own accounts. That’s your resolution to make, however it needs to be a choice, not a default.<\/p>\n

Determine your place on agent entry earlier than the Ninth Circuit decides it for you. Three postures are coherent. The primary is welcome: You settle for user-delegated brokers on accounts, you might cost in a different way for agent-driven transactions, you might publish an agent-readable floor that makes the work simpler for each side. The second is block: You deal with user-delegated brokers as unauthorized entry, you again that place with phrases and technical controls, and also you settle for that some customers will depart for web sites with the welcome posture. The third is companion: You build an API or capability surface<\/a> that user-delegated brokers can use with out scraping your logged-in pages, and you set the brokers by means of that door moderately than the entrance one.<\/p>\n

The default posture most web sites have right now was written earlier than agent-as-visitor was an actual entry class. Regardless of the Ninth Circuit guidelines on June 11, the default is now the incorrect posture for many web sites. Select intentionally.<\/p>\n

Extra Assets:<\/strong><\/p>\n\n

This publish was initially printed on No Hacks<\/a>.<\/em><\/p>\n\n

Featured Picture: Billion Photographs\/Shutterstock<\/em><\/p>\n<\/div>\n