Amazon v. Perplexity: agent architecture and CFAA
On August 4, 2026, the US Court of Appeals for the Ninth Circuit vacated the preliminary injunction that Amazon had obtained against Perplexity AI in March. The injunction concerned the Comet browser and its AI assistant: Amazon demanded that the agent not work with shoppers’ accounts on Amazon without permission from the platform itself. The appeal sent the case back to the trial court, and the dispute on the merits continues. Below is an analysis based on the docket and the text of the decision: the particulars, the chronology, the technical side, the parties’ positions, and what the decision means and does not mean.
What the case is
The plaintiff is Amazon.com Services LLC, the defendant is Perplexity AI, Inc. Case No. 3:25-cv-09514 is before the federal district court for the Northern District of California, Judge Maxine M. Chesney. Appellate proceeding No. 26-1444 in the Ninth Circuit. The original legal grounds: the federal Computer Fraud and Abuse Act (CFAA) and its California counterpart, the Comprehensive Computer Data Access and Fraud Act (CDAFA).
This is a dispute about a software agent’s access to computer systems and shoppers’ accounts. Not about copyright in training data, and not about whether shopping agents may be built at all.
What Comet does and what the conflict is about
In the materials the appeal considered, Comet is described as a browser running on the user’s computer. It has an optional AI Assistant: the user can instruct it to find a product on Amazon and complete the purchase. Technically the process looks like this:
- The browser on the user’s device requests Amazon pages.
- The Assistant receives screenshots of the browser.
- The screenshots are sent to Perplexity’s servers.
- The servers return instructions on the next actions.
- The Assistant performs them in the user’s browser.
The distribution of these steps became the central question. Amazon maintained that Perplexity accesses its systems through a tool the company itself controls. Perplexity replied that the user obtains access, and the company only supplies the program.
A separate line of dispute is the identification of automation. Amazon demanded that the agent’s activity be marked in the user-agent string, by which the platform can recognize and block it. The parties disputed whether Perplexity changed that string deliberately after Amazon learned to distinguish the Assistant. The appellate court called this fact disputed and did not resolve it.
Chronology
| Date | Event |
|---|---|
| Before Comet’s release in 2025 | According to the appellate decision, Amazon told a Perplexity executive that its AI products were not permitted to access the Amazon Store; after the launch the notices were repeated |
| November 4, 2025 | Amazon filed the suit and a motion for a preliminary injunction |
| January-February 2026 | The parties filed supplemental materials; after postponements the hearing was set for March 6 |
| March 6, 2026 | Hearing in the trial court, 3 hours 18 minutes per the docket |
| March 9, 2026 | Judge Chesney granted Amazon’s motion for an injunction with a seven-day stay of enforcement |
| March 10, 2026 | Perplexity appealed the injunction |
| March 16, 2026 | The Ninth Circuit temporarily stayed the injunction, then stayed it pending appeal and expedited review |
| June 11, 2026 | Oral argument on appeal: who exactly accesses Amazon, the user, the agent or Perplexity |
| August 4, 2026 | The appellate court vacated the injunction and remanded the case to the trial court |
An important detail: the March injunction was not continuously in force until August. Its enforcement was first stayed, then suspended pending appeal.
The parties’ positions
Amazon’s position came down to five propositions. A shopper’s permission to use their own account does not mean Amazon permitted a third-party company to access its computers. The Assistant does not merely display pages: its actions are determined by Perplexity’s servers, so access should be attributed to Perplexity itself. The agent operates in closed, password-protected areas of the account and transmits information to the company’s servers. The company continued doing so after notices of prohibition. Finally, the agent’s operation creates security risks and degrades the shopping experience.
Amazon also pointed to the costs of detecting and blocking Comet. The trial court found proven expenses well above $5,000, the threshold that matters for a civil claim under the CFAA. This is not the amount of compensation but a condition of the claim’s admissibility.
Perplexity objected. Access to Amazon is obtained by the shopper through their own browser. Taking screenshots of an already loaded page is not equivalent to the company’s computers entering Amazon’s systems. The Assistant is the user’s software tool, not an independent actor with a separate intent, and it can be compared to the functions of an ordinary browser that automatically fills in address and payment fields. Perplexity’s last argument, that Amazon uses an anti-hacking law to restrict competing tools, remained the position of a party, not a finding of the court.
Why Amazon won in March
The trial court found that Amazon had shown a high likelihood of success under the CFAA and CDAFA. The court framed the key distinction this way: Comet acts with the permission of the Amazon user but without the permission of Amazon itself, obtains information from a protected account and transmits it to Perplexity. For the preliminary injunction the court also assessed the likelihood of irreparable harm, the balance of hardships and the public interest. This was a preliminary assessment for a temporary measure, not a ruling that the product is unlawful.
Why the appeal vacated the injunction
The decision was issued by Judges Milan D. Smith Jr., Eric C. Tung and visiting district judge John Charles Hinderaker; Smith wrote the opinion. The court focused on the first element of a CFAA claim: did Perplexity itself access Amazon’s computers.
Access by Perplexity was not shown. On the materials presented the court answered no: the user obtains access, using the Assistant as a tool. Receiving screenshots and sending instructions do not by themselves mean that Perplexity entered Amazon’s servers. The court left a caveat: on different facts, the degree of Perplexity’s control over the agent could lead to a different conclusion.
The agent is a tool, not a person. The CFAA speaks of a person who intentionally accesses a protected computer. The court noted that the Assistant, however advanced, remains a tool and not a person for the purposes of the statute. It was therefore necessary to determine whose actions it carries out. On the material considered - the user’s.
A criminal provision cannot be expanded without caution. The dispute is civil, but the CFAA contains criminal prohibitions, and the court applied the rule of lenity, the principle of narrow construction of ambiguous criminal provisions. The court also pointed to the danger of Amazon’s logic: it could expose ordinary shoppers using an agent to criminal liability, for example through theories of aiding and abetting or conspiracy.
The evidence of irreparable harm was weak. The appeal did not accept the arguments that the agent might choose a less favorable price or delivery, that Amazon’s reputation suffers, and that there are cyber risks: the latter were not tied to specific interactions with Amazon and were partly rebutted by information about security improvements. The court assessed the balance of interests in Perplexity’s favor: enjoining activity that on the available facts probably does not violate the named statutes would limit shoppers’ choice and the development of the technology.
Which precedents were discussed
| Case | Significance for the dispute |
|---|---|
| Van Buren v. United States | The Supreme Court described access as entry into a computer system or part of it; the Ninth Circuit used this in analyzing Perplexity’s actions |
| Facebook v. Power Ventures | Amazon relied on the liability of a service that continued interacting with Facebook after a prohibition. The appeal noted that the dispute there was about permission, and the fact of access was not separately analyzed in that way |
| Meta Platforms v. BrandTotal | Perplexity relied on the distinction between obtaining data from the user’s device and accessing the platform’s servers. The court found the analogy incomplete: Comet does more than a passive data-collection extension |
| United States v. Nosal | A warning against turning an anti-hacking law into a broad prohibition of ordinary computer activity |
| hiQ Labs v. LinkedIn | A reminder of the CFAA’s anti-hacking purpose, not a universal permission to access closed accounts |
The court also received amici curiae briefs: from the ACLU and the Knight First Amendment Institute; from a group of EFF, Mozilla, the Alliance for Responsible Data Collection, Digital Medusa and EleutherAI; and from industry organizations of retailers, publishers and airlines. The court directly quoted the description of the technical architecture from the EFF group’s brief when examining who interacts with Amazon’s servers.
What the decision means and what it does not
| Question | Answer from the text of the decision |
|---|---|
| Did Perplexity win the case? | No. The preliminary injunction was vacated, the case was remanded to the trial court |
| Did the court allow any agents to work on any sites? | No. The conclusion is limited to the specific facts and the concept of access in the CFAA and CDAFA |
| Is the user’s consent always stronger than the platform’s prohibition? | There is no such conclusion. The court decided who obtained access, not all questions of authorization |
| Is transmitting screenshots hacking? | On the facts considered, no: by itself it did not prove Perplexity’s entry into Amazon’s systems |
| Would direct requests from Perplexity’s servers to Amazon change the assessment? | It might. The court left the question open for other facts |
| Did Amazon lose the right to enforce its terms of service? | No. The appeal expressly placed that question outside its conclusion |
| Did the court exclude any other liability for the agent? | No. It declined to establish a general legal regime for AI agents |
Amazon retains two obvious paths: seeking rehearing en banc and rebuilding the suit on new facts, including contractual grounds. The appeal’s caveat about a different assessment given a different degree of control over the agent points directly to that.
Why the case matters for AI system architecture
For developers it is telling that the court analyzed not the label “autonomous AI” but the specific architecture: where the browser runs, who sends the requests, where the data goes and to whom the tool’s actions are attributed. Three different questions follow from the materials, and they must not be conflated.
Technical: does the local browser contact the site, or do the agent vendor’s cloud servers. Legal: does such interaction count as access by the vendor under the CFAA and CDAFA. Contractual: does the user violate the platform’s terms, and does the agent vendor induce that violation.
Hence a consequence for anyone building agents, including legal ones. The scheme “the local client performs the actions, the cloud only advises” received protection in the Ninth Circuit, but exactly within the limits where the cloud does not touch someone else’s servers itself. Move the requests to the vendor’s side, and the argument “the user obtains access” stops working. For Lexometrica this is a practical guide: agents that work with court data and external services must be designed so that the question “who obtained access” has an unambiguous and documented answer.
This dispute cannot be reduced either to the formula “AI agents are lawful” or to the formula “account automation is hacking”. The August decision concerns one architecture and one set of evidence. What follows depends on which facts Amazon brings to the trial court.