Ninth Circuit: Perplexity's Shopping Agent Didn't 'Hack' Amazon Under the CFAA

The Ninth Circuit on August 4, 2026 vacated an injunction that had barred Perplexity’s Comet AI assistant from shopping on Amazon.com, holding that an AI agent acting on a user’s instructions does not ‘access’ a website’s servers within the meaning of the Computer Fraud and Abuse Act. Amazon had sued under the CFAA and California’s equivalent statute, arguing that Comet logged into user accounts, browsed, and completed purchases in violation of terms that prohibit automated access — and that because Amazon never authorized the agent, its activity was ‘without authorization’ regardless of what the user wanted. A district judge in the Northern District of California had agreed in March, calling it a close call and granting the injunction.

The panel, in an opinion by Judge Milan D. Smith Jr., turned on a technical point about who does the accessing. Comet runs as client-side software on the user’s machine: it captures screenshots, sends them to Perplexity’s servers for navigation instructions, but the actual network packets hitting Amazon originate from the user’s own computer. Perplexity’s servers never touch Amazon’s. Drawing on the Supreme Court’s Van Buren definition of access as ‘entering a system,’ the court concluded the human user — not Perplexity — is the one accessing Amazon, treating the agent as a tool rather than a legal actor. It declined to follow Facebook v. Power Ventures, calling that precedent’s contrary premise unexamined, and it sidestepped a live factual dispute over whether Perplexity swapped in a generic Chrome user-agent string after Amazon blocked and identified its bot in August 2025.

The ruling strips retailers of the CFAA as a weapon against third-party agent developers, but it is narrow by design: the court reached only the threshold ‘access’ question and left Amazon’s contractual tools intact. Amazon can still throttle, technically block, and enforce its terms of service against users — it just can’t convert a terms violation into a federal computer-crime claim against the agent’s maker. With agentic browsing becoming mainstream, the decision pushes the fight over automated access away from criminal statute and toward private contract and protocol-level controls like Amazon’s emerging Universal Commerce Protocol.