Ninth Circuit: The User, Not the AI Company, Accesses a Site Under the CFAA

On 4 August 2026 the US Court of Appeals for the Ninth Circuit vacated the preliminary injunction against Perplexity’s Comet browser assistant, holding that when a customer directs an AI assistant to act on a website, it is the customer, not the AI company, who “accesses” that website under the Computer Fraud and Abuse Act. It is the first US federal appellate decision addressing agentic AI and the CFAA, and it went against the platform.

Editor’s note: this page was verified against the full text of the opinion, which is linked in the sources, and against independent reporting. The case is at the preliminary injunction stage and has been remanded to the district court, so the position may change. Nothing here is legal advice.

What the court decided

Amazon sued Perplexity in November 2025, alleging violations of the CFAA and its California analogue, the California Comprehensive Computer Data Access and Fraud Act (CDAFA). In March 2026 Senior US District Judge Maxine Chesney of the Northern District of California granted Amazon a preliminary injunction, finding Amazon likely to succeed on both claims. Perplexity appealed, and a motions panel of the Ninth Circuit issued a stay pending appeal, so the injunction did not restrict Comet while the appeal was heard. The case was argued and submitted in Seattle on 11 June 2026.

The Ninth Circuit panel found the district court had abused its discretion in its “access” analysis. Writing for the panel, Circuit Judge Milan D. Smith Jr. held:

It is the user who “accesses” Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.

Two steps got the court to that conclusion. First, it asked whether Perplexity itself communicates directly with Amazon’s servers, and found it does not. Only the browser retrieves the page; the Assistant then analyses what is displayed and sends information and user instructions to Perplexity’s servers, which reply with directions to act on the page. In the court’s words, “Perplexity itself does not directly communicate with Amazon’s servers.”

Second, it asked whether Perplexity uses the Assistant as a tool to access Amazon’s computers, and answered no. Receiving screenshots of the user’s browser and sending instructions back does not amount to gaining entry to Amazon’s servers. As the opinion puts it, “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.”

The court reinforced the holding with the rule of lenity, noting that the CFAA applies in criminal as well as civil contexts, so ambiguity cuts against liability. It also observed that Amazon’s reading could expose users themselves to criminal liability. The CDAFA claim failed on the same reasoning: “access” under the CDAFA may be broader, but the inquiry still focuses on the person accessing or causing the access.

The access analysis is not the only ground. The panel separately held that the district court erred on the remaining injunction factors, describing Amazon’s evidence of irreparable harm as weak and finding that an injunction would impair consumer choice and limit the development of a nascent technology. The conclusion is conjunctive: the injunction fell because Amazon is unlikely to succeed on the merits and the equitable factors do not otherwise strongly favour an injunction.

The panel vacated the injunction and remanded. Circuit Judge Eric C. Tung and US District Judge John Charles Hinderaker (District of Arizona, sitting by designation) completed the panel.

The dispute was about an agent that would not identify itself

The opinion records that at the core of the dispute was Perplexity’s decision not to use a user-agent string, a mechanism that would have communicated that the user had activated an AI agent. That string would have let Amazon detect and block the Assistant.

This is worth separating from the legal holding. Amazon’s underlying complaint was not that agents exist. It was that this agent arrived indistinguishable from a human shopper, which left Amazon with no way to apply a different rule to it. Agent identity, which the protocol and infrastructure layer has been building towards through mechanisms such as Web Bot Auth and signed agent credentials, is the same problem approached from the other side.

What the court did not decide

The opinion is deliberately narrow, and reading it as a general licence for agentic AI would be a mistake. The panel wrote that it does not establish a new legal regime governing agentic AI, and limited its holding to “access” as contemplated by the CFAA, as applied to the Assistant’s interactions with Amazon.com on the record before it.

Three limits are worth recording separately:

• Other causes of action remain open. The court wrote that it does not address whether Perplexity can avoid liability in other contexts, “including tort claims”. Wilson Sonsini’s analysis names trespass to chattels, tortious interference and the anti-circumvention provisions of the Digital Millennium Copyright Act as the obvious untested routes. Those specific causes of action are the firm’s reading rather than the court’s words.
• Terms of service are explicitly preserved. A footnote states that the outcome “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users”, and that Amazon is simply unlikely to succeed in regulating access by invoking the CFAA and the CDAFA. The court did more than leave contract open; it pointed at it.
• The outcome depended on product architecture, and on geography. Because the reasoning followed where the chain of communication runs, an agent built differently could reach a different result. An agent whose vendor servers call a merchant’s endpoints directly does not have the fact pattern that saved Perplexity here. The decision also binds only federal courts in the Ninth Circuit, which covers California and eight other western states.

Amazon has said it disagrees with the ruling and is evaluating next steps. The case returns to the district court.

Why it matters for agentic commerce

Until 4 August 2026 the strongest legal instrument a large marketplace had against an unwanted third-party shopping agent was an anti-hacking statute, and the March injunction suggested it worked. That instrument is now weaker, at least against a client-side agent acting on a user’s instruction inside the Ninth Circuit.

For a merchant or marketplace, the practical consequence is that exclusion has to rest on something else:

• Terms of service and contract. Expressly preserved by the court, and untested against agents at appellate level.
• Technical access controls. Bot detection, rate limits, Web Bot Auth and similar agent-identity mechanisms. These operate regardless of the legal question, and the user-agent string point in this case shows how central detection is to the whole argument.
• Permissioned access. Admitting agents deliberately, on terms the operator sets, through a declared interface such as an agent-callable API, a Model Context Protocol server, or a supported commerce protocol.

The third option is the one this ruling makes more attractive. If keeping agents out through litigation is harder than it looked in March, deciding which agents to recognise, and on what terms, becomes a live commercial question rather than a deferrable one. That is the same question the protocol and agent-identity layer has been approaching from the other direction: see The Agentic Commerce Protocol Stack for how the access, authorisation and payment layers fit together, AI Shopping Agent Authorization for the merchant-side view of recognising an agent, and Agentic Commerce Risks and Readiness for where third-party agent access sits in the wider risk picture.