AI Agents Can Shop Amazon Again: What the Ninth Circuit's Perplexity Ruling Actually Decided

*This is a research-based legal news analysis built from the Ninth Circuit's published opinion and analysis by law firms and reporters covering the case. It is general information, not legal advice — consult counsel before making decisions that depend on this ruling.*

On August 4, 2026, the US Court of Appeals for the Ninth Circuit vacated the preliminary injunction that had barred Perplexity's Comet browser assistant from shopping on Amazon since March 2026. The panel, in an opinion authored by Judge Milan D. Smith, Jr., held that Amazon is unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) claim because Comet's agentic "Assistant" is a tool operated by users — meaning it is the users, who hold legitimate Amazon accounts, who "access" Amazon's servers, not Perplexity.

Three qualifiers keep the ruling in proportion:

1. It is a preliminary-injunction ruling, not a final judgment. The court decided Amazon is *unlikely to succeed* on the CFAA theory — the underlying lawsuit continues.
2. The holding is expressly narrow. The panel noted there is "little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents" under the CFAA, and said agentic AI law "will doubtless change."
3. Amazon's other claims survive. The trademark and state-law claims were not resolved by this decision, and website operators retain contractual and technical means of managing automated traffic.

Amazon sued Perplexity in November 2025, alleging that Comet's AI Assistant accessed password-protected Amazon pages without Amazon's authorization — violating the CFAA and California's parallel statute (CDAFA). In March 2026, the district court agreed and enjoined Comet from Amazon: it reasoned that Amazon had not authorized Perplexity's access, regardless of whether Amazon customers had authorized the Assistant to act on their own accounts.

That framing — the platform's permission versus the user's permission — is the entire case. If a website's non-authorization of the *tool vendor* controls, then every AI agent needs permission from every site it visits. If the *user's* authorization controls, then an agent acting on a logged-in user's instructions stands in the user's shoes.

The panel sided with the user-authorization framing at this stage, on three grounds reported consistently across legal analyses:

• Operation, not creation, is what counts. Perplexity built the tool, but users invoke it, direct it, and authenticate with their own credentials. On that record, the "access" is the user's.
• The rule of lenity. The CFAA is a criminal statute applied civilly. Where its text is ambiguous — and attributing agent conduct is genuinely ambiguous — courts construe the ambiguity against liability. The Electronic Frontier Foundation, which filed in support of neither party, argued that building a browser cannot itself be a CFAA violation; the panel's reasoning tracks that concern.
• Judicial modesty about a moving target. The panel repeatedly flagged that agentic AI is new, the record is thin, and Congress — not a preliminary-injunction appeal — is the right forum for a comprehensive rule.

• It does not hold that AI companies can never be liable under the CFAA. A tool that acts autonomously, without user direction, or that circumvents technical barriers could be analyzed differently.
• It does not give agents a right to ignore a website's terms of service. Contract claims, trademark claims, and unfair-competition claims proceed on their own tracks.
• It does not prevent Amazon from technically blocking or rate-limiting agent traffic. The decision addresses criminal-statute liability, not network engineering.
• It does not bind courts outside the Ninth Circuit, though it is the first appellate word on the question and will be widely cited.

The practical stakes are larger than one shopping assistant:

For AI companies, the decision removes — for now, in one circuit — the most severe legal theory against user-directed agents: felony-statute liability for merely visiting sites the vendor lacks permission to visit. Expect agent vendors to lean into the "user-operated tool" architecture the court credited: user credentials, user initiation, user-visible actions.

For website operators, the decision signals that the CFAA is the wrong tool for managing unwanted agent traffic. The durable levers are contractual terms, technical controls (bot management, agent-identification protocols), and business deals — several large retailers have chosen partnership over litigation, striking agentic-checkout agreements with AI providers rather than suing them.

For users, agents that shop, book, and compare on your behalf just became meaningfully harder to ban outright. The open question is whether platforms respond with cooperation (sanctioned agent APIs) or friction (aggressive bot detection that degrades the experience).

For everyone, the panel's candor is the headline: there is essentially no settled law on responsibility for AI agents' actions, and this ruling is a first draft. Businesses building on agentic access should assume the rules will keep moving.

1. Does your agent act only on explicit user direction, with the user's own credentials? That is the architecture the court credited.
2. Do you have a fallback if target platforms deploy technical blocks? A legal right to exist is not an engineering guarantee of access.
3. Are your terms and disclosures honest about the agent's identity? Trademark and misrepresentation theories survived this ruling.
4. Are you monitoring the remand and parallel cases? A preliminary ruling can be narrowed, distinguished, or superseded.