Amazon Vs. Perplexity: the CFAA Case That Decides Whether AI Agents Can Visit Your Website

There is a fundamental tension emerging between how we want to use the internet and how platforms want to control it. For years, we have accepted that we must manually click buttons and navigate menus. But as AI agents evolve, we are moving toward a world where we delegate these tasks. The real question is whether a website can legally stop you from using a tool of your own choosing to access your own account.

This is not just a technical dispute. It is a question of agency. If I tell an AI to buy a specific product for me, is that AI a guest I have invited, or is it an intruder breaking into a system? The outcome of the current legal battle between Amazon and Perplexity will likely define the boundaries of the autonomous web for the next decade.

The Timeline of a Legal Collision

The conflict accelerated quickly between March and May of 2026. At the center of the dispute is Comet, an AI powered browser developed by Perplexity. Comet is designed to act as a proxy for the user. It can use a person's stored credentials to log into their Amazon account, browse for products, and navigate the checkout process to complete a purchase.

Amazon viewed this as a violation of their systems. They filed a lawsuit in the Northern District of California, arguing that Comet's behavior constitutes unauthorized access under the Computer Fraud and Abuse Act, or CFAA. Amazon did not just focus on the access itself, but also raised claims regarding unfair competition and trademark issues, as Comet essentially wraps Amazon's pages within the Perplexity interface.

By March 10, 2026, a federal judge issued a preliminary injunction. This order effectively blocked Comet from accessing any password protected areas of Amazon, including order histories and account settings. The judge's reasoning was that Amazon's terms of service dictate who is authorized to be on the site, and a user's permission to an agent does not automatically grant that agent legal authorization.

However, the situation shifted a week later when the Ninth Circuit Court of Appeals paused that injunction. This allowed Comet to continue its operations while the appeal moves forward. Perplexity has since argued that applying the CFAA to an agent acting under explicit user instruction is a fundamental misfit for the law.

Expert Interpretation: The speed of these rulings suggests that the courts are feeling the pressure to set a precedent quickly. The tradeoff here is between user autonomy and platform security. If you are a platform owner, you want total control over who hits your servers to prevent load issues and protect data. If you are a user, you want your tools to work where you have accounts. The decision you should inspect here is whether your own platform's "authorized access" is defined by the identity of the person or the identity of the software making the request.

Breaking Down the CFAA Theory

To understand why this is so contentious, we have to look at the Computer Fraud and Abuse Act. Passed in 1986, the CFAA was designed to stop the kind of hacking seen in movies like WarGames. It was meant to punish people who broke into computers they had no right to touch.

Over time, lawyers have stretched this law to cover things that look nothing like hacking. It has been used to sue people for web scraping, account sharing, and automated access. The Supreme Court tried to reel this in with the 2021 case Van Buren v. United States. In that ruling, the court decided that if a person has permission to access a system, they do not violate the CFAA just because they accessed it for a reason the owner doesn't like.

Amazon is attempting to carve out a different path. Their theory rests on three main points. First, their terms of service explicitly forbid automated access, reserving the site for natural persons. Second, they argue that when Comet logs in, the agent is the entity making the request, not the human. Therefore, the visitor is the software, not the user.

Third, Amazon claims that because they never gave Comet permission, the access is unauthorized. In their view, the user's instruction to the AI is irrelevant because the user cannot grant permissions that the platform owner has explicitly withheld.

Expert Interpretation: Amazon is trying to shift the legal definition of "access" from a permission based on the account holder to a permission based on the technical agent. This is a critical distinction. If the court accepts this, it means that "authorization" is not a property of the account, but a property of the connection. The risk for the industry is that this could turn every API or automated tool into a potential CFAA violation if the terms of service are written broadly enough.

The Significance of the Ninth Circuit's Pause

In the legal world, the fact that the Ninth Circuit paused the injunction is a signal. Staying a preliminary injunction is not a common occurrence. To do so, the court typically looks at a four factor test, and the most important factor is the likelihood that the appealing party will succeed on the merits of the case.

While the panel did not release a detailed written opinion explaining the stay, the procedural act itself suggests that the judges believe Perplexity has a reasonable chance of winning. They are likely skeptical of the District Court's broad interpretation of the CFAA.

The core of this skepticism likely stems from the idea of agency. If a human uses a browser, the browser is a tool. If a human uses an AI agent, is the agent still just a tool, or has it become a separate entity? If the court views the AI as a tool, then the user's authorization should cover the tool. If they view it as a separate entity, Amazon's theory holds more weight.

Expert Interpretation: When a higher court pauses a lower court's order without a long explanation, it often means the lower court's logic was too aggressive. For those of us watching this, the "signal" is that the courts are hesitant to let platforms use the CFAA as a blanket tool to block user delegated AI. The tradeoff is that while this protects user choice, it leaves platforms vulnerable to automated traffic they cannot easily block via legal threats.

The Domino Effect for the Broader Web

This case is about more than just Amazon and Perplexity. If Amazon's theory survives, it provides a legal blueprint for every major website to block AI agents from logged in accounts.

We would see a wave of litigation across multiple sectors. Retailers could block AI shopping agents from comparing prices on accounts where the user has loyalty discounts. Travel sites could stop AI agents from managing reservations or finding better deals on existing bookings. Financial institutions and brokerages could block AI wealth managers from accessing account data to provide advice.

Essentially, the web would become a series of walled gardens where the only way to interact with your own data is through the platform's own approved interface. This would effectively kill the concept of the "personal AI agent" that can move between services to get things done for you.

Expert Interpretation: This is the "playbook" risk. Once a legal victory is established, it becomes a template. Companies will not invent new theories, they will simply copy the Amazon filing. If you run a platform, you need to decide if you want to be a closed ecosystem or an open one. Blocking agents might protect your current UI, but it creates a friction point that users will eventually resent as AI becomes the primary way people interact with the web.

What to Listen for During Oral Arguments

The oral arguments are set for June 11, 2026, in Seattle. There are three specific areas where the judges' questions will reveal their leanings.

First, watch the agency doctrine. If the judges ask Amazon why a user's explicit instruction does not extend to their chosen agent, it is a sign they are uncomfortable with the District Court's ruling. Conversely, if they press Perplexity on why an automated agent should be treated the same as a human, they may be leaning toward Amazon.

Second, look for distinctions between types of agent access. The court may decide that there is a difference between a "read only" agent and an agent that can execute transactions. A distinction here could lead to a compromise ruling.

Third, pay attention to how they treat the Terms of Service. The court will have to decide if a contract (the ToS) can override the general legal principle of agency, or if the CFAA is the wrong tool for enforcing a contract violation.

Expert Interpretation: The "soft tell" in these hearings is usually found in the hypotheticals the judges pose. If they start asking about "what happens if the agent makes a mistake," they are thinking about liability. If they ask about "who owns the data," they are thinking about property rights. The decision you should track is whether the court views this as a security issue or a contract issue.

Immediate Steps for Website Owners

Regardless of the court's decision, this case highlights a gap in how most websites handle automated access. Most Terms of Service were written in an era where "automated access" meant malicious scrapers or basic bots. They were not written for a world where a user's own AI agent is the visitor.

If you own a website, you should take a few concrete steps this week. Start by reading your own terms of service. Look for clauses regarding automated access and ask yourself if that language still reflects your goals in the age of AI agents.

You need to make a strategic choice. If you want to welcome agents that act on behalf of your users, your terms should explicitly state that user delegated agents are permitted. This removes the ambiguity and protects you from being the target of a similar dispute.

Introduction

The key issue here is Amazon sued Perplexity over its Comet browser shopping on Amazon under user authorization. On March 10, 2026, a federal judge in the Northern District of California issued a preliminary injunction blocking Comet from accessing Amazon's logged in pages. My read is to treat it as a decision point: what signal needs to become clearer, what part of the system is currently weak, and what evidence would show that the work is improving visibility rather than only adding activity.

That is the difference between reacting to a trend and building a useful search system. Connect this point back to the page template, internal linking, entity signals, content depth, crawl accessibility, and the way the brand is represented across the wider web before deciding what to change first.

Practical next steps

The useful part is not only the idea itself, but the operating habit behind it. Use it as a checklist for decisions: what deserves attention now, what should be monitored, what needs a stronger evidence base, and what can wait until the system has more scale.