Amazon.com Services, LLC v. Perplexity AI, Inc. (No. 26-1444), Opinion

Source: U.S. Court of Appeals for the Ninth Circuit; opinion by Judge Milan D. Smith, Jr. · 2026-08-04

The panel (1) vacated the district court’s preliminary injunction requested by Amazon.com Services, LLC, against Perplexity AI, Inc., an artificial intelligence company, to prevent the use of Perplexity’s agentic web browser AI tool on Amazon.com in violation of the federal Computer Fraud and Abuse Act (CFAA) and its California state law analogue, the Comprehensive Computer Data Access and Fraud Act (CDAFA); and (2) remanded for further proceedings.

To succeed on a claim under the CFAA, a plaintiff must show that the defendant (1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that the defendant (3) thereby obtained information (4) from any protected computer, and that (5) there was loss to one or more persons during any oneyear period aggregating at least $5,000 in value.

The panel concluded that Amazon was not entitled to a preliminary injunction because it was unlikely to succeed on the merits of its CFAA claims by showing that Perplexity “accessed” Amazon computers for CFAA purposes. On the facts before the panel, it concluded that Perplexity did not use a tool to “access” Amazon’s computers. Rather, it was the user who “accessed” Amazon’s computers, with the help of Perplexity’s AI agent, the “Assistant,” to carry out specific acts on Amazon.com. The panel concluded that Amazon was unlikely to succeed on the merits of its CDAFA claim for the same reason that Amazon was unlikely to succeed on the merits of its CFAA claim: the user (not Perplexity) accessed Amazon using the Assistant as an AI tool.

The panel held that the district court erred in concluding that the remaining equitable factors favored Amazon. The remaining equitable factors favored Perplexity because (1) the potential harms Amazon faces do not weigh in favor of an injunction, (2) the balance of the equities favors Perplexity and weighs against an injunction, and (3) an injunction against conduct that likely does not violate the CFAA or the CDAFA would not serve the public interest. The panel therefore vacated the preliminary injunction and remanded for further proceedings. user’s machine and enabling the user to navigate the Internet. According to Perplexity, Comet’s differentiating feature is an optional AI “agent” (the Assistant) that “can perform tasks at the user’s direction, such as browsing websites like Amazon.com to shop for requested goods.”

When a Comet user directs the Assistant to locate an item on Amazon.com, the Assistant takes screenshots of the browser view, sends those screenshots from the user’s computer to Perplexity’s servers, and receives instructions from Perplexity’s servers on how to navigate Amazon.com. In other words, the Assistant cannot operate wholly independently; it relies on direction from the user and instructions from Perplexity’s servers.

Amazon owns and operates Amazon.com, also known as the Amazon Store. Customers may create Amazon.com accounts, which, according to Amazon, allow them to “manage orders, store payment information and delivery addresses, receive personalized recommendations, track purchases, and process returns within their passwordprotected accounts.” Amazon also operates in the AI space and launched agentic AI products in 2025.

Before Comet’s release, Amazon told Perplexity’s CEO that Perplexity’s AI products would not be permitted to access the Amazon Store. After Perplexity launched Comet and the Assistant accessed the Amazon Store, Amazon again informed Perplexity that it did not have authorization to do so. At the core of the dispute was Perplexity’s decision not to use a “user-agent string,” a mechanism “that would communicate that the user has activated an AI agent.” That Amazon filed its Complaint in November 2025, alleging violations of the CFAA and the CDAFA. Amazon also moved simultaneously for a preliminary injunction. In March 2026, the district court held a hearing on the motion and issued a tentative ruling in Amazon’s favor, indicating that it was a close call. The district court soon after issued a written order granting Amazon’s requested preliminary injunction on the grounds that Amazon had shown a likelihood of success on its CFAA claims under § 1030(a)(2) and its CDAFA claims. The district court also held that Amazon had shown it would suffer irreparable harm absent an injunction and that the balance of the hardships and public interest favored Amazon.

To bring a successful § 1030(a)(2) claim pursuant to the CFAA private right of action, Amazon must show that Perplexity “(1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that [Perplexity] (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign communication), and that (5) there was loss to one or more persons during any one-year period aggregating at least $5,000 in value.” See LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). We have cautioned against interpretations that “would transform the CFAA from an anti-hacking statute into an expansive misappropriation statute.” United States v. Nosal (Nosal I), 676 F.3d 854, 857 (9th Cir. 2012) (en banc).

In its short written order, the district court stated: “Amazon has provided strong evidence that Perplexity, through its Comet browser, accesses with the Amazon user’s permission but without authorization by Amazon, the user’s password-protected account, thereby obtaining information as to the user’s private Amazon account information, and that such information is transmitted to Perplexity’s servers for the purpose of conducting said user’s requested tasks,” and “Amazon has submitted essentially undisputed evidence that it has expended significantly more than $5,000 in responding to such circumstances, including, for example, costs attributable to numerous hours spent by Amazon employees in developing tools to block Comet’s access to its private customer accounts and detecting future unauthorized access by Comet.” The district court erred, however, in its “access” analysis.

Perplexity argues that “access” for CFAA purposes requires the defendant to have “gain[ed] entry” to the computer “system itself.” See Van Buren v. United States, 593 U.S. 374, 388 & n. (2021). In Perplexity’s view, it never “gain[ed] entry” to an Amazon computer because no Perplexity computer ever accessed Amazon’s servers. Instead, Perplexity explains that any Amazon data was first transmitted to the user’s computer and then to Perplexity’s servers via browser screenshots.

This is most akin, Perplexity argues, to an Apple user accessing Amazon.com via the Safari web browser, even if “the Safari software automatically fills in the user’s address and payment information at checkout on the user’s behalf.” Any arguable intent that the Assistant possesses should, Perplexity asserts, be ascribed to the user, not to Perplexity itself, because “the Assistant is mere computer software that has no ‘intent’ apart from what the user directs it to do on the user’s behalf.” Perplexity also points to Meta Platforms, Inc. v. BrandTotal Ltd., 605 F. Supp. 3d 1218 (N.D. Cal. 2022), for the proposition that access to data on a user’s computer sent to that user by a company is not the same as access to that company’s computer. See id. at 1232, 1260– 61.

In Amazon’s view, it suffices for CFAA purposes that the Assistant communicates with Perplexity’s servers to, as Perplexity states, “determine appropriate actions” regarding the Amazon Store. Amazon argues that Perplexity itself admits that the Assistant proceeds autonomously and “behaves like an efficient human shopper,” and that autonomous action should be ascribed to Perplexity because it is the Perplexity servers that direct the Assistant. According to Amazon, this argument tracks our conclusion in Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), and what Amazon describes as a “relatively ministerial, user-directed task” can be ascribed to Perplexity. See id. at 1066–68. This is different, Amazon argues, from Safari because the Assistant’s agentic capabilities—i.e., its autonomous action—go beyond the passive displays of a traditional web browser. Amazon further argues that BrandTotal is distinguishable because the data there was collected passively through users’ normal use of Facebook, as opposed to the Assistant actively navigating Amazon.com.

Agentic AI is an emerging technology. There is thus little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant, let alone caselaw specifically dealing with agentic AI in the CFAA context. And CFAA cases dealing with more established technologies do not provide a perfect analogue to the case at hand. Take the parties’ two main cited cases as examples.

In Power Ventures, Facebook sued Power Ventures under the CFAA for alleged violations of the same subsection at issue in this case. See 844 F.3d at 1066. Power Ventures operated a social media aggregation platform that allowed users to “see all contacts from many social networking sites on a single page.” Id. at 1062. As part of a promotional campaign in which Power awarded users who invited others to the Power platform, “Power caused a message to be transmitted to the user’s friends within the Facebook system.” Id. at 1063. We held that Power was liable pursuant to the CFAA for continuing to cause such district court declined to extend CFAA liability to such conduct. See id. at 1261. But here, the Assistant appears to do more than passive data collection.

The Amicus Brief of Electronic Frontier Foundation, Alliance for Responsible Data Collection, Mozilla Corporation, Digital Medusa, and EleutherAI articulates the nature of the system most clearly:

When a user visits a website, only . . . the browser . . . communicates with the website’s server. Specifically, when a user visits an Amazon.com webpage, the browser requests the contents of the page from Amazon’s server and displays the page to the user. If the user activates the Assistant, the Assistant will analyze the contents of the page that has been displayed by the browser on the user’s computer. . . . If necessary to carry out the task requested by the user, the Assistant may communicate the user’s instructions, along with information received from the browser pertaining to the page accessed by the user and any potentially relevant browsing history, to Perplexity’s AI servers. Perplexity’s servers never directly access Amazon’s servers.

What is clear from this description—and how the parties themselves describe the systems at issue—is that Perplexity itself does not directly communicate with Amazon’s servers.

We must nevertheless determine whether Perplexity accesses Amazon.com through the Assistant. The CFAA’s plain language suggests the Assistant itself cannot “access” Amazon’s servers. The relevant provision of the CFAA punishes “[w]hoever . . . intentionally accesses” a “protected computer.” 18 U.S.C. § 1030(a)(2) (emphasis added). In other words, the CFAA contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. See 18 U.S.C. § 921(a)(1) (“The term . . . ‘whoever’ include[s] any individual, corporation, company, association, firm, partnership, society, or joint stock company.”); see also Whoever, Cambridge English Dictionary, [https://perma.cc/YY3T- VTJF] (last visited July 16, 2026) (“[T]he person who” (emphasis added)).

The Supreme Court has instructed that, “in the computing context, ‘access’ references the act of entering a computer system itself or a particular part of a computer system, such as files, folders, or databases.” Van Buren, 593 U.S.