Courts have spent years working through how the Computer Fraud and Abuse Act (“CFAA”) applies to web scraping, including whether access to a website occurs “without authorization.” In Amazon.com Services, LLC v. Perplexity AI, Inc., the Ninth Circuit addressed that familiar CFAA claim, but in connection with a novel technology, agentic AI. Rather than focusing on whether Perplexity, as an entity, had authorization to access Amazon’s site, the court addressed whose technology “accesses” Amazon’s computers. The court found that individual Perplexity users, rather than Perplexity as a company, “accessed” Amazon.com. In doing so, the court vacated a preliminary injunction that prohibited Perplexity from enabling its users to use Perplexity’s AI-powered browser to interact with Amazon.
While the decision leaves open questions about who bears responsibility for agentic AI online, it provides an important first answer at least in connection with CFAA claims. The holding suggests that a developer is not automatically responsible for an AI agent’s activity even where the developer built the agent and provides instructions that help it perform a user-requested task.
Agentic Browsing
Perplexity operates Comet, an AI-enabled web browser that runs locally on a user’s computer. Comet includes an optional AI agent called the “Assistant,” which can perform tasks at the user’s direction, such as navigating Amazon to shop for requested products.
When a user asks the Assistant to locate an Amazon product, the Assistant takes screenshots of what the browser displays, sends those screenshots to Perplexity’s servers, and receives instructions from those servers about how to navigate Amazon. The Assistant therefore does not operate entirely independently: the user initiates the task, while Perplexity’s servers supply instructions used to carry it out.
In November 2025, Amazon sued Perplexity under the CFAA and the California equivalent, California’s Comprehensive Computer Data Access and Fraud Act (“CDAFA”). In March 2026, the Northern District of California granted Amazon a preliminary injunction after finding, among other things, that Amazon was likely to succeed in showing that Perplexity accessed password-protected Amazon accounts without Amazon’s authorization. Perplexity appealed.
Who “Accesses” the Amazon’s Servers?
The CFAA prohibits knowingly accessing a protected computer without authorization or by exceeding authorized access. Many significant web scraping cases involving CFAA claims focus on whether the relevant computer systems are accessible to the general public or whether there are certain restrictions on access—which the Supreme Court articulated as a “gates-up-or-down” analysis in its decision in Van Buren. In Van Buren, the court’s decision did not turn on whether an access gate was up or down. It turned on who went through the gate.
Here, Perplexity argued that “access” would have required it to actually gain entry into Amazon’s computer system, and that Perplexity’s own computers never entered Amazon’s systems: Amazon sent information to the user’s browser, the Assistant analyzed what appeared on the user’s computer, and screenshots were then transmitted separately to Perplexity. Perplexity compared the Assistant to conventional browser functionality that acts for a user, such as autofilling payment or address information.
Amazon countered that the Assistant was not merely a passive browser feature because Perplexity’s servers instructed it how to navigate Amazon. In Amazon’s view, those agentic capabilities meant that the Assistant’s actions should be attributed to Perplexity.
That distinction presented a novel issue. The Ninth Circuit noted that there is “little to no existing caselaw” addressing how responsibility for AI agents should be allocated, and existing CFAA precedents involving more conventional technologies did not offer a perfect analogue.
The User Accesses Amazon; Perplexity Does Not
The Ninth Circuit’s CFAA analysis involved two key findings, starting with the definition of “[w]hoever” in reference to intentionally accessing a protected computer. The court held that an AI agent is not a person within the plain language of the statute, such that an AI agent would not be capable of intentionally accessing a protected computer. The court said: “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.”
The court also concluded that Perplexity does not “access” Amazon’s servers within the meaning of the CFAA. Under the Supreme Court’s Van Buren formulation, access refers to entering a computer system or a particular part of that system. Here, the user’s browser—not Perplexity— communicated with Amazon, and therefore, the user accessed Amazon and used Perplexity’s Assistant as a tool to carry out actions within Amazon’s website.
The court nevertheless left itself room to reach a different conclusion in a future case. It expressly declined to decide whether different facts—or a different degree of control by an AI developer over its agent—could result in the developer itself “accessing” a website. That qualification could become important as agentic systems become more autonomous and the line between a user-directed tool and an independently acting service becomes harder to draw.
What the Decision Means (and Does Not Mean) for Agentic AI
This case confirmed that courts remain reluctant to turn the CFAA into a general-purpose tool for policing unwanted online conduct. However, it did not establish a general liability framework for agentic AI, decide whether an AI developer could be responsible for its agent under tort or other legal theories, or hold that an AI agent can never be sufficiently controlled by its developer for the developer to have “accessed” another computer. It decided only that these facts did not establish access by Perplexity for purposes of the CFAA.
Nor did the Ninth Circuit address whether Perplexity acted without authorization, whether Amazon adequately established the CFAA’s $5,000 “loss” requirement, or the other elements of Amazon’s CFAA claim. Once the court determined the “access” issue, those other questions were unnecessary.
The procedural posture is also important. This was an appeal from a preliminary injunction, not a motion to dismiss, summary judgment ruling, or decision following trial. Amazon filed its complaint and preliminary injunction motion at the outset of the litigation, and the Ninth Circuit decided only that Amazon was unlikely to succeed on the CFAA and CDAFA theories presented on the current record. The litigation itself continues on remand.
For companies developing agentic products, the decision nevertheless offers an early indication that technical architecture may matter significantly for CFAA risk. How much autonomy the agent possesses and how much control the developer exercises over its specific interactions with the third-party site may be a critical inquiry.
For website operators, the decision is another reminder that the CFAA is not necessarily a comprehensive remedy for unwanted access. The Ninth Circuit expressly noted that its ruling does not prevent Amazon from regulating access through private terms of service. And, as we have seen throughout the evolution of web-scraping litigation, other claims (e.g., including contract, copyright, DMCA, and tort theories) may be effective.
We will continue to monitor this case as it proceeds through the next phases of litigation.