What the Amazon vs Perplexity Ruling Changed
The Ninth Circuit vacated Amazon's injunction against Perplexity's Comet browser in August 2026. It did not say agents are welcome.
What the court actually held
Amazon sued Perplexity in November 2025 over its Comet browser, pleading the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act. A district court granted a preliminary injunction in March 2026. The Ninth Circuit stayed it pending appeal, and in August 2026 vacated it.
The reasoning is the part worth carrying away. On the record before the panel, the systems were being accessed by Amazon's own customers, signed into their own accounts, using software they had chosen. Perplexity was not the one accessing Amazon. On that basis Amazon was unlikely to prevail on a statute written about unauthorised access.
It is the first federal appellate ruling on whether AI agents acting for a user may access an online platform, and the panel was careful to say it was deciding that record rather than announcing a doctrine.
What it did not hold
It did not say agents are welcome, and it did not say a site has lost control of its own front door.
Contract claims were not what the panel found weak. Terms of service, trademark questions and state-law theories are all untouched. A different record with different facts, particularly one where the agent operates at scale rather than for one signed-in customer, could come out differently.
The useful summary is narrow and worth stating without decoration: computer-misuse law is a weak instrument against software a customer chose to run on their own account.
The distinction the ruling turns on
| Crawler | User's agent | |
|---|---|---|
| Acting for | Its operator | One signed-in customer |
| Scale | Many sites, high volume | One session at a time |
| Authenticated | Usually not | As the customer |
| Data ends up | In the operator's product | In front of the person who asked |
| The ruling's reasoning | Does not apply | Applies |
Most blocking rules in the wild do not make this distinction. A blanket refusal of automated access catches a customer's own agent alongside the scraper it was aimed at, and those two are commercially opposite: one is a visitor with a wallet, the other is a cost.
What actually gives you control
Three levers, and none of them are statutes.
Terms of service are a contract question, and contract was not the theory that failed here. Identity is the second lever: an agent that signs its requests can be recognised and treated deliberately, which is what HTTP Message Signatures and Web Bot Auth exist for, supported at AWS WAF since November 2025 and at Cloudflare since early 2026. Rate and behaviour limits are the third, and they are the only ones that keep working regardless of what a visitor claims to be.
Together they let you decide per class of visitor on purpose. The alternative is deciding by accident, which is what a blanket rule does. The trade-offs of each choice are set out in the crawler allowlist post.
The question for an operator
Whether agent-mediated customers are worth having is a commercial decision, not a legal one, and it is answerable with your own data.
Find out whether that traffic already reaches you. Then check whether your checkout, booking or enquiry flow can actually be completed by software driving a browser as a signed-in customer, and whether any step depends on a person noticing something on a screen. What an agent sees on your site covers the mechanics of that audit.
Both failure modes cost money. Silently blocking agent-mediated customers who would have converted turns away business. Letting them arrive and fail halfway through generates support load and a bad impression, which is worse than a clean refusal.
Where this sits next to the other retreat
It is worth reading this alongside what happened to in-chat checkout. OpenAI pulled back from completing purchases inside ChatGPT on 4 March 2026 and confirmed the retirement on 24 March, after roughly five months live and about a dozen Shopify merchants ever going live. Discovery moved into the assistant; the transaction went back to the merchant's own site.
The two events point the same way. Buying inside the assistant lost, and the customer's own agent operating the merchant's site just survived its first appellate test. That makes the merchant's own checkout the surface that matters, which is the argument made in full in agentic commerce after Instant Checkout.
Sources: Reuters via Yahoo Finance, Engadget, PYMNTS on the CFAA narrowing, CNBC on the March injunction.
01Does this mean AI agents can now use any site freely?+
No, and the panel went out of its way to prevent that reading. The holding is that on the factual record presented, Amazon was unlikely to succeed on its Computer Fraud and Abuse Act claim, because the access to Amazon's systems was being performed by Amazon's own customers signed into their own accounts rather than by Perplexity. That is a conclusion about one statute applied to one evidentiary record. The court explicitly declined to announce broader principles about agentic AI or about liability in other legal contexts, which leaves contract claims, terms-of-service claims, trademark questions and state-law theories entirely open. Read as a rule for your own site, it says something much narrower than the headlines: reaching for computer-misuse law against software a customer chose to run is a weak play, and the strength of your position depends on which theory you bring rather than on how you feel about agents.
02What is the practical difference between an agent and a crawler here?+
Who is acting, and on whose instruction, which turns out to be the hinge the whole ruling swings on. A crawler visits your site for its operator's purposes, usually at scale, usually not signed in, and usually to collect data that will be used somewhere else. An agent in the Comet sense is running for one person, signed into that person's account, doing something that person asked for and could have done by hand more slowly. The reasoning that Amazon's customers rather than Perplexity were the ones accessing the systems only works for the second shape. This matters for how you write your rules: a blanket block on automated access sweeps up your own customers' agents alongside the scrapers you actually meant to stop, and the two have different legal footing and very different commercial consequences.
03So what actually gives a site control over agent traffic?+
Three things, none of which are computer-misuse statutes. Your terms of service are a contract question rather than a hacking question, and contract theories were not what the panel found weak. Identity is the second: an agent that signs its requests can be recognised and allowed, throttled or refused on purpose, which is the direction the ecosystem is moving with HTTP Message Signatures and Web Bot Auth support at AWS WAF since November 2025 and at Cloudflare since early 2026. Rate and behaviour limits are the third, and they are the only ones that work regardless of what anyone claims to be. The combination lets you make a deliberate decision per class of visitor instead of an accidental one, and that decision is a commercial choice about whether agent-mediated customers are worth having.
04Should a small business do anything differently because of this?+
Most should do one thing, and it is not legal. Find out whether agent-mediated traffic is already reaching you and what it does when it arrives, because you cannot make a decision about a channel you are not measuring. Check whether your checkout, booking or enquiry flow can be completed by software driving a browser as a signed-in customer, and whether anything in it depends on a human noticing something on screen. That is a product question with a commercial answer: if agent-mediated customers convert and you are silently blocking them, you are turning away business, and if they arrive and fail halfway through, you are generating support load. The legal position only becomes relevant after you have decided which of those you want, and for most operators the decision is worth more than the ruling.
