Part of the AI Regulation News hub.
The Ninth Circuit vacated Amazon's preliminary injunction against Perplexity, finding Amazon unlikely on this record to prove that Perplexity accessed Amazon under the CFAA
A published federal appellate opinion on whether software can commit computer fraud. Read the disposition before the headline: the injunction is gone, and the case is not.
Bottom line: On 4 August 2026 a Ninth Circuit panel vacated the preliminary injunction Amazon had obtained against Perplexity AI and remanded for further proceedings. The opinion is marked FOR PUBLICATION, so it binds district courts in the circuit.
The holding, in the court's words: The relevant provision of the Computer Fraud and Abuse Act punishes whoever intentionally accesses a protected computer. The panel read that as contemplating access by a person, and wrote: "However advanced the Assistant currently is, it is a tool, not a person for statutory purposes."
Who did the accessing: "It is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com." Perplexity receiving screenshots and sending instructions did not, by itself, mean Perplexity gained entry to Amazon's servers.
What this is not: This is a ruling on likelihood of success at the preliminary-injunction stage, on this record. It is not a merits judgment, Perplexity has not won the case, and the panel expressly refused to create a general rule for agentic AI. Those limits are in the opinion itself.
What a business defending its own site should take from it: This is the desk's analysis, not a direction from the court. If your position assumed the CFAA reaches automated access to your website, this decision is a reason to retest it where the architecture resembles this one, browser-mediated with no direct server-to-server contact. Footnote 5 preserves your contract route: the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users."
Primary sources: Opinion, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) · 18 U.S.C. section 1030, the Computer Fraud and Abuse Act · California Penal Code section 502, the CDAFA
- Case
- Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444
- Court
- United States Court of Appeals for the Ninth Circuit. FOR PUBLICATION
- Panel
- Circuit Judges Milan D. Smith, Jr. and Eric C. Tung, and District Judge John Charles Hinderaker (D. Ariz.), sitting by designation. Opinion by Judge Milan D. Smith, Jr.
- Below
- D.C. No. 3:25-cv-09514-MMC, Northern District of California, District Judge Maxine M. Chesney
- Argued and submitted
- 11 June 2026, Seattle, Washington
- Decided
- 4 August 2026
- Disposition
- Preliminary injunction VACATED. REMANDED for further proceedings
- Statutes
- Federal CFAA, 18 U.S.C. section 1030, claim under section 1030(a)(2). California analogue CDAFA, Cal. Penal Code section 502
- Procedural posture
- Preliminary injunction, reviewed on likelihood of success. Not a merits determination
- Elements not reached
- The remaining CFAA elements, including the scope of the loss provision (footnote 4). Amazon's section 1030(a)(4) claim was not addressed below and was not raised on appeal (footnote 2)
- Preserved for Amazon
- Regulating access via private terms of service for its users (footnote 5)
- Disputed, not decided
- Whether Perplexity knowingly altered the Assistant's user-agent string after Amazon first blocked it (footnote 1)
- Primary source
- https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf
The distinction the case turns on is who acted, not what was used
Amazon sued in November 2025 over Perplexity's Comet browser and its optional Assistant, which performs tasks at the user's direction. Perplexity built Comet after acquiring Sidekick, and released it in 2025. Amazon told Perplexity's chief executive before release that its AI products would not be permitted on the Amazon Store, and said so again after launch.
The district court granted a preliminary injunction, calling it a close call in a tentative ruling for Amazon, then issued a written order. Bond was refused. A seven-day administrative stay followed, and a motions panel then stayed the injunction pending appeal with expedited briefing.
On appeal the panel narrowed the question to a single word in the statute. The provision Amazon sued under punishes, in the statutory text, whoever intentionally accesses a protected computer. The panel's reading: "In other words, the CFAA contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes."
That is the sentence that will be quoted, and it is worth being precise about what it does. It does not say an AI agent can never trigger the statute. It says this statute, on this record, aims at persons, and the Assistant is not one. The actor the statute reaches is the human who directed it.
The technical description did the work, and both sides agreed on it
The panel adopted a description of the architecture drawn from an amicus brief filed by the Electronic Frontier Foundation, the Alliance for Responsible Data Collection, Mozilla Corporation, Digital Medusa and EleutherAI.
On that description the browser communicates with Amazon's server. The Assistant analyses the page already displayed on the user's own computer, and may relay the user's instructions along with page information and potentially relevant browsing history to Perplexity's AI servers. The operative sentence: "Perplexity's servers never directly access Amazon's servers."
The panel then noted that this matches how both parties themselves describe the systems at issue. In this desk's reading, that agreement is what let the point carry without a contested factual finding. A defendant in a later case whose architecture routes server-to-server, or whose own filings describe it differently, does not get this outcome by citing this opinion.
The court also distinguished passive data collection. It observed that the Assistant "appears to do more than passive data collection", and so did not treat the earlier authority Amazon relied on as resolving the matter by itself.
Lenity, and the risk of criminalising the user
The panel reached its access conclusion first, then wrote that "[t]his conclusion is further reinforced by the rule of lenity." Lenity reinforced the narrow reading; it did not drive the result. Because the CFAA is "primarily a criminal statute" and interpretations of its provisions are equally applicable in the civil and criminal contexts, ambiguity is construed against the government.
In this desk's reading, and we mark it as ours rather than the court's: that reinforcement is worth noting for anyone litigating scraping and bot-blocking, because a civil plaintiff asking a court to read the CFAA broadly is asking it to widen a criminal prohibition. The opinion does not say how future panels will weigh that.
The panel also followed Amazon's theory to its consequence. On that theory the user, having directed the Assistant, would be the one who accessed the servers, which the court noted could expose users themselves to criminal liability on a conspiracy or aiding-and-abetting theory. It cited the circuit's own warning against transforming whole categories of otherwise innocuous behaviour into federal crimes simply because a computer is involved.
The California claim went the same way for the same reason. "Amazon's CFAA and CDAFA claims rise and fall together." Even if access under the CDAFA is broader, the relevant prohibition applies only to any person who causes unauthorised access, so "the focus of the inquiry is still on the person accessing or causing the access."
What the court expressly did NOT decide, which is the part that matters most
Unusually, the panel wrote its own limits into the opinion. Anyone briefing this case should quote this passage before the holding, because it is what keeps a citation honest.
"Because we recognize that agentic AI is an emerging technology, we reiterate what this opinion is not. We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant's actions."
The panel added that its holding is limited to access as contemplated by the CFAA, as applied to the Assistant's interactions with Amazon.com on the record before it, and not the broader legal landscape surrounding agentic AI. Then a temporal limit: "For now, this opinion reflects and applies to the state of technology only as presented in the filings in this case."
Elsewhere the court left open whether, on a different record or new facts, Perplexity might exercise control over the Assistant in such a way as to gain entry to Amazon's servers. Footnote 4 leaves the remaining CFAA elements, including the loss provision, unreached. Footnote 2 records that the district court did not address Amazon's section 1030(a)(4) claim and that Amazon did not raise it on appeal.
The opinion does not decide the enforceability or remedies of private terms of service; footnote 5 instead preserves Amazon's ability to regulate access through them. It says nothing about copyright or trespass to chattels, expressly leaves tort liability open, and does not reach the loss threshold or the section 1030(a)(4) claim. It also leaves open what happens on a different technical record.
The equities, and why the injunction failed twice over
Having found Amazon unlikely to succeed on the access element, the panel also found the equitable factors against it.
One limb of Amazon's irreparable-harm showing was declarations that the Assistant may not select the best price, delivery method or product recommendations, which the panel read as claiming a degraded shopping experience. It held those harms more attenuated than in the cases Amazon relied on, and called the degradation of the overall shopping experience "more abstract", noting also the question of how far users would blame the Assistant given their own choice to employ it.
The panel assessed a second limb separately and called it "also weak": Amazon's cyber-risk argument. It noted Perplexity's contention that Amazon's own expert said he could not fully replicate the risks, that only one cited risk involved a shopping website and not Amazon.com itself, and concluded that while the declaration gives some support, "Amazon's proffered evidence is limited and counteracted, at least in part, by Perplexity's asserted cyber improvements. Accordingly, the potential harms Amazon faces do not weigh in favor of an injunction."
The balance of equities and the public interest both favoured Perplexity. An injunction against conduct that likely violates neither statute, the panel reasoned, would not serve the public interest.
That double basis matters on remand. A plaintiff who cures the likelihood-of-success problem still has an evidentiary problem on harm.
What to actually do differently
Everything in this section is our analysis, not a direction from the court. The opinion decides an injunction; it does not tell anyone how to run a compliance programme.
If you defend a website: on this record the CFAA was not a successful lever against this architecture, so a strategy that assumed the statute reaches automated access deserves a fresh look. Footnote 5 records only that the outcome does not impair Amazon's ability to regulate access via private terms of service for its users. It does not decide whether such terms are enforceable, what remedies follow, or that contract is the preferred route. Because the panel treated the system architecture as a central fact, it is worth knowing whether your own logs show server-to-server contact or a user's browser before assuming this case is analogous.
If you build or buy agentic tools: this addresses one statutory element, on one architecture, at one procedural stage. Be precise about the disclaimers, because they differ. The panel expressly declined to decide whether Perplexity can avoid liability for the Assistant in other contexts including tort claims. It said nothing about copyright. On terms of service it did not disclaim, it preserved: footnote 5 keeps that route open for the site owner. The dispute over the user-agent string is unresolved and is a factual issue, not a legal shield.
If you are advising on a live scraping or bot-access matter: the case was remanded, so counsel telling a client the matter is over is wrong. Diary the district-court docket rather than the appellate one.
For everyone: this is one circuit. The panel refused to generalise, and nothing here predicts how another circuit will read the same word.
The Ninth Circuit vacated Amazon's preliminary injunction against Perplexity on 4 August 2026 and remanded. On this record Amazon is unlikely to succeed on the access element of its CFAA and CDAFA claims, because the statute contemplates access by a person and the Assistant is a tool, not a person, so it is the user who accesses the site. The panel applied the rule of lenity and flagged that Amazon's theory could expose users to criminal liability. It expressly declined to establish any legal regime for agentic AI, declined to decide whether Perplexity can avoid liability in other contexts including tort, said nothing about copyright, preserved the site owner's terms-of-service route in footnote 5, and limited itself to the technology as presented in these filings. Perplexity has not won the case, and scraping has not become lawful.
Source File
https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf
Open the Ninth Circuit opinion in No. 26-1444 dated 4 August 2026 and read it in this order. Take the disposition from the caption page first, VACATED and REMANDED, so the posture is fixed before the reasoning. Then read the access analysis for the sentence that the CFAA contemplates access by a person and that the Assistant is a tool, not a person. Read the amicus-derived technical description immediately before it, because the holding rests on the finding that Perplexity's servers never directly access Amazon's servers. Read footnote 3 for the rule of lenity. Then read the paragraph beginning that the panel reiterates what this opinion is not, which contains the express limits, and footnotes 1, 2, 4 and 5 for the disputed user-agent string, the unraised section 1030(a)(4) claim, the unreached loss provision, and the preserved terms-of-service route. Read the CDAFA discussion for the statement that the claims rise and fall together, and the final pages for the irreparable-harm and public-interest analysis.
However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. ยท Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), slip op. at 15
FAQ
Did Perplexity win the case?
No. The panel vacated a preliminary injunction and remanded for further proceedings. That is a ruling about likelihood of success on the record before the court, not a judgment on the merits, and the litigation continues in the district court.
Does this mean AI agents cannot violate the CFAA?
No, and the court refused to say that. It wrote that it does not establish a new legal regime governing agentic AI, and limited its holding to the meaning of access under the CFAA as applied to this Assistant's interactions with Amazon.com on this record. It also left open whether, on a different record or new facts, Perplexity might exercise control over the Assistant in a way that does gain entry to a site's servers.
Can a site still block AI agents?
Yes. Footnote 5 records that the outcome does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users. The technical blocking question is separate and unresolved: the parties dispute whether Perplexity knowingly altered the Assistant's user-agent string after Amazon first blocked it, and the court did not resolve it.
What changes for a business defending its own website?
Read this as our analysis rather than a rule the court announced. On this record and this architecture the CFAA claim did not succeed, so the statute looks like a weaker lever than a site owner might have assumed. Footnote 5 records that the outcome does not impair Amazon's ability to regulate access via private terms of service for its users, which keeps that route open without deciding its enforceability or remedies. Because the panel treated the finding that Perplexity's servers never directly access Amazon's servers as central, the architecture in your own logs matters to whether this case is analogous to yours. Note also that the injunction failed on the equities too: the panel called the degraded shopping experience more abstract than the harms in the cases relied on, and called the cyber-risk argument also weak.
Is this binding outside the Ninth Circuit?
No. The opinion is marked FOR PUBLICATION, so it binds district courts within the Ninth Circuit, but it is persuasive only elsewhere. The panel expressly declined to generalise, and nothing in it predicts how another circuit will read the statute.
Was the loss threshold or the section 1030(a)(4) claim decided?
Neither. Footnote 4 records that the remaining CFAA elements, including the scope of the loss provision, were not reached. Footnote 2 records that the district court did not address Amazon's section 1030(a)(4) claim and that Amazon did not raise it on appeal.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.