This is the published opinion of the United States Court of Appeals for the Ninth Circuit in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, filed August 4, 2026. The panel comprised Circuit Judges Milan D. Smith, Jr. and Eric C. Tung and District Judge John Charles Hinderaker of the District of Arizona, sitting by designation; Judge Smith wrote for the court. The case was argued and submitted June 11, 2026 in Seattle, on appeal from the Northern District of California (No. 3:25-cv-09514-MMC, Chesney, J.). The opinion runs to 21 pages and vacates the preliminary injunction that had barred Perplexity's Comet Assistant from Amazon's marketplace, remanding for further proceedings.
The holding is narrow and the panel says so expressly: Amazon is unlikely to succeed on the "access" element of the Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act (CDAFA), because on this record "[i]t is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com."
Statutory background as the panel states it
The opinion recites the CFAA's history: enacted as part of the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 98-473, tit. II, ch. XXI, 98 Stat. 1837, 2190–92, and aimed, per hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022), "to prevent intentional intrusion onto someone else's computer—specifically, computer hacking." The 1984 version reached only computers holding national-security or financial data and those operated by or for the government; a 1996 amendment extended it to any "protected computer" as now defined at 18 U.S.C. § 1030(e)(2). The private cause of action requires damage or loss aggregating at least $5,000 in a year.
California's CDAFA, Cal. Penal Code § 502, was enacted in 1987 "to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems." It criminalizes "[k]nowingly and without permission access[ing] or caus[ing] to be accessed any computer, computer system, or computer network," § 502(c)(7), and supplies a private right of action, § 502(e)(1).
The five-element § 1030(a)(2) test the panel applies comes from LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009): intentional access, without or exceeding authorization, thereby obtaining information, from a protected computer, with at least $5,000 in loss.
The technical record
The opinion describes Comet as a browser that "operates like Google Chrome, running locally on a user's machine." Perplexity developed it after acquiring the browser company Sidekick and released it publicly in 2025. Its distinguishing feature is an optional agent, the Assistant, that "can perform tasks at the user's direction, such as browsing websites like Amazon.com to shop for requested goods." When directed to find an item, the Assistant "takes screenshots of the browser view, sends those screenshots from the user's computer to Perplexity's servers, and receives instructions from Perplexity's servers on how to navigate Amazon.com." The panel records that the Assistant "cannot operate wholly independently."
The dispute's factual core is the user-agent string. Amazon told Perplexity's chief executive before Comet's release that its AI products would not be permitted on the Amazon Store, and repeated that after launch. Perplexity chose not to use a user-agent string, a mechanism "that would communicate that the user has activated an AI agent" and would let Amazon block it. A footnote records that the parties dispute whether Perplexity knowingly altered the string after Amazon first succeeded in identifying and blocking the Assistant.
The panel adopts, as the clearest statement of the architecture, a passage from the amicus brief of the Electronic Frontier Foundation, the Alliance for Responsible Data Collection, Mozilla Corporation, Digital Medusa and EleutherAI: only the browser communicates with the website's server; the Assistant analyzes the page already displayed on the user's computer and may relay the user's instructions and page information to Perplexity's AI servers; "Perplexity's servers never directly access Amazon's servers."
Procedural history recorded in the opinion
Amazon filed in November 2025 and moved simultaneously for a preliminary injunction. In March 2026 the district court held a hearing, issued a tentative ruling in Amazon's favor indicating that it was a close call, and then granted the injunction in a short written order finding a likelihood of success under § 1030(a)(2) and the CDAFA, together with irreparable harm and a favorable balance of hardships and public interest. The written order did not address Amazon's § 1030(a)(4) claim, which Amazon did not raise on appeal. The district court denied Perplexity's request for a bond and for a stay pending appeal but granted a seven-day administrative stay; a motions panel of the Ninth Circuit then entered an administrative stay, issued a stay pending appeal, and ordered expedited briefing and calendaring.
The district court's operative language, quoted in the opinion, was that "Amazon has provided strong evidence that Perplexity, through its Comet browser, accesses with the Amazon user's permission but without authorization by Amazon, the user's password-protected account, thereby obtaining information as to the user's private Amazon account information, and that such information is transmitted to Perplexity's servers," and that Amazon had spent well over $5,000 developing blocking and detection tools.
The access holding
Review is for abuse of discretion under Sierra Forest Legacy v. Rey, 577 F.3d 1015, 1021 (9th Cir. 2009), asking under United States v. Hinkson, 585 F.3d 1247, 1261–62 (9th Cir. 2009) (en banc), whether the district court identified the correct legal rule and whether its application was illogical, implausible, or without record support. The four Winter factors govern, on the circuit's sliding-scale approach per Bennett v. Isagenix Int'l LLC, 118 F.4th 1120, 1126 (9th Cir. 2024).
The panel frames the parties' positions symmetrically. Perplexity argued that "access" requires "gain[ing] entry" to the system itself under Van Buren v. United States, 593 U.S. 374, 388 & n.6 (2021); that no Perplexity computer ever reached Amazon's servers; that the arrangement is like a Safari user whose browser autofills address and payment details at checkout; that the Assistant "is mere computer software that has no 'intent' apart from what the user directs it to do"; and that Meta Platforms, Inc. v. BrandTotal Ltd., 605 F. Supp. 3d 1218 (N.D. Cal. 2022), establishes that access to company data sitting on a user's computer is not access to the company's computer. Amazon argued that it suffices that the Assistant communicates with Perplexity's servers to determine appropriate actions; that Perplexity admits the Assistant proceeds autonomously and "behaves like an efficient human shopper"; that Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), permits ascribing a "relatively ministerial, user-directed task" to the vendor; and that the Assistant's agentic capabilities distinguish it from a passive browser and from BrandTotal's passive logging.
The panel says neither precedent fits. In Power Ventures the court "assumed without discussion that Power 'accessed' Facebook," devoting the analysis to authorization rather than access, though its description "implied that Power accessed Facebook's servers." BrandTotal concerned an extension that "passively logged" data users already received, which the district court held was "not proactively 'accessing' or 'communicating with' Meta's servers"; here, by contrast, "the Assistant appears to do more than passive data collection." The panel states plainly that "[a]gentic AI is an emerging technology" and that there is "little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents."
Two steps carry the holding. First, Perplexity does not itself communicate with Amazon's servers, which follows from the architecture both parties describe. Second, Perplexity does not access Amazon through the Assistant, because § 1030(a)(2) punishes "[w]hoever . . . intentionally accesses" a protected computer, and "the CFAA contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes." The panel cites the definition of "whoever" at 18 U.S.C. § 921(a)(1) and a dictionary entry. Applying Van Buren's definition of access as "entering a computer system itself or a particular part of a computer system," it concludes that receiving screenshots and sending instructions "by themselves, do not mean that Perplexity has 'accessed' (gained entry) to Amazon's servers."
The rule of lenity reinforces the reading. Because the CFAA is "primarily a criminal statute" whose interpretations are "equally applicable" civilly, per Brekka, ambiguity is construed against liability. Even accepting Amazon's approach as reasonable, adopting it "would require a novel interpretation far afield from the statute's purpose." The panel adds a further concern: Amazon's theory "could expose users themselves to criminal liability (under a conspiracy or aiding-and-abetting theory)," against the caution in United States v. Nosal (Nosal I), 676 F.3d 854, 860, 862 (9th Cir. 2012) (en banc), about "transform[ing] whole categories of otherwise innocuous behavior into federal crimes simply because a computer is involved."
The CDAFA claim fails for the same reason. The panel accepts that Amazon "might be correct that 'access' under the CDAFA is broader than the CFAA's definition," but the prohibition in § 502(c)(7) reaches "any person" who causes unauthorized access, so "the focus of the inquiry is still on the person accessing or causing the access."
Stated limits
The opinion sets out four limits on itself. It does "not establish a new legal regime governing agentic AI." It does not address whether Perplexity can avoid liability for the Assistant's actions "in other contexts, including tort claims." It reserves the question "whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers." And a footnote states that the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users" — Amazon is "simply unlikely to succeed in its attempt to regulate access by invoking the CFAA and the CDAFA." The panel also declines to reach the remaining CFAA elements, including the scope of the loss provision, and adds that "this opinion reflects and applies to the state of technology only as presented in the filings in this case."
The equitable factors
The panel first rejects Perplexity's procedural objection: the district court did not simply substitute its merits finding for the equitable analysis, since "it discussed each of the equitable factors," though much of that discussion presupposed a CFAA violation.
On irreparable harm, the panel treats the question as close. Amazon's evidence was declarations claiming the Assistant "may not select the best price, delivery method, or product recommendations for a customer," which the panel finds "more attenuated than the harms recognized in other 'threat of harm' cases," contrasting Stuhlbarg Int'l Sales Co. v. John D. Brush & Co., 240 F.3d 832, 840–41 (9th Cir. 2001), where customs detention meant identified customers would not receive goods already promised. Degradation of the overall shopping experience "is more abstract, as is the degree to which users would hold the Assistant responsible for any such degradation given their choice to employ it." On cyber risk, the panel notes that Amazon's own expert said he could not fully replicate the risks, that only one cited risk involved a shopping website and not Amazon.com, and that the evidence is "limited and counteracted, at least in part, by Perplexity's asserted cyber improvements."
On the balance of equities, an injunction "needlessly imposes a burden on Perplexity by preventing it from fully operating a product that it spent large sums developing." On the public interest, an injunction against conduct that likely violates neither statute "would impair consumer choice and needlessly limit development of a nascent technology."
Counsel and amici
Hagan Scotten of Hueston Hennigan LLP argued for Amazon, with Christine M. Woodin, Moez M. Kaba and Billy J. McLain. Christopher G. Michel of Quinn Emanuel Urquhart & Sullivan LLP argued for Perplexity, with Lucas A. Hammill, Renita N. Sharma, Daniel C. Posner, Jonathan H. Kim, John B. Quinn and Andrew H. Schapiro.
Amici were the American Civil Liberties Union, the ACLU of Northern California and the Knight First Amendment Institute at Columbia University (Esha Bhandari and Lauren Yu; Jake Karr, Ramya Krishnan and Alex Abdo); the Electronic Frontier Foundation, the Alliance for Responsible Data Collection, Mozilla Corporation, Digital Medusa and EleutherAI (Corynne McSherry, Victoria Noble and Andrew Crocker); the Software & Information Industry Association (Tod Cohen and Annie Nguyen of Manatt Phelps & Phillips LLP); the National Retail Federation (David M. Gossett and Alexandra Perloff-Giles of Davis Wright Tremaine LLP); Digital Context Next (Huth Reynolds LLP); the News/Media Alliance (Winston & Strawn LLP); and the Air Transport Association of America, d/b/a Airlines for America (Ifrah PLLC).
Reception
The Software & Information Industry Association, which appeared as amicus at the merits stage, filed a brief supporting Amazon's petition for rehearing en banc on August 28, 2026, arguing among other things that the panel neither credited the district court's control findings nor held them clearly erroneous under Hinkson, and that it narrowed Power Ventures without saying so (Brief of the Software & Information Industry Association as Amicus Curiae Supporting Rehearing En Banc — Amazon v. Perplexity (August 28, 2026)). Amazon petitioned for rehearing en banc on August 18, 2026 (Source: metnews.com).
Provenance
Retrieved from the Ninth Circuit's own opinion datastore at cdn.ca9.uscourts.gov. Corroborated against Justia's docket page for No. 26-1444 dated August 4, 2026; a Wilson Sonsini client alert of August 7, 2026 and a Pearl Cohen note, both linking the same path; and the SIIA rehearing brief of August 28, 2026, which quotes the slip opinion at pages 7–18 in matching terms. An August 7 Reuters account gave the decision date as August 5; the slip opinion is dated August 4, 2026.
Relationships
- instance-of: AI Agentic Browsers
- depends-on: Computer Fraud and Abuse Act (CFAA)
- supports: Amazon v. Perplexity AI
- contradicts: Brief of the Software & Information Industry Association as Amicus Curiae Supporting Rehearing En Banc — Amazon v. Perplexity (August 28, 2026)
- related: Perplexity, Amazon, Electronic Frontier Foundation (EFF), Software & Information Industry Association (SIIA)