This is the amicus brief of the Software & Information Industry Association filed in the United States Court of Appeals for the Ninth Circuit on August 28, 2026 in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (DktEntry 67.2), supporting Amazon's petition for rehearing en banc of the panel opinion of August 4, 2026 (Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) — Opinion). It runs to 25 pages; counsel are Tod Cohen and Alysha Agarwal of Manatt, Phelps & Phillips, LLP. SIIA announced the filing on August 31, 2026 (Source: siia.net).
The brief is an advocacy filing by a trade association whose AI-developer members compete with Perplexity; its assertions are SIIA's positions, not findings of any court. The brief states that counsel for both sides consented, that no party's counsel authored it, and that no party funded it.
The filer and its stated interest
SIIA describes itself as a global trade association representing nearly 400 firms "involved in the business of information," including software companies, search engine providers, data and analytics firms and digital publishers serving business, education, government, health care and consumers. It states that its members "include platform operators, licensed database providers, scientific and technical publishers, market data services, educational technology firms, and financial information providers—as well as artificial intelligence ('AI') developers actively building and deploying agentic AI products in compliance with existing access standards," and that those members "have a direct stake in the outcome."
The interest statement contains the passage with the widest reach beyond the case. Many of SIIA's AI-developer members, it says, "already build to the agent identification and permissioning standards emerging across the industry—including the Agentic Commerce Protocol ('ACP') and the Model Context Protocol ('MCP')," and "[t]hose members are disadvantaged by Perplexity's evasive conduct." A footnote characterizes each: the ACP, developed by OpenAI and Stripe, "specifies how an agent identifies itself to a merchant and how a merchant signals whether it accepts agent-initiated transactions"; the MCP, developed by Anthropic, "establishes permissioned, authenticated agent-to-tool connections as a baseline." SIIA's stated conclusion is that excusing Perplexity's conduct "would not expand access or innovation," because "[p]latforms would impose broader limits on AI use, including against compliant agents, and would chill responsible use across the digital ecosystem."
The four arguments
The panel neither credited nor rejected the control findings
SIIA's first and central argument is procedural. The district court found facts bearing on control — "strong evidence" that "Perplexity, through its Comet browser, accesses with the Amazon user's permission but without authorization by Amazon, the user's password-protected account," with the information "transmitted to Perplexity's servers" — and the panel's own recitation, that the Assistant "cannot operate wholly independently; it relies on direction from the user and instructions from Perplexity's servers," points the same way. SIIA asserts that "[t]he navigational decisions executed on Amazon's servers are generated by Perplexity, not by the user's keystrokes."
The panel, SIIA argues, "did not hold any of those findings clearly erroneous. It did not address them." It cites Anderson v. City of Bessemer City, 470 U.S. 564, 573–74 (1985), for the rule that "[w]here there are two permissible views of the evidence, the factfinder's choice between them cannot be clearly erroneous," and United States v. Hinkson, 585 F.3d 1247, 1262 (9th Cir. 2009) (en banc), for the circuit's formulation; the panel "recited that standard . . . and then did not apply it." On corporate attribution, SIIA invokes New York Central & Hudson River R.R. v. United States, 212 U.S. 481, 494–95 (1909), and United States v. Hilton Hotels Corp., 467 F.2d 1000, 1004–05 (9th Cir. 1972), for the proposition that "[a] corporation acts only through instrumentalities," concluding that attributing the Assistant's access to Perplexity "was at a minimum a permissible inference."
The consequence SIIA presses is uncertainty rather than a wrong outcome: members "must decide now what to build, what to disclose to the platforms their agents visit, what to place in their terms of service, and what to tell customers about who bears the risk," and "[n]one of those decisions can be made against a rule that has been set aside without being applied." It adds that if the operator is not the accessor, "the user is the one left exposed." A footnote cites McKinsey's The State of AI in 2026: On the Road to ROI (August 25, 2026) for the datum that 40% of respondents at organizations with annual revenues above $1 billion report scaling AI agents, up from 27% the prior year.
The opinion narrows Power Ventures without saying so
SIIA reads Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), as having already decided the intermediary-access question. There, a user's click on a "Yes, I do!" button — which the court called "akin to allowing a friend to use a computer or to log on to an e-mail account" — gave Power "at least arguable permission," and the court then analyzed authorization "as to Power, not as to Power's user," holding Power liable because Facebook, not the user, had revoked authorization. SIIA maps the facts: a Perplexity user's affirmative act is downloading the Assistant onto their browser, and "[i]n each case the user took an affirmative act that let the company into the account." The only difference the panel identified, SIIA argues, "is the use of AI," and "[i]f the user's permission is dispositive and the platform's revocation beside the point, the opinion has reversed Power Ventures without saying so."
The brief argues that a panel may not narrow a published decision by recharacterizing what it decided, citing Miller v. Gammie, 335 F.3d 889, 900 (9th Cir. 2003) (en banc), Spinelli v. Gaughan, 12 F.3d 853, 855 n.1 (9th Cir. 1993), and United States v. Lindsey, 634 F.3d 541, 550 (9th Cir. 2011), together with United States v. Jingles, 702 F.3d 494, 502–03 (9th Cir. 2012), for the rule that a decision's reasoning binds and not only its holding. Rehearing is warranted under Fed. R. App. P. 40(b)(2)(A) to maintain uniformity and under Rule 40(b)(2)(D) for exceptional importance, citing Hart v. Massanari, 266 F.3d 1155, 1172 n.29 (9th Cir. 2001).
Liability turning on architecture rather than conduct
SIIA's third argument is that the opinion "can be read to make liability under both statutes turn on where the code runs rather than on what the operator did," so that "an operator whose software executes on the user's machine would sit outside both statutes regardless of notice, revocation, or deliberate evasion." It states expressly that it "does not contend that the panel intended that result," but that "what that reading would permit is the measure of what is at stake."
The chronology it draws from the panel's own recitation is that Amazon told Perplexity's chief executive before Comet's release that its AI products could not access the Amazon Store; Perplexity launched without a user-agent string that would have let Amazon identify and block the Assistant; and Amazon then repeated that Perplexity had no authorization. Both statutes, SIIA notes, are framed in terms of conduct — the CFAA preventing "intentional intrusion," the CDAFA reaching "[k]nowingly and without permission" access — and "[n]either looks to where its code ran."
Much of this section is a re-reading of Meta Platforms, Inc. v. BrandTotal Ltd., 605 F. Supp. 3d 1218 (N.D. Cal. 2022), which the panel had distinguished as passive collection. SIIA argues the quoted language "describes only BrandTotal's collection of information Meta had already sent to users, which was not on Meta's servers," and does not describe what BrandTotal did inside password-protected pages. It quotes the district court's statement that a connection to password-protected pages, "even if not used to collect data, could violate the CFAA," and its finding that "[o]nce Meta revoked BrandTotal's continued use of its various programs to actively collect data while panelists were logged into Facebook . . . it violated the CFAA." Because BrandTotal, like Perplexity, ran a browser extension on the user's machine with no server-to-server connection, SIIA concludes that "[t]hat decision drew the line at the authenticated perimeter, not at the network boundary," and that under the reading the panel leaves open, "the same circumvention would be unlawful when carried out by ordinary software and lawful when carried out by an agentic AI tool." It also cites hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1194–1203 (9th Cir. 2022), as analyzing authorization rather than software architecture. SIIA takes the panel's disclaimer of any new agentic-AI regime "at face value" but says it "does not solve the problem, because a published opinion that leaves the governing standard unstated will still be applied."
The section closes with a hypothetical about malicious browser extensions. The panel, SIIA argues, "does not supply a principle separating a user who genuinely consents to the use of an AI tool from one who is deceived or whose machine is compromised," since the same architecture — data collected on the user's machine, sent to the operator's servers, instructions returned — "could describe a malicious browser extension." The panel applied the rule of lenity to the consenting user but "did not address the user who never consented at all." SIIA's example is an AI tool that presents itself as a shopping browser while also using the user's computer to reach another platform's servers without authorization; on the panel's logic the deployer has not accessed those servers, "and the fact that the user was deceived changes nothing." Again SIIA states it "does not suggest the panel intended that outcome. It is a result the opinion leaves available."
The CDAFA treatment
The fourth argument is that the panel disposed of a claim under the broader state statute "in a single paragraph of analysis built on the narrower federal statute," leaving an independent ground for relief undecided. California law reaches corporations, Cal. Penal Code § 7(a)(1), and district courts in the circuit have applied the CDAFA where a corporation controls the instrumentality — Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL, 2025 WL 2210002 (N.D. Cal. Aug. 4, 2025), and In re Apple Inc. Device Performance Litigation, 347 F. Supp. 3d 434, 454 (N.D. Cal. 2018).
SIIA's textual point is that § 502(b)(1) defines access as "to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with" a computer's resources, while the panel "recited only 'caus[ing] input to [or] data processing with,' and omitted 'instruct' and 'communicate with.'" Those omitted verbs, it argues, "describe exactly what the panel says Perplexity's servers do to the Assistant," so that a corporation instructing software to navigate a system "cause[s] [it] to be accessed" under §§ 502(b)(1) and (c)(7) even assuming it never gained entry itself. Section 502(j), which deems one who "causes, by any means, the access of a computer" to have "personally accessed" it, is cited as confirming the point while being addressed to cross-jurisdictional reach. Reading § 502 as coextensive with § 1030 is what the Ninth Circuit "declined to do" in United States v. Christensen, 828 F.3d 763, 789 (9th Cir. 2016).
Provenance
Retrieved from SIIA's own host at siia.net. Corroborated against SIIA's announcement post of August 31, 2026, which links the same PDF; the document's ECF header (Case 26-1444, 08/28/2026, DktEntry 67.2); Metropolitan News-Enterprise coverage of Amazon's en banc petition dated August 20, 2026; and the panel opinion the brief quotes at pages 7–18.
SIIA also appeared as amicus at the merits stage, represented there by Tod Cohen and Annie Nguyen of the same firm (Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) — Opinion).
Relationships
- contradicts: Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) — Opinion
- supports: Amazon v. Perplexity AI
- depends-on: Computer Fraud and Abuse Act (CFAA)
- related: Software & Information Industry Association (SIIA), Perplexity, Amazon, Agentic Commerce Protocol (ACP), Model Context Protocol (MCP), AI Agentic Browsers