TL;DR

On August 4, 2026, the Ninth Circuit vacated the preliminary injunction that had kept Perplexity’s Comet shopping agent off Amazon.com, holding that the customer, and not Perplexity, “accessed” Amazon’s computers. On September 10, the full court declined to rehear the case. On September 21, Amazon filed a First Amended Complaint alleging that Comet for iOS ran in Perplexity’s own cloud on customers’ copied login cookies, that Perplexity told the Ninth Circuit the opposite while it was happening, and that Perplexity is liable for tortious interference with Amazon’s customer contracts.

My read: Amazon has now pleaded the facts the panel said it was not deciding. But what matters in this case is not really the configuration of the shopping bots — underneath the statutes, this is a fight over who owns the shopping session and the customer data it produces, and the advertising dollars.

Who Was Shopping?

On September 15, 2026, an Amazon tester opened Perplexity’s Comet browser and typed “shop for AA batteries.” The agent described battery types and linked to other websites. The tester typed “order for me.” The tester never mentioned Amazon and did not have Amazon open. The agent opened Amazon in a new tab, used the account’s saved login, and found the batteries. Told to “complete the order,” it clicked “Buy Now” and went to checkout, where the account’s delivery address appeared. First Am. Compl. ¶ 36 (“FAC”).

Six weeks earlier, the Ninth Circuit had held that when Comet shops on Amazon, the shopper is the one accessing Amazon, and Perplexity just makes the tool. That holding rested on a picture of a user who picks the store, logs in, and tells the tool what to do. That framework assumes the human shopper makes the decisions. Amazon’s Amended Complaint throws that assumption into question.

I originally wrote this article shortly after the appellate decision and never published it. At the time, I thought the customer’s control was the most persuasive part of Perplexity’s argument. Now I am seeing more of the other side.

The Ninth Circuit’s Decision Was Narrow

In Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), the panel found Amazon unlikely to establish statutory access by Perplexity under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and California Penal Code § 502. It vacated preliminary relief and remanded. On September 10, the court denied rehearing en banc.

Three points matter:

• The user accessed Amazon on the facts presented. The court distinguished the user’s browser contacting Amazon from Perplexity receiving screenshots and supplying instructions. Slip op. at 15; see Van Buren v. United States, 593 U.S. 374, 388 (2021).

• Different control arrangements remained open. The panel reserved whether other facts could establish access by Perplexity. Id.

• Other liability theories remained open. The court did not decide tort liability and recognized Amazon’s ability to regulate users through contractual terms. Id. at 17, 21 n.5.

Lenity reinforced the court’s statutory reading. See LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1134–35 (9th Cir. 2009). The court also found Amazon’s evidence of threatened harm weak. This was neither a dismissal nor a universal immunity rule for user-directed agents.

Amazon's Amended Complaint Adds a Different Architecture

Amazon filed its First Amended Complaint on September 21, 2026 (ECF No. 122). It keeps the CFAA and § 502 counts and adds tortious interference with contract. Everything below is Amazon’s allegation; none of it has been proven.

• Comet for iOS ran in Perplexity’s cloud. Perplexity launched Comet for iOS on March 18, 2026, nine days after the district court’s injunction. In agent mode, it copied the user’s Amazon login cookie to Perplexity’s cloud servers, which ran a virtual browser and requested pages directly from Amazon. “No user device touches Amazon’s servers.” The app itself told users the request “will be handled by a virtual cloud browser.” FAC ¶¶ 6, 66.

• That’s not what Perplexity told the Ninth Circuit. Its April 1 opening brief called it “undisputed” that “no Perplexity computer ever has direct access to an Amazon” computer. Amazon’s counsel flagged the conflict by letter on May 6; Perplexity filed its reply that day without correcting it. On May 11, Perplexity’s counsel wrote that it had “temporarily disabled the assistant feature on Amazon.com in Comet for iOS.” Amazon alleges Perplexity never told the Ninth Circuit. FAC ¶¶ 67–68. The panel’s opinion addresses only the desktop product.

• Even on desktop, Amazon says Perplexity makes every call. Perplexity’s servers pick each click and each URL, can halt the agent mid-task, and can change its behavior between software releases; the agent stops working if it loses its connection to Perplexity. FAC ¶¶ 37–38, 41. The battery test, and a second test where a Barnes & Noble purchase ended in an Amazon cart, are Amazon’s evidence that Perplexity chooses where the agent goes. FAC ¶ 36.

• Perplexity is working hard to fly under the radar. Every request carries Google Chrome’s user-agent string. Users cannot change it, and Perplexity changed the agent’s identifying traits each time Amazon learned to spot it, beating Amazon’s blocks within 24 hours in August 2025 and within two days in December 2025. FAC ¶¶ 45, 57, 64–65.

• Perplexity keeps what it sees. Perplexity admitted it may store screenshots and page snapshots of password-protected pages on its servers for up to 30 days. In one test, a single session sent Perplexity a customer’s full Amazon browsing-history page, including name and postal code. FAC ¶ 42. Amazon’s requested relief includes another preliminary injunction. FAC ¶ 122. A renewed motion would not surprise me. Its prospects would depend on the evidence and the conduct Amazon seeks to stop.

Infographic courtesy of Claude

There is Always a Person

The panel explained that software is not itself a person for purposes of the statute. I agree. But there is always a person behind an agent. A person set it up, granted permissions, and supplied the means to pay. People built the systems that carry out its instructions. AI in front of them does not make the people behind the curtain disappear.

I can hear the objection from the back of the room: what about an agent that spins up another agent and buys things with no human involved? In the words of the immortal Dwight Schrute, “False.” A human set up the first agent. AI agents are not collecting tchotchkes and electric lawnmowers for their own enjoyment.

That principle tells us who to look at. It doesn’t tell us who is liable. Tracing an action back to someone does not tell us whether that person violated a statute, breached a contract, or caused a legally compensable injury.

Here, both the shopper and Perplexity may exercise meaningful control. The shopper sets the goal and authorizes the purchase. The agent provider determines how its software performs the task. Those forms of control can coexist, and that can further muddy the water in terms of liability.

Agency law offers useful concepts, including assent, authority, and control. But calling software an “agent” does not automatically create an agency relationship. We can look forward to future lawsuits in which liability, control, and authority between AI and humans are at issue. We’ll need to identify the amount of legal control exercised by each, and what legal rules govern their conduct and relationship.

Amazon's Next Route

Lack of contractual privity with Perplexity does not prevent Amazon from bringing statutory or tort claims. Privity matters to identifying contractual obligations, but many causes of action don’t require it. The new interference claim illustrates the point. Amazon alleges that Perplexity intentionally induces breaches of contracts between Amazon and its customers. FAC ¶¶ 110–117.

Under California law, intentional interference with contractual relations requires a valid contract, the defendant’s knowledge, intentional acts designed to induce breach or disruption, actual breach or disruption, and resulting damage. CACI No. 2201; Pacific Gas & Elec. Co. v. Bear Stearns & Co., 50 Cal. 3d 1118, 1126 (1990). Amazon doesn’t need a contract with Perplexity, and the theory doesn’t take the customer off the hook. It depends on customer breaches.

There is a hedge. Under Ixchel Pharma, LLC v. Biogen, Inc., 9 Cal. 5th 1130 (2020), interference with an at-will contract requires an independently wrongful act. Whether Amazon’s particular customer obligations fall within that category remains an open question. Being able to stop shopping is not necessarily the same as having an at-will contract for every relevant obligation.

Amazon pleads independent wrongfulness “insofar as” required. FAC ¶ 112. If it must rely on its computer-access theories to satisfy that requirement, the architecture dispute becomes important to the interference claim too.

Follow the Money

“Follow the money.” It doesn’t replace legal elements, but it helps explain incentives. And the incentives here expose what is really going on at the heart of this matter. The goods sold and were paid for. So why does Amazon care who clicked “Buy Now”? This is where the fight stops looking like a proxy war and starts to make sense.

The commercial question—what this really comes down to, in my opinion—is who gets to observe the shopping session, shape it, and profit from it.

• The data. Buyer profiles are not an abstract concern. Store loyalty cards were one way to track and profile customer buying habits. When I was expecting, diaper coupons started arriving about two weeks before my baby was born. That was no coincidence. It doesn’t prove what happened in this case, but it illustrates why the information generated by shopping behavior is valuable. Perplexity’s CEO has said Comet would track what users do online to sell “hyper personalized” ads.

• The steering. I have also seen different prices at Amazon, depending on who was logged in. That is my own observation, not proof of a general Amazon pricing practice or the reason for any particular difference. Still, it makes me interested in what an agent sees, what it recommends, and whether its choices serve the shopper’s interests. And perhaps also why Amazon is so intent on keeping bots off its site. Bots don’t respond especially well to advertising.

• The advertising. Amazon alleges costs associated with distinguishing automated traffic from billable human impressions, and lost advertising revenue. FAC ¶¶ 84, 118. Advertisers haven’t figured out how to sell to the bots yet, and if their marketing is aimed at you but you are not the one doing the buying, their system breaks down.

Amazon is serious about this. On September 21, Amazon blocked Meta’s Muse shopping agent, showing users a notice asserting that continued access by an unauthorized agent violated its Conditions of Use. Of course Amazon has legitimate and understandable security and customer-experience concerns. Customers also have a legitimate interest in choosing their own shopping tools. My admittedly jaded opinion is that control of the customer relationship, including its data and advertising value, explains why the dispute is so consequential.

What This Means for Lawyers — Practice Suggestions

For Clients That Run Websites (and for your firm)

1. Write agent terms that identify the obligations and the enforcement trigger. Clear terms help establish what customers may authorize, how agents must identify themselves, and when permission ends.

Automated Agents. You may not use, allow, or enable a software agent to access [Platform] on your behalf unless the agent identifies itself in each request as an automated agent and complies with our access limits. If we notify you or the agent’s provider that the agent may not access [Platform], you must stop using that agent to access [Platform]. You may not use an agent to circumvent technical restrictions on access. [Company] may seek injunctive relief where legally available.

Notice may help establish the provider’s knowledge. It does not automatically establish an enforceable contract, a breach, or an interference claim. Those questions require attention to assent, the obligations actually imposed, and the conduct at issue.

I would not rely on an irreparable-harm recital to carry an injunction request. The client needs evidence of likely harm and must satisfy the remaining equitable requirements. Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7, 20 (2008).

2. Choose the enforcement ladder before it’s needed. Warning, throttling, agent-level blocking, account suspension, termination. Decide which measure fits which conduct, who authorizes it, and how to avoid blocking legitimate customer activity. Help your client decide in advance whether they would ever sue a customer.

3. Preserve traffic logs and response-cost records. Logs help establish what happened, which systems made requests, and whether activity continued after notice. Records of investigation, remediation, and restoration help establish the financial consequences.

The CFAA’s qualifying-loss requirements need their own analysis. Logs alone do not establish the $5,000 threshold, and not every business expense or lost advertising opportunity necessarily qualifies. 18 U.S.C. § 1030(e)(11), (g). Once litigation is reasonably anticipated, preserve relevant evidence promptly with litigation holds. Short retention periods can make a technically strong claim difficult to prove.

4. Evaluate alternative theories early. A claim can fail on a single element. Consider statutory, contractual, and tort theories at the outset, including their distinct evidence requirements and defenses. Pleading in the alternative should reflect supportable facts.

For Clients That Build, Buy, or Defend Agents

5. Map the architecture on every platform. Determine:

◦ Where does the browser run?

◦ Which system sends each request to the third-party website?

◦ Where are credentials, cookies, and session tokens stored?

◦ What information leaves the device, and where does it go?

◦ Who can change the agent’s behavior or stop it mid-session?

Then use the answers to write contract terms that describe the actual product. For example:

Vendor represents that [Agent] operates as described in the attached Architecture Schedule, including the location of browser execution, the systems making third-party requests, and the handling of credentials, cookies, and session tokens. Vendor will give Customer at least [30] days’ written notice before materially changing those practices on any platform, subject to agreed procedures for urgent security changes.

The schedule should also address retention, access controls, third-party processing, and responsibility for complying with website restrictions. A useful warranty describes something the parties can verify.

6. Make certain the briefs, the logs, and the marketing align. Start by looking at the marketing. Marketing aims to persuade, sometimes at the expense of accuracy. But accuracy matters, because the company could be held to what the advertising says. Will the description hold up against the actual architecture in court? Before filing, I would confirm the description covers the relevant products, versions, and periods. Technical descriptions need continuing verification. And be careful with “Undisputed” and “never” are dangerous words when a client pushes updates every week.

What Happens Next

The Amended Complaint is a reset. The dispute continues in the Northern District of California, No. 3:25-cv-09514-MMC. The next questions include whether Amazon can prove its architecture allegations and whether its interference theory survives the applicable defenses.

A challenge based on Ixchel would not surprise me. Neither would another request for preliminary injunctive relief supported by these new allegations, if they can stand up to scrutiny.

With rehearing denied September 10, Amazon has until December 9, 2026, to seek Supreme Court review, absent an extension. Sup. Ct. R. 13.3. I doubt it will; its stronger case is now in the district court. My guess is that Amazon will concentrate on developing that case on these much more persuasive allegations.

But what we’re seeing here, the real lesson, the heart of the matter, is that consumer data—your data—is valuable. The struggle to control the shopping relationship and benefit from the advertising dollars and shopping data is really what this case boils down to.

© 2026 Amy Swaner. All Rights Reserved.  May use with attribution and link to article.