Amazon Court Order Blocks Perplexity AI Bots — New CFAA Precedent for AI Agents

U.S. District Judge Maxine Chesney of the Northern District of California granted Amazon a preliminary injunction on March 9, 2026, barring Perplexity's Comet browser from accessing password‑protected portions of Amazon customer accounts. The order, reported by Reuters, requires Perplexity to destroy copies of Amazon customer data already collected through Comet and bars the AI agent from accessing Prime subscriber accounts going forward.

The ruling is stayed for 7 days to allow Perplexity to appeal. The Ninth Circuit subsequently granted Perplexity an administrative stay, temporarily pausing the injunction while the appeals court considers a longer pause, according to CyberScoop. The case is Amazon.com Services LLC v. Perplexity AI Inc, No. 3:25‑cv‑09514.

Amazon accused Perplexity of far more than casual scraping. According to Yahoo Finance, Perplexity's Comet browser was covertly logging into password‑protected Prime accounts to browse and make purchases on users' behalf. The agent disguised its automated activity as human browsing — masking Comet's digital fingerprint to impersonate Google Chrome traffic.

When Amazon deployed a technical block in August 2025, Perplexity pushed a software update within 24 hours to bypass it. The judge specifically cited this evasion as evidence of unauthorized access. Amazon had warned Perplexity at least 5 times before filing suit, as CNBC reported.

This is the first judicial test of how the CFAA applies specifically to agentic AI — systems that autonomously make decisions and initiate transactions — acting on a human's behalf. (The CFAA has been applied to automated bots before, notably in Facebook v. Power Ventures, but never to generative AI agents.) The key precedent: platform authorization matters more than user consent. Even when a user explicitly authorizes an AI agent to act for them, the platform's authorization is also required. User consent alone does not constitute "authorized access" under the CFAA.

As IAPP explains, this directly impacts how builders design agentic tools. The era of "the user authorized it, so we're fine" is over. Platforms now have legal backing to control which AI agents access their services.

The CFAA was drafted in 1986 — long before AI agents existed. How it applies to autonomous software acting on a human's behalf has never been tested at trial. The ruling suggests platforms can use CFAA claims to enforce ToS provisions about AI agent identification, though IAPP's analysis argues this may conflict with the Supreme Court's Van Buren ruling (2021), which held that violating computer‑use policies alone is insufficient for CFAA liability.

Perplexity's decision to update its software to bypass Amazon's technical block was cited as evidence of unauthorized access — similar to but distinct from the hiQ v. LinkedIn precedent. The Ninth Circuit appeal will be the next critical test, according to WSJ.

Amazon is simultaneously blocking competitors' AI agents while developing its own — the Rufus shopping assistant. This raises antitrust concerns: platforms may use CFAA claims to block competitors while building their own tools. Amazon has already blocked dozens of AI agents including ChatGPT from its platform.

The stakes are massive. AI shopping agents that skip directly to checkout eliminate all sponsored listings, threatening Amazon's $68.6 billion in 2025 advertising revenue. As WSJ notes, the ruling protects this revenue stream. Other retailers like Walmart are developing their own AI assistants while likely tightening access.

In a twist noted by Yahoo Finance, Amazon founder Jeff Bezos is a personal investor in Perplexity — adding an ironic dimension to the litigation.

The Ninth Circuit appeal is the next battleground. If the appeals court upholds the injunction, it sets a binding precedent across the western United States. If it reverses, the door opens for AI agents with user authorization to access platforms without platform consent. Either way, the case could eventually reach the Supreme Court.

For builders, the practical takeaway is clear: the era of open web access for AI agents is closing fast. ERP Today reports that enterprise architecture teams are already redesigning integration strategies around "API‑first, governed access" models. Builders who invest in formal API partnerships and agent identification now will be ahead of the curve when this precedent expands to other platforms and jurisdictions.

Current law (CFAA, drafted in 1986) was not designed for AI agents. This case highlights the urgent need for updated legislation specifically addressing agentic AI access rights — but until that legislation arrives, the courts are setting the rules one injunction at a time.