Perplexity beat Amazon's CFAA claim on where its code runs. Your scrapers run somewhere else.

An AI agent lost the right to shop on Amazon in March. In August a three-judge panel of the Ninth Circuit gave it back. The reasoning the panel used to do that is the part worth reading if you run collection infrastructure, because it does not say what the headlines say it says. "Court clears AI to shop Amazon" is a fair summary of the outcome and a misleading summary of the rule.

The case is Amazon.com Services, LLC v. Perplexity AI, Inc., No. 3:25-cv-09514-MMC in the Northern District of California, with the appeal docketed as No. 26-1444. Amazon filed in November 2025, after, by its own account, first detecting the activity in August 2025. It alleged that Perplexity's Comet browser drove automated sessions into logged-in Amazon accounts, degraded the shopping experience, and disguised itself as an ordinary Google Chrome session to avoid detection. The statutory hook was the Computer Fraud and Abuse Act and its California counterpart, the Comprehensive Computer Data Access and Fraud Act. On 10 March 2026, Judge Maxine Chesney granted a preliminary injunction barring Comet from Amazon's password-protected pages. The Ninth Circuit heard argument in Seattle on 11 June and, on 4 August 2026, vacated it.

The short version. The panel did not hold that scraping is legal or that agents may access any site. It vacated a preliminary injunction on one narrow point: because Comet runs on the user's own machine and the user directs it, the court held that the user, not Perplexity, "accessed" Amazon's computers under the CFAA. It limited that holding to the CFAA and the state statute and left Amazon's contract theories alive. The reasoning rests on an architecture most collection operations do not use.

What the panel actually held

The CFAA is an anti-hacking statute from 1986. A civil claim under it has to clear a few elements, including intentional access "without authorization" and a loss that has to reach at least $5,000 in a year. Amazon's problem on appeal was not the loss number. It was the word "access."

Amazon argued that Perplexity accessed its servers. The panel disagreed on the mechanics. As the law firm Cooley summarized the opinion, the court found that "Perplexity itself does not directly communicate with Amazon's servers," because the requests route through the user's own machine first. From that, the panel concluded that "it was the user who 'accessed' Amazon's computers, with the help of Perplexity's AI agent." A logged-in person told a tool on their own device to do something the person was allowed to do, and the tool did it. On that reading, the party that accessed Amazon was the account holder, not the company that shipped the browser.

The California statute defines access more broadly, but the panel said it "still focuses on the person accessing or causing access," so the same logic sank that claim too. And the equities did not save the injunction: the court found Amazon's evidence of irreparable harm "comparatively weak and abstract." An injunction against conduct that likely does not violate the statute, the panel reasoned, would not serve the public interest.

None of that is a merits ruling. A preliminary injunction asks who is likely to win, not who wins. The case continues in San Francisco.

Why this is a narrowing, not a green light

Read the holding by its facts and it describes a very specific machine. Comet is a consumer browser. It runs on the user's device. There is a human with an Amazon account issuing an instruction, and the traffic that reaches Amazon leaves from that human's browser. The agent is a delegate acting inside a session the account holder was entitled to open. This is the shape of automation we covered when we noted that agents are winning the logged-in work, not the bulk crawl: a principal, a delegate, and an authorized session.

A production scraping operation is almost the mirror image. There is usually no logged-in account holder behind each request. The traffic does not originate on an end user's laptop; it leaves from a datacenter, a headless browser fleet, or a residential proxy pool, and it hits the origin directly rather than passing through some individual's own browser first. Cooley flagged exactly this gap: the outcome could differ where "AI company's servers communicated directly with the defendant's servers." That sentence is not describing Comet. It is describing the topology of nearly every crawler in production.

So the part of the ruling that helped Perplexity is the part a scraping team cannot borrow. The win came from the request originating on the user's machine under the user's direction. Take away the human principal and the client-side origin, which is what bulk collection does, and you are back inside the fact pattern the panel distinguished, not the one it excused. The safest way to read Amazon v. Perplexity from the collection side is that it says very little about you, and what it does say points the other way.

What survives: terms of service, and the Chrome disguise

The panel was careful to fence its holding. It decided the CFAA and the state computer-crime statute and nothing else. Cooley's read is blunt: sites "may have to turn to other theories of liability, such as enforcing terms of service," and the same conduct "could be the basis for claims sounding in tort or contract." Breach of contract is untouched by this opinion. Amazon's terms of service claim is still live in the district court.

That matters because contract is where the logged-out versus logged-in line does its real work, a distinction we walked through in the context of proxy supplier contracts and the Reddit suit. Fetching a public product page nobody had to log in to see is one fact pattern. Carrying a session that exists because somebody accepted terms is another, and it drags a signed agreement into the dispute. The Perplexity ruling does not collapse that line. If anything it sharpens it, by pushing platforms toward the contract theories that turn on it.

Then there is the detail that gets lost in the "AI wins" framing: Amazon's complaint that Comet presented itself as Google Chrome. Set aside whether that helps or hurts either side legally. Operationally it is the whole game. A site cannot enforce a rule against traffic it cannot identify, and identification now runs on signals well below the user agent string, from the TLS handshake and its JA3 fingerprint to HTTP/2 frame ordering and behavioral cadence. This is the same anti-bot system machinery that decides why scrapers get blocked in the first place. A ruling that an agent's access was lawful does nothing for you if the origin's detection stack refuses the connection before any of that is argued. The court fight and the fingerprint fight are separate fights, and you can win the first while losing the second every night.

What it changes for a collection team this week

Not much in the law, and that is the point. But a few things are worth doing while the case is fresh.

Separate your jobs by who the principal is. Automation that acts inside a session a real, authorized user opened sits in a different legal and contractual position than a fleet crawling logged-out or under credentials nobody consented to lend. That split is worth mapping for evaluating web data providers and for your own pipeline, because it is the first question anyone will ask about a given feed. The Ninth Circuit just made the boundary between the two more consequential, not less.

Do not let a vendor cite this ruling as cover. Expect at least one collection service to wave Amazon v. Perplexity around as proof that agentic access is settled and safe. It is neither. It is a vacated preliminary injunction on a client-side consumer browser, expressly limited to two statutes, in a case that is still running. A vendor that summarizes it as "agents can access any site now" is telling you how carefully it reads the things it sells you.

Keep watching the district court. The contract and tort claims the panel left alone are where the durable rule for automated access is more likely to get written. The CFAA question got the coverage. The terms-of-service question is the one that will actually decide what your crawlers are allowed to touch, and it has not been answered yet.

None of this is legal advice, and none of it depends on how the San Francisco case comes out. The appeal resolved one narrow question in one narrow way. The reasoning that resolved it is built on a machine that looks nothing like the one collecting your data.