When Can Amazon Block an Agentic AI Service?–Amazon v. Perplexity (Guest Blog Post)

by guest blogger Kieran McCarthy

On March 9, 2026, Judge Chesney granted a preliminary injunction in the case of Amazon v. Perplexity, concluding Amazon was likely to succeed on its CFAA and California Penal Code section 502 theories.

If you’re familiar with the CFAA, the outcome of the preliminary injunction opinion was what you might expect.

But it is underwhelming in some new and interesting ways. It is, in my opinion, a shockingly poor effort to grapple with CFAA applicability to agentic AI technology after Van Buren.

If you’re unfamiliar, agentic AI is simply the name for AI that actually does work for you instead of answering questions. An agent can take a loose goal, break it into steps, use tools, gather information, make decisions, and come back with the task done. That makes it useful for the work people hate but still need judgment to finish, such as research, product comparisons, customer support, and multi-step coordination.

One valuable use case for agentic AI is shopping. Not only can Agentic AI tell you what the highest rated toaster on Amazon is for under $100, it can actually buy it for you.

You can tell agentic AI:

Buy a toaster on Amazon for under $100. Prioritize name brands, Amazon Prime shipping, and wide slots for bagels. Do not buy based solely on Amazon rating. Consider only models with at least 1,000 reviews, a rating of 4.7 or higher, and no obvious fake-review pattern. Cross-check at least two independent review sources or testing sites for confirmation that the quality is among the best at this price point. Choose a 2-slice toaster unless a 4-slice model is clearly better.

If one option is clearly superior under these criteria, add it to my cart and proceed to purchase. If not, add the best by these measures and I will review and purchase.

The thing about instructions like these is that they totally kill many of the ways online e-commerce sites make money. Amazon doesn’t just make money from selling you stuff and sending it to you. They also make money from product placement, ads, upselling, and a million other ways of nudging you into buying more stuff.

Amazon wants their search bar to be the way that you buy things online. But if the interface for your shopping becomes the AI labs’ platforms, that’s a big deal for e-commerce sites. It’s an existential threat to some e-commerce platforms and a major margins headwind for giants like Amazon and Walmart.

Those are the stakes.

* * *

The injunction in this case arose from Amazon’s challenge to Perplexity’s Comet browser and shopping agent. Perplexity built a tool that allows software to shop for users on Amazon through their logged-in accounts. Amazon sent a cease-and-desist letter. But Comet didn’t stop.

The court focused on a familiar question for CFAA folks, which is that Amazon allegedly revoked authorization, Perplexity’s agents continued accessing Amazon’s systems through user accounts, and therefore Amazon was likely to succeed under theories derived from CFAA and California computer-access law.

From a pure CFAA perspective, the allegations were straightforward. Monopolist platform discovers a kind of automation that people who use the Internet enjoy, labels it “unauthorized,” cites to Power Ventures, points to investigative costs, and gets its injunction. It has happened before and it will happen again.

But the genuinely novel issue was totally ignored in the opinion. Perplexity’s Comet is an AI agent. And agentic AI is not merely collecting data. It is acting as the user’s delegated representative in an ongoing workflow.

The opinion makes zero effort to analyze:

• whether an AI agent should be treated like a browser,
• whether it should be treated like a human assistant using delegated credentials,
• whether agency-law concepts matter,
• whether user autonomy creates an independent authorization interest distinct from Power Ventures,
• whether there is a meaningful distinction between scraping data and performing user-directed actions.

Instead, the court seems to jump directly to the conclusion that Amazon retains ultimate authority to exclude the intermediary.

(In partial defense of the court, they hint that they may have discussed this at oral arguments. But there’s no analysis of agentic AI in the opinion itself).

From an agentic-AI perspective, it’s straightforward to ask:

If I can personally log into Amazon and buy a toaster, why can’t I save time and have software do it for me?

Because Power Ventures is dumb and Amazon says so, that’s why.

The Power Ventures framing has always allowed platforms to control their platforms, even when the user wants a certain tool to interact with them, if the integration includes a logged-in component. If there is a password at any part of the flow, most courts find that the CFAA can be used to crush any unwanted integration, no matter how benign or socially useful it is. Log-in plus cease-and-desist has almost always been a CFAA violation.

That’s why Power Ventures matters so much. If Power Ventures controls, Amazon gets to frame Comet as just another unwanted logged-in integration. If it doesn’t, the case becomes about whether users can delegate ordinary account activity to software.

That is also what makes this such an interesting test case for Power Ventures. Amazon wants to put Comet in the Power Ventures box, and legally, that is exactly where a plaintiff wants to be. But the factual analogy is imperfect. Power Ventures was not merely helping users operate Facebook. It built a competing service, collected Facebook users’ information, imported that information into its own platform, and used users’ networks to market itself. Comet’s better factual description is simpler, because the user is still shopping. The user just has delegated parts of the shopping flow to software.

If Power Ventures means that a platform can veto any third-party agent, then the CFAA becomes a platform-control statute for the agentic web. Maybe that is where the Ninth Circuit ultimately lands. But if that’s the case, the CFAA is going to be an increasingly unpopular law.

What’s especially disappointing is that courts continue to pretend that there are not difficult policy questions to consider with these new technologies. It is particularly true in this case, because it was a preliminary injunction proceeding, and the court was required to consider the broader public interest question. Perplexity argued that an injunction would disserve the public interest in consumer choice and innovation.

The court’s response was as thin and fragile as overcooked spaghetti. It said that the public has an interest in preventing unauthorized access to computers, and that was that.

The platform says it’s not allowed, therefore it’s not allowed, and it’s in the public’s interest for it not to be allowed.

See how easily we resolved issues with agentic AI?

Reasoning like this makes the CFAA one giant circle of enforcing platform preferences.

To be clear, there’s an argument for Amazon’s position, too. Platforms have real interests in account security, fraud prevention, bot detection, and knowing whether an automated system is moving through logged-in user accounts. But that’s only a small part of the story.

The anti-competitive implications here are super-obvious. Perplexity’s stated theory of the case is that Amazon does not like a user tool that routes around Amazon’s preferred shopping and advertising experience. AI agents “don’t have eyeballs” for the ads Amazon “bombards” users with. Even if you think that line is a bit cute, the underlying point is real. Intermediaries often threaten incumbents precisely because they reduce friction, reorder presentation, or weaken monetization levers the incumbent would rather preserve. Search engines did that. Price-comparison tools do that. Browser extensions do that. API clients and integrations do that. AI agents will absolutely do that in a way that the platforms are not yet prepared to deal with.

Stated plainly, the public interest section just isn’t serious here. A court need not become an antitrust tribunal every time someone says “innovation” or “consumer choice.” But this fact pattern is different from the fact pattern in Power Ventures. A court has a duty to at least think about that.

—

The other interesting part of this case is it’s another test of the definition of technological harm after Van Buren.

Knowing that the Power Ventures question was always going to be a tough climb, Perplexity also asked some of the other tough CFAA questions that Van Buren didn’t bother to answer. The order recognizes that Van Buren at least raises a question about whether “loss” should be limited to technological harms, and it notes the Ninth Circuit’s comment in hiQ about Van Buren requiring such harms. Then it basically shrugs and says, in substance, “this is going to be resolved in Amazon’s favor,” without any explanation or analysis of whether that’s the correct outcome.

To me, the technological harm question would be the easiest way to separate Power Ventures from benign or socially useful integrations. A few courts have agreed, but many do not.

And whether I like it or not, the Section 502 piece of the opinion is even more “chalk” than the CFAA ruling. California cases have long treated response and investigatory expenses as cognizable losses under Section 502. This also dates back to Power Ventures and beyond. So if defendants already face an uphill fight arguing that CFAA investigative costs must be tethered to technological harm notwithstanding Van Buren’s “technological harms” language, that argument is harder still under Section 502, where Van Buren is not controlling and the California text is friendlier to verification costs.

Regardless, it is hard to imagine that Power Ventures will survive agentic AI forever. Sooner or later, courts will be forced to acknowledge that people should be allowed to delegate to software tasks that they are legally allowed to do themselves, especially as software gets better and better at doing those tasks. But for now, Power Ventures stays intact. Until courts grapple with the power with what agentic AI actually does, the CFAA will remain what large platforms want it to be. Not just a law against hacking, but a legal cudgel against unwanted interoperability or user preferences.

The real task is for courts to acknowledge that platforms don’t need unchecked authority to kill all forms of automation on their platforms, but should instead distinguish malicious automation from disclosed, user-directed software that functions as the user’s chosen interface. I think we’ll get there eventually, but this opinion makes me think it’ll be some time before we do.