When the 9th U.S. Circuit Court of Appeals hears oral argument later today in Amazon.com Services LLC v. Perplexity AI, Inc., it will confront a novel question: how should the Computer Fraud and Abuse Act (CFAA), a statute designed to punish computer break-ins, apply to an AI agent that browses the web on a user’s behalf?
The underlying facts are not especially favorable to Perplexity. In granting a preliminary injunction, Judge Maxine Chesney of the U.S. District Court for the Northern District of California found “strong evidence” that Perplexity violated both the federal CFAA and California’s analogous statute. According to the court, Perplexity continued accessing Amazon’s systems after receiving a cease-and-desist letter and deliberately evaded the technical measures Amazon deployed to block that access. The 9th Circuit stayed the injunction pending appeal.
The doctrinal question is the easy one. Amazon will probably win, and probably should. It is also the less interesting question.
The harder and more consequential issue is whether the CFAA is the right body of law to govern this kind of dispute at all. More broadly, it raises a recurring problem in technology law: whether it is sustainable to keep asking statutes written for the technological realities of the mid- and late-20th century to govern technologies their authors could not have anticipated.
We think the answer to both questions is no. As Greg Dickinson puts it in his masterful article, “Law Proofing the Future”:
Technological breakthroughs provoke wonder, then fear, then legislation. The resulting legal regimes entrench incumbents, suppress experimentation, and displace long-standing legal principles with bespoke but brittle rules. . . . [Meanwhile,] the most powerful tools for governing technological change—the general-purpose tools of the common law—are in fact already on the books, long predating the technologies they are now called upon to govern, and ready also for whatever the future holds in store.
The interests Amazon seeks to protect are real. But they are fundamentally interests in property and contract, and courts developed the core principles governing those interests long before Congress enacted the CFAA. When statutes track those common-law principles, they often work well. When they depart from them—or prevent the sort of incremental adaptation that characterizes the common law—they tend to generate exactly the kind of doctrinal strain the CFAA now exhibits.
The lesson for agentic AI is not that Congress needs to enact a new statute. The legal system already possesses a framework capable of absorbing these new facts. Under current political and institutional conditions, any new legislation is more likely to depart from that framework than to reinforce it.
When a Contract Dispute Wears a CFAA Costume
The factual record is unflattering enough to Perplexity that, under existing doctrine, Amazon has a strong CFAA case. According to the complaint, Perplexity’s Comet browser transmits the same user-agent string as Google Chrome, making its automated activity inside an authenticated Amazon session difficult to distinguish from that of a human shopper. When Amazon deployed a technical block targeting Comet in August 2025, Perplexity allegedly pushed a software update within 24 hours that changed Comet’s fingerprint and restored access. Amazon sent a cease-and-desist letter to Perplexity’s CEO on Oct. 31, 2025. Perplexity declined to comply and instead published a blog post titled “Bullying is not innovation.” Amazon sued four days later.
The doctrinal question is whether an authenticated session—but one conducted contrary to terms of service that prohibit third-party automation and after Amazon revoked access by contractual and technical means—is the kind of environment in which an automated commercial agent acts “without authorization” under the CFAA. After the Supreme Court’s 2021 decision in Van Buren v. United States, authorization is, roughly, a function of whether the accessed system is “gates-up” or “gates-down.” Here, as Judge Chesney put it, Comet accessed Amazon “with the Amazon user’s permission, but without authorization by Amazon.”
The Supreme Court in Van Buren took pains to read the statute narrowly, partly because a broader reading could turn routine terms-of-service violations into federal computer crimes. In particular, after Van Buren, it is hard to argue that a user’s authorized session becomes a federal computer crime simply because the user also does something that violates the terms of service. Amazon’s strongest theory is therefore not the bare terms-of-service violation, which, after Van Buren and the 9th Circuit’s decision in hiQ II, might not be enough on its own.
Instead, Amazon’s case rests on three facts: Amazon deployed a technical countermeasure specifically targeting Comet at the point of access; Perplexity pushed an update within 24 hours to defeat it; and Comet continued to spoof a Chrome user-agent string to evade detection. On that record, Amazon’s claim is not merely that Perplexity breached a contract. It is that Amazon closed a gate, and Perplexity deliberately broke through it. That is much closer to the paradigmatic CFAA case preserved by Van Buren than to the terms-of-service cases the Supreme Court has narrowed.
So Amazon probably wins.
The problem is that Amazon’s path to victory requires the CFAA to do work that exposes its awkward conceptual fit. The “gate” Amazon seeks to protect under the CFAA is one it erected because its underlying contractual prohibition on agentic access was, by itself, inadequate. Detection was costly, circumvention was fast, and ordinary contract remedies were too slow to matter. Pressing the CFAA into service this way is understandable, but it conflates the intrusion claim the statute was designed to police with the property-and-contract claim actually at issue.
That raises the larger question: Why is this dispute being resolved under a federal anti-intrusion statute drafted at the dawn of personal computing, rather than through the bodies of law—property, contract, trespass, and duty of care—that courts normally use to allocate responsibility for such harms? And what should the answer tell us about how the law should govern agentic AI?
The Matthew Broderick Theory of Legislation
The CFAA traces, somewhat embarrassingly, to a Hollywood blockbuster.
WarGames premiered in June 1983. Within days, President Ronald Reagan reportedly raised the film’s hacking scenario with the Joint Chiefs of Staff. Congressional hearings followed within a year, and Congress enacted the statute that became the CFAA in 1986. The threat model was straightforward: an outsider breaking into a discrete government or defense computer system. The statute’s core concepts—“access without authorization,” “exceeds authorized access,” and “protected computer”—were drafted with that scenario in mind.
Yet Congress was not entering a legal vacuum. By 1986, the common law had spent centuries developing doctrines for analogous disputes. Trespass to chattels and conversion addressed unauthorized use of another’s property. Nuisance governed conduct that interfered with the productive use of resources. Principal-agent doctrines distinguished between actions that bound a principal and actions that exceeded an agent’s authority.
Indeed, before the CFAA became the dominant framework, courts often analyzed unauthorized automated access through the common-law doctrine of trespass to chattels. Cases such as CompuServe v. Cyber Promotions (1997) and eBay v. Bidder’s Edge (2000) reached results that look remarkably similar to what Amazon seeks here. The difference is that they did so through doctrines grounded in property and contract. The common law already had tools for addressing these disputes. In important respects, the CFAA displaced those tools rather than allowing them to continue evolving.
The result is a textbook case of technological panic producing bad legislation. As Kevin Frazier recently observed (discussing Dickinson’s “Law Proofing the Future”):
Enacted in 1986 to address hacking of government systems, the CFAA soon expanded into a sweeping prohibition on ‘unauthorized access’ to any computer connected to the internet—which, in practice, meant nearly everything. . . . What began as a targeted fix for a Cold War fear became a vague, overbroad, and ill-fitting statute that chilled ordinary activity. It is precisely the kind of misfire we should expect when lawmakers legislate in haste against technologies they barely understand.
The dispute in Amazon v. Perplexity bears little resemblance to the intrusion Congress had in mind in 1986. No one is breaking into a military computer or bypassing a security perimeter to obtain forbidden information. Instead, a commercial software agent is acting on behalf of a paying customer and carrying out transactions the customer is entitled to perform on a platform that invites the customer’s business.
Amazon’s interests are real. It has legitimate concerns about advertising-impression integrity, fraud detection, authenticated-session security, and the economics of its affiliate program. But those are not the interests the CFAA was designed to protect. They are interests that fit far more naturally within contract, property, and tort law.
You Can’t Give Away Rights You Don’t Have
Absent the CFAA mismatch, the Amazon-Perplexity dispute seems relatively straightforward.
Amazon owns the servers. Authenticated customer accounts run on those servers. The merchant, affiliate, and advertising relationships layered on top of the platform are contractual. The right to determine the terms of access—including whether and on what terms automated agents may operate within authenticated sessions—is part of the bundle of rights Amazon possesses and may choose to allocate.
None of that requires the CFAA. Trespass to chattels, breach of contract, tortious interference with business relationships, and unfair-competition law all potentially reach the conduct Amazon challenges. Amazon’s reliance on the CFAA instead reflects the statute’s procedural and strategic advantages—federal jurisdiction, a criminal-law backstop, and enhanced remedies—not the nature of the underlying interests at stake.
The strongest defense of agentic access rests on user consent. Perplexity’s argument, at bottom, is that its AI agent is simply doing what the end user has authorized it to do. If a user may browse Amazon, why can’t the user’s software agent browse Amazon on the user’s behalf?
The common law has long had an answer. A guest’s permission to enter property does not automatically entitle the guest to bring along commercial agents whom the property owner has not authorized. Justice Clarence Thomas captured the principle succinctly in his dissent in Van Buren:
As the Second Restatement of Torts explains, “[a] conditional or restricted consent to enter land creates a privilege to do so only in so far as the condition or restriction is complied with.” . . .
. . . What is true for land is also true in the computer context; if a company grants permission to an employee to use a computer for a specific purpose, the employee has no authority to use it for other purposes.
Use beyond the scope of consent renders the visitor a trespasser.
The same logic appears in the common law of agency. An agent cannot possess greater authority than its principal. The principle traces to the ancient maxim nemo dat quod non habet: one cannot give what one does not have. Amazon’s contractual prohibition on third-party agentic access is therefore the relevant constraint. A user’s decision to employ Perplexity’s agent cannot expand the underlying property and contractual rights the user received from Amazon in the first place.
The 9th Circuit has already confronted—and rejected—essentially the same user-consent argument. In Facebook v. Power Ventures, the court held that a third-party aggregator’s continued access to Facebook on behalf of users who voluntarily supplied their login credentials was nevertheless “without authorization” under the CFAA once Facebook issued a cease-and-desist letter and the aggregator circumvented Facebook’s technical restrictions:
Similarly, for Power to continue its campaign using Facebook’s computers, it needed authorization both from individual Facebook users (who controlled their data and personal pages) and from Facebook (which stored this data on its physical servers). Permission from the users alone was not sufficient to constitute authorization after Facebook issued the cease and desist letter.
Once platform-level permission has been revoked, the court explained, neither technological workarounds nor user authorization can restore it. The implication here is straightforward: authorization from the user is not a substitute for authorization from the platform. A third party that acquires a user’s credentials acquires no greater rights against the platform than the user possesses.
It’s Not ‘Bullying’ to Protect One’s Property
Perplexity’s public response illustrates a broader problem with how parts of the AI industry frame these disputes. After receiving Amazon’s cease-and-desist letter, Perplexity published its “Bullying is not innovation” blog post. The substance of the argument is that legal constraints on Perplexity’s preferred mode of operation are themselves illegitimate—that requiring an AI agent to identify itself, comply with contractual restrictions, or respect technical barriers constitutes “bullying.”
That framing gets things backward. Describing the enforcement of property and contract rights as bullying is rhetorical sleight of hand. It asks the legal system to weaken the very institutions that make commercial cooperation and innovation possible. If anything, the stronger claim runs in the opposite direction: demanding unauthorized access to someone else’s property is not “innovation.”
The concept of “permissionless innovation,” when applied accurately, denotes autonomy from government mandates, not an exemption from private contractual obligations. There is no contradiction in arguing that AI agents should operate without regulatory pre-approval while maintaining that they must obtain consent from the platforms they engage with. Far from being a substitute, a robust system of private ordering serves as the essential foundation for innovation that is truly permissionless.
Indeed, complying with basic conditions of access should be table stakes. Among other things, agentic browsers introduce attack surfaces that did not previously exist, including indirect prompt injection and session-hijacking risks of the sort that have come to be called “CometJacking”—literally named after Perplexity’s browser. Platforms have a legitimate interest in knowing which sessions are being driven by software agents, what those agents are doing, and how to respond when something goes wrong. None of this is rendered moot because it is new technology doing the accessing.
The Supreme Court’s decision in American Broadcasting Cos. v. Aereo offers a useful analogy. Aereo built a technically ingenious system consisting of thousands of tiny antennas, each assigned to an individual user. The architecture was designed to allow Aereo to retransmit broadcast television without paying the licensing fees that a conventional retransmitter would have owed to the broadcaster.
The company’s argument was essentially that its novel technical design changed the legal character of the underlying conduct. The Supreme Court disagreed.
The broader lesson of Aereo should apply here. A defendant cannot avoid legal obligations merely by inserting a clever technical architecture between itself and the conduct at issue. Agentic AI is, in this sense, the new Aereo: a novel technical layer placed on top of conduct that would otherwise require the platform’s consent. The novelty of the architecture should not alter the legal analysis.
The Statute Trap
The CFAA is not unique in routing around the common law. Modern technology law has repeatedly taken problems the common law could have absorbed and recast them into statutes tailored to the anxieties, assumptions, and political pressures of a particular technological moment. The results vary. Some statutes ossify into broad immunity. Others stretch far beyond their original purpose. A few work tolerably well because they preserve enough flexibility for courts to adapt them over time.
Agentic AI is now provoking the same legislative instinct. But before Congress reaches for the drafting pen, it is worth examining how similar efforts have fared.
Section 230: The Immunity Machine
The CFAA’s drift away from the common law has a structural counterpart in another statute whose pathologies have come to dominate digital-policy debates: Section 230 of the Communications Decency Act.
The common law of intermediary liability had already developed coherent answers to many of the problems Section 230 purported to solve. Courts had long grappled with analogous questions through doctrines governing innkeeper liability, premises liability, dram-shop liability, and the duty-to-control doctrine. Across these doctrines, a common principle emerged: liability generally turns on whether the intermediary is the least-cost avoider of the harm, whether the harm was foreseeable, and whether reasonable steps could have mitigated it.
These are not abstract concepts. They are centuries-old institutions for allocating responsibility among parties whose conduct predictably affects one another. As we have noted elsewhere:
While it was once in fashion to proclaim the Internet a wholly unique invention to which traditional laws could not readily be applied, a more sober analysis of the history of the common law demonstrates that new business models and new technologies are regularly and inevitably incorporated into the law.
Section 230 was enacted in 1996 to address the narrow doctrinal problem created by Cubby v. CompuServe and Stratton Oakmont v. Prodigy. Over time, however, it hardened into a near-categorical immunity that bears little resemblance to the common-law duty-of-care framework it displaced. Online intermediaries today enjoy a liability shield that no comparable offline business has ever possessed.
Section 230’s failure lies in ossifying into an immunity that excludes conduct it arguably should reach. The CFAA’s failure lies in stretching to reach conduct it was never designed to govern. But the underlying mechanism is the same: A statute drafted for a particular technological moment imposes categories tailored to that moment, while the common-law principles it displaced lose the opportunity to evolve alongside the technology.
The Sherman Act: Blessedly Vague
Not every statute touching a fast-moving industry produces this kind of strain. The clearest counterexample is the Sherman Antitrust Act, which, as one of us has argued recently, “is best viewed as a modest statutory extension of the common law.”
Read literally, the Sherman Act is almost comically terse. But its brevity proved to be a virtue. Its vague language and standards-based structure lent themselves to a common law-like process of judicial interpretation. Over time, courts developed the rule of reason, the per se / rule-of-reason distinction, and eventually the consumer-welfare standard.
The result is a 136-year-old statute that has survived repeated technological revolutions—from railroads and broadcasting to software platforms and digital markets—because courts have continually adapted its principles to new facts.
It did not have to turn out that way, and the contrast with more prescriptive competition statutes is instructive. The Robinson-Patman Act in the United States and the European Union’s Digital Markets Act (DMA) both reflect a more top-down approach. The DMA, for example, “applies per se rules to broad swathes of conduct in so-called digital markets,” with “no scope for effects analysis or procompetitive justifications.”
That is the opposite of the common-law method. It assumes legislators can identify in advance, across industries and technological contexts, which practices will prove anticompetitive. The resulting error costs are predictable and often substantial.
And the political-economy costs may be worse. Antitrust, like any body of law governing significant commercial interests, attracts rent-seeking by firms hoping to hobble competitors through regulation rather than competition.
The CFAA, even after Van Buren, sits closer to the DMA end of the spectrum than to the Sherman Act end. Its framework relies on categorical concepts rather than standards-based balancing. If agentic AI ultimately requires a statute at all, the better model would look less like the CFAA and more like the Sherman Act: principles-based, flexible, and designed to leave courts room to adapt the law incrementally.
The political-economy point matters here as well. When Congress enacted the Sherman Act, organized interest groups had only limited ability to shape its implementation. The same cannot be said of agentic AI. The interested constituencies are already organized, already lobbying, and already shaping the proposals now circulating in Washington.
The impulse to “just write a new statute” risks producing something closer to the DMA’s rigid framework than the Sherman Act’s relative durability.
The Digital Millennium Copyright Act: A Useful Warning
The Digital Millennium Copyright Act (DMCA) is perhaps the most instructive example because it occupies the middle ground.
Congress enacted the DMCA in 1998 to solve a problem that neither the common law nor private contracting could easily solve on their own: governing access to copyrighted works at internet scale.
The transaction-cost problem is straightforward. Copyright is a property right ordinarily enforced through contracts. Rightsholders license works, users pay for access, and contracts define the terms. But where transactions become highly dispersed, low-value, and extraordinarily numerous, bilateral contracting becomes prohibitively expensive.
Historically, markets responded by creating collective institutions. Performance-rights organizations such as ASCAP and BMI emerged to facilitate music licensing where individual negotiations would have been impractical. The DMCA represented Congress’s attempt to create a comparable framework by statute before market institutions had developed at sufficient scale.
Viewed charitably, that logic maps closely onto the agentic-AI access problem. Amazon and Perplexity can, in theory, contract with one another. But bilateral negotiations between every platform and every developer of every agentic system are unlikely to scale. A statutory framework featuring identified agents, safe harbors, opt-outs, and knowledge-conditioned liability could, in principle, reduce those transaction costs.
The problem is that the DMCA also illustrates how quickly statutory compromises can drift away from their original design.
The provisions intended to protect rightsholders have gradually been narrowed through judicial interpretation (so judicial interpretation is not a panacea, either). Section 512’s notice-and-takedown framework was intended to provide a workable enforcement mechanism when contracting was impractical. Yet courts have often interpreted the statute to impose far less responsibility on intermediaries than Congress appears to have envisioned.
Safe harbors intended as conditional protections for intermediaries that take meaningful steps against repeated infringement have, through cases such as Viacom v. YouTube and UMG v. Veoh, evolved into something approaching categorical immunity. Knowledge standards have narrowed. Repeat-infringer requirements have weakened. Decisions such as the 9th Circuit’s Lenz v. Universal have further limited enforcement by reading a fair-use precondition into the statute, despite the traditional rule that fair use operates as an affirmative defense.
The result is a perpetual game of whack-a-mole. Rightsholders issue automated takedown notices against content that often reappears almost immediately. Meanwhile, the intermediaries whose conduct the statute was meant to regulate enjoy a liability regime increasingly disconnected from the common-law principles of intermediary responsibility that inspired it.
The DMCA therefore serves both as a model and as a warning. Some aspects of its design closely track common-law principles. Notice-and-takedown resembles traditional abatement doctrines. The Section 512 safe harbors can be understood as a form of least-cost-avoider analysis.
Its failures emerged when courts transformed those conditional protections into something resembling the broad immunity that Section 230 became. The underlying property interests became underprotected, and the duty-of-care framework gradually hollowed out.
The implication for agentic AI is straightforward. Any statutory attempt to address the transaction-cost problem should preserve the conditional protections that make the framework work. Otherwise, the same interpretive forces that transformed Section 230 and weakened the DMCA may produce yet another technology statute whose practical operation bears little resemblance to its original design.
The Market Is Already Solving the Problem
Meanwhile, a statute is necessary at all in this context only where private ordering is too costly. The most encouraging feature of the current moment, however, is that the market is not waiting for the litigation to end.
Identified-agent regimes, negotiated-access arrangements, and commercial licensing agreements are emerging in real time. Amazon’s first-party agent, Buy for Me, identifies itself through a transparent user-agent token and honors opt-outs communicated through robots.txt and direct merchant requests. Reddit’s litigation against Perplexity has proceeded alongside Reddit’s own program of paid licensing agreements with major AI developers. Large publishers are negotiating direct deals with frontier-model companies. And robots.txt itself—the nearly 30-year-old industry standard through which web crawlers honor exclusion requests—demonstrates that workable private-ordering arrangements can emerge without statutory intervention.
Whether the resulting equilibrium is optimal in every detail is a question better answered by the parties negotiating it than by legislators or courts. Disputes between platforms and developers of agentic systems involve exactly the kinds of interests that contract law routinely governs: server capacity, monetization, security, brand integrity, and obligations to merchants and advertisers.
When private parties possess both the incentive and the technical capacity to negotiate access terms, the default presumption should be that they will do so. The legal system’s role is to enforce the resulting agreements, not to specify their contents in advance.
None of this implies support for forced interoperability, mandatory disclosure, compulsory licensing, or treating platform “openness” as a regulatory objective. The absence of interoperability is rarely evidence of market failure. Forced interoperability often carries significant costs to security, product design, and firms’ ability to differentiate themselves—costs that its advocates routinely understate.
Nor does the argument imply that Amazon must admit any agent that identifies itself. Quite the opposite. Treating this as a property-and-contract problem means preserving the platform’s right to say no.
There is, however, a risk running in the opposite direction. The emerging private-ordering equilibrium is itself vulnerable to capture if Congress intervenes. Whatever statute Congress writes for agentic-AI access, incumbent AI developers and incumbent platforms will both seek to shape it to protect their existing positions.
The DMCA’s Section 512 notice-and-takedown regime, whatever its virtues, plainly reflects the interests and bargaining power of the incumbents of 1998. An AI-access statute enacted in 2026 would similarly reflect the interests and bargaining power of the incumbents of 2026, with predictably distortive consequences.
The default position, unless and until Congress can devise a framework that supports rather than supplants common-law principles, should be to let parties negotiate, let markets adapt, and let courts resolve disputes using the property, contract, and tort doctrines we already possess.
‘The Only Winning Move Is Not to Play’
For the 9th Circuit, the appropriate posture is restraint. If the panel concludes that Amazon has the stronger CFAA claim under existing doctrine—as it should—it ought to write narrowly. Any holding should turn on persistent circumvention of a deployed technical access control, not on a generalized theory of agentic access. Van Buren counsels exactly that approach. The court should resist the temptation to transform the CFAA into a general framework for governing AI agents’ interactions with commercial websites.
The longer-run framework lies elsewhere: in property, contract, and trespass.
For platforms and AI developers, the most productive path forward—private ordering—is, as noted, already emerging. Litigation will continue, and some of it will be necessary. But the equilibrium in this market will be shaped less by judicial opinions than by the agreements parties strike. The law’s modest contribution is to make property, contract, and trespass remedies predictable enough that those agreements become easier to negotiate.
For Congress, the lesson is one of humility and timing. The CFAA and Section 230 are cautionary tales. The DMCA, the closest analog to a common-law-supportive statutory framework, has generated enough difficulties of its own to warrant skepticism. The Sherman Act is the rare success story, but its success depended in part on the political conditions of 1890—conditions that plainly do not exist in 2026.
The default should be restraint.
Amazon v. Perplexity is useful not because it presents a particularly difficult dispute, but because it exposes a recurring institutional temptation. Amazon’s interests are legitimate. Perplexity’s conduct, on the current record, is difficult to defend. The doctrinal stretch required to reach the right result under the CFAA is small enough that the court will likely make it.
But that does not mean the statute is the right tool for the job.
The broader lesson is that not every technological development requires a new legal framework, and not every legal problem requires a new statute. The common law has spent centuries adapting old principles to new facts. Agentic AI is new. The underlying questions of property, consent, agency, and trespass are not.
Let platforms exclude. Let agents identify themselves. Let parties negotiate. Let courts enforce the bargains they reach.
The law has seen this movie before.
The post WarGames, Shopping Bots, and the Statute Trap: The CFAA and Amazon v Perplexity appeared first on Truth on the Market.
Nicole Byers is an entertainment enthusiast! Nicole is an entertainment journalist for the Maple Grove Report.
