Agentic AI Meets CFAA and CDAFA: Ninth Circuit Issues Ruling Involving Agent Liability

The U.S. Court of Appeals for the Ninth Circuit recently issued a novel ruling that an agentic AI tool did not trigger liability under the Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA)—statutes that often appear as companion claims in privacy cases involving unauthorized access to computers, devices, or data.

On August 4, 2026, in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, the Ninth Circuit vacated the trial court’s award of a preliminary injunction to Amazon, holding that Amazon was unlikely to succeed on the merits of its CFAA and CDAFA claims because it could not show Perplexity’s agentic AI tool “accessed” Amazon computers, a requirement of both statutes.

While the Court expressly limited its narrow ruling, this first-of-its-kind decision offers a glimpse into how courts may approach agentic AI issues in similar contexts, and raises broader questions about when agentic AI may trigger liability for statutory or other privacy-related violations.

Background

This case involved Perplexity’s AI-enabled web browser, Comet, which it developed and publicly released. Comet runs locally on a user’s machine and includes an AI agent (which the Court refers to in its opinion as “the Assistant”) that performs tasks at the user’s direction, including online shopping.[1]

Amazon allegedly told Perplexity, prior to Comet’s release, that its AI products would not be allowed to access the Amazon.com store.[2] After Perplexity released Comet, Amazon detected that the Assistant was shopping its store on behalf of Comet users, and Amazon again informed Perplexity that the Assistant was not authorized to use the store or make purchases for its customers.[3]

Amazon then filed suit against Perplexity for violations of the CFAA and the CDAFA and moved for a preliminary injunction to prohibit the use of Perplexity’s agentic web browser AI tool on Amazon’s website.[4] Amazon claimed that Perplexity violated the CFAA, a federal anti-hacking statute, and its California state-law analogue, the CDAFA.[5] Both are criminal statutes that provide a private right of action for civil claims. The CFAA prohibits intentionally accessing and obtaining information from computers without authorization, and makes relief available to plaintiffs who have suffered damage or loss of at least $5,000 per year as a result of a violation.[6] The CDAFA similarly prohibits knowingly accessing without permission any computer system or network, but it does not impose a minimum loss threshold.[7]

Amazon claimed that by way of the Assistant, Perplexity’s servers had accessed Amazon’s servers without Amazon’s authorization.[8] Perplexity countered that its own computers never gained “access” to any Amazon computer or server, because when the user deploys the Assistant, any Amazon data is first transmitted to the user’s computer—and any “intent” would belong to the user, not Perplexity, as the Assistant is computer software.[9]

The Court Rejects Amazon’s Argument

The Court ruled in favor of Perplexity, vacating the preliminary injunction and concluding that Amazon was unlikely to succeed on the merits because it failed to show that Perplexity “accessed” Amazon’s servers as required under the CFAA and the CDAFA.[10] The Court determined that the evidence did not support Amazon’s argument that Perplexity itself directly communicated with Amazon’s servers, as it is the user who controls the Assistant to carry out shopping tasks on Amazon.com.[11] It further explained that the plain language of the CFAA does not allow for “access” by the Assistant, as “access” only applies to a person—and “[h]owever advanced the Assistant currently is, it is a tool, not a person for statutory purposes.”[12]

The Court reiterated that agentic AI is an emerging technology, and that this decision does not “establish a new legal regime governing agentic AI”—nor does it address the potential for liability in other contexts such as tort claims.[13] It also acknowledged that “[t]he legal understanding of agentic AI will doubtless change as AI technology grows increasingly sophisticated.”[14] However, this case represents an early marker in what is sure to become a hotly contested issue going forward.

Key Takeaways

As the Court noted, this ruling is limited and does not insulate agentic AI developers or deployers from potential liability under these statutes or other laws, nor from claims based on violations of a website’s terms of service.

It does, however, provide a novel illustration of a court conducting a piecemeal analysis of how an agentic AI tool operates to determine liability, including an examination of who controls—and may ultimately be responsible for—the actions that the agent undertakes. As this case shows, each outcome may depend on highly factual questions, including how the tool is built and whether the agent is acting only on behalf of the user.

As the law evolves to keep pace with the rapid advancement of agentic AI, companies should stay informed about key judicial decisions and legislative activity and their potential implications for the AI tools that they develop and deploy.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

[1] Amazon.com Services, LLC v. Perplexity AI, Inc., 184 F.4th 1083, 1087–88 (9th Cir. 2026).

[2] Id. at 1088.

[3] Id.

[4] Id.

[5] Id.; 18 U.S.C. § 1030; Cal. Penal Code § 502.

[6] 18 U.S.C. § 1030(a)(2), (g).

[7] Cal. Penal Code § 502. For more information on the recent rise in CDAFA claims in the privacy context, including with regard to website tracking technologies, see our prior article here.

[8] Id. at 1089–90.

[9] Id. at 1089.

[10] Id. at 1090–91.

[11] Id. at 1091.

[12] Id.

[13] Id. at 1092.

[14] Id.