Yesterday, Judge Maxine Chesney in the Northern District of California issued a preliminary injunction that blocks Perplexity’s Comet browser from accessing Amazon accounts. The case is Amazon.com Services LLC v. Perplexity AI, Inc. (3:25-cv-09514), and it’s the first time a federal court has drawn a line between what a user authorizes and what a platform authorizes when an AI agent is doing the shopping.

This matters for everyone building in agentic commerce. Not just Perplexity.

What Actually Happened

Perplexity built Comet — a browser that lets an AI agent log into your Amazon account, find products, and check out for you. Amazon didn’t like it. They sent five cease-and-desist letters starting in November 2024. Perplexity ignored all five.

In August 2025, Amazon put up a technical block. Perplexity shipped a workaround within 24 hours. That’s the detail that made this case. A court can forgive a lot, but documented, deliberate circumvention of a platform’s access controls is hard to spin.

Amazon sued in November 2025 under two statutes: the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA). Both are about unauthorized access to computer systems.

The injunction says Perplexity has to:

Perplexity has until around March 16 to petition the Ninth Circuit to put a hold on it.

The Legal Distinction That Changes Everything

Here’s the sentence from the ruling that every agent builder should tattoo on their wall:

Comet accessed Amazon accounts “with the Amazon user’s permission, but without authorization by Amazon.”

Judge Chesney split user consent from platform authorization. They’re two different things. Perplexity’s whole defense was that when a user says “go buy this for me,” that permission flows down to the agent. The court said no — the platform gets a separate vote.

Think about what that means. If the Ninth Circuit affirms this reasoning, every AI agent that logs into an authenticated account on someone’s behalf needs the platform’s blessing too. ChatGPT’s checkout features. Google’s shopping agents. Microsoft Copilot. Any tool that touches a login wall.

User permission is necessary but not sufficient. The platform has to say yes too.

Why Perplexity’s Defense Didn’t Work

Perplexity ran three arguments:

The personal assistant analogy. They compared Comet to hiring someone to manage your Amazon account. The court didn’t bite. A human assistant doesn’t mask their identity as a Chrome browser, and a human assistant doesn’t get updated to circumvent access blocks the next day.

The consumer harm angle. Blocking Comet hurts consumer choice and lets big platforms veto AI competition. There’s real merit to this argument long-term, but it doesn’t help when you’ve got a paper trail of ignoring five warnings and actively dodging technical blocks.

The $1 billion bond. Perplexity asked the court to make Amazon post a billion-dollar bond before the injunction kicked in, based on Comet’s market value. Chesney denied it. That ask probably didn’t help their credibility.

The biggest self-inflicted wound was a quote from Perplexity’s own lawyers in Marketing Brew back in January: “AI agents don’t have eyeballs to see the pervasive advertising Amazon bombards its users with.” That’s legally candid and strategically catastrophic. They told a court that their product bypasses the business model of the platform they’re accessing. Hard to argue you’re not causing harm after that.

Follow the Money: This Is an Advertising Case

The CFAA framing is the legal vehicle. But the actual fight is about ad revenue.

When Comet shops for you, it skips sponsored product placements. It ignores remarketing pixels. It doesn’t generate behavioral data Amazon can sell back to brands. It cuts past the entire retail media infrastructure that Amazon has spent a decade building into a $50+ billion business.

Perplexity’s lawyers basically admitted this. Andy Jassy, on a prior earnings call, said Amazon would partner with agent builders — “but on its own terms.” Those terms almost certainly include preserving the ad layer.

Andrew Frank at Gartner put it plainly: “There’s a huge amount of value at stake for anyone who wants to have a relationship with their customers.” Tyler Murray at VML went further, calling agentic shopping tools “not just a threat to retail media, but truly an existential threat.”

The court case is about unauthorized access. The business war is about who controls the transaction surface.

What This Means for Agentic Commerce Builders

A few things I’m thinking about:

The “dual authorization” doctrine is coming. If Chesney’s reasoning holds on appeal, we’re looking at a world where agents need both user consent AND platform consent. That creates a gatekeeping layer that big platforms will use. Whether you think that’s reasonable protection or anticompetitive depends on where you sit.

Disguise is the death sentence. Comet masked itself as a regular Chrome browser. That’s what turned a business dispute into a CFAA case. If your agent identifies itself honestly, the legal calculus shifts. Platforms might still block you, but the “unauthorized access” argument gets weaker. Transparency buys you options.

The robots.txt era is over for authenticated contexts. Public web scraping has fuzzy rules. But once you’re behind a login wall, using credentials, accessing account-specific data — you’re in CFAA territory. Cloudflare has documented millions of daily requests from agents ignoring robots.txt. This ruling gives platforms real legal teeth to enforce access controls.

Partnerships will be the path. Jassy already tipped this. Amazon wants agents on its platform — agents that show ads, generate data, and play by its rules. The winning agentic commerce companies in 2026 won’t be the ones that hack around platforms. They’ll be the ones that negotiate terms that work for both sides.

Watch the Ninth Circuit. Perplexity will appeal. If the appellate court affirms the split between user consent and platform authorization, that becomes binding precedent across the western US and a strong signal nationally. If they reverse, we’re back to ambiguity. Either way, this is the case that defines the legal boundaries of agentic commerce for the next several years.

The Bigger Picture

I’ve been writing about agentic commerce for over a year now. The technology questions — can we build agents that shop? — are basically answered. Yes. We can.

The open questions are structural. Who gets to authorize what? Who keeps the customer relationship? Who captures the data? Where does the ad revenue go?

Perplexity picked a fight with the biggest ecommerce platform on earth and got smacked. But the questions they raised aren’t going away. Every company building AI shopping agents is going to hit this same wall. The ones that survive will be the ones that figure out how to add value to platforms instead of extracting it.

Because right now, the courts are saying platforms get to decide who comes through the front door. And that changes the game for everyone.

Sources: Bloomberg, CNBC, GeekWire, CyberScoop, Search Engine Journal, Marketing Brew, Marketing AI Institute