Short answer: a federal district court has already said yes — a platform’s own terms and a cease-and-desist letter can make an AI agent’s access “unauthorized” under anti-hacking law, even when the shopper who sent the agent fully consented. That ruling is now on appeal, and the case deciding whether it holds up — Amazon v. Perplexity — is the closest thing agentic commerce has to a test case for “can an agent buy on your store without your say-so.”

The case that’s deciding it

Amazon sued Perplexity in the Northern District of California in November 2025 over Comet, Perplexity’s AI browser, which logs into a user’s Amazon account to browse, add to cart and check out on their behalf (CourtListener docket, No. 3:25-cv-09514). On March 9, 2026, Senior Judge Maxine M. Chesney granted Amazon a preliminary injunction, finding Amazon likely to prevail on claims under the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act. Her order blocked Comet from password-protected Amazon pages — account, order history, checkout — and required Perplexity to delete any customer data it had collected there (Cooley: “Court Finds AI Agent May Violate State, Federal Law by Accessing Amazon Accounts Without Authorization”).

Consent from the user isn’t authorization from the platform

The legal hinge is a distinction most merchants have never had to think about: Judge Chesney found Comet accessed Amazon accounts “with the Amazon user’s permission, but without authorization by Amazon” — treating user consent and platform authorization as two separate, both-required gates. She applied the Ninth Circuit’s Facebook v. Power Ventures precedent, under which a cease-and-desist letter can revoke authorization even where the underlying user willingly handed over credentials (Mogin Law: “Amazon v. Perplexity: Courts Weigh Authorization, Consent, and Agentic AI”). Amazon had sent Perplexity such a letter before suing; the court treated continued access after that letter as evidence of unauthorized access, not just a contract dispute.

Perplexity’s defense: it isn’t Perplexity that “accesses” Amazon, the user does, through a tool — the same as opening a browser. Amazon countered that undeclared agentic traffic pollutes its ad-attribution and bot-filtering pipelines.

What’s still undecided

The Ninth Circuit stayed the injunction on March 30, 2026, so Comet has been able to shop on Amazon again since then while the appeal proceeds. A three-judge panel (Circuit Judges Milan Smith Jr. and Eric Tung, with District Judge John Hinderaker sitting by designation) heard oral argument in Seattle on June 11, 2026. As of this writing, six weeks later, the panel has not issued an opinion — the case remains submitted with no ruling on the merits. Whichever way it goes, the precedent won’t stay confined to Amazon: it will apply to any site with a login wall, loyalty program or booking flow that an agent might try to operate on a user’s behalf (KJK: “When AI Goes Shopping Without Permission: What Amazon v. Perplexity Means for Ecommerce Brands”).

What merchants should do regardless of the outcome

Legal commentary aimed at ecommerce brands is converging on the same three moves, independent of how the Ninth Circuit rules:

  • Put explicit agent language in your terms of service — state whether automated/agentic access to authenticated areas is permitted, rather than leaving it implied.
  • Require agents to self-identify rather than presenting as an ordinary logged-in browser session, so “was this access authorized” isn’t a forensic question after the fact.
  • Keep a cease-and-desist template ready. Power Ventures and this case both turn on the fact that a platform sent one — silence reads as tacit permission.

Whether the goal is to let agents transact cleanly or keep them out of account-holder areas entirely, the same underlying gap shows up either way: most merchants have no documented policy on agentic access at all, so there’s nothing for a court — or an agent — to go on. That’s a distinct question from whether an agent can find a product page; it’s whether it’s allowed to finish the purchase, which is the exact gap AgentReady’s transaction-focused scan checks for, alongside the checkout-protocol readiness this watch has covered separately.

Sources