Blocking AI agents: can an online shop shut them out? Amazon v Perplexity

On 4 November 2025 Amazon.com Services LLC brought proceedings against Perplexity AI, Inc. in the federal district court for the Northern District of California (case 3:25-cv-09514-MMC). The claim concerns Perplexity’s Comet browser, whose built-in AI agent can search for products and make purchases in Amazon’s store on the user’s behalf. Amazon contended that the agent accessed customers’ password-protected accounts without Amazon’s permission, in breach of the federal Computer Fraud and Abuse Act (CFAA) and its California counterpart. For Norwegian online retailers and consumers the case raises three questions, namely whether a platform may shut agents out, whether the agent’s purchases bind the consumer, and who bears the loss when the agent buys wrongly or card details are misused.

What did the courts decide in Amazon v Perplexity?

The district court (Judge Maxine M. Chesney) granted Amazon’s motion for a preliminary injunction on 9 March 2026. The court found that Comet accessed the user’s password-protected account with the user’s permission but without Amazon’s authorisation, and that Amazon was likely to succeed on the merits. The injunction barred Perplexity from giving AI agents access to Amazon’s protected systems.

The Court of Appeals for the Ninth Circuit vacated the injunction on 4 August 2026 (case 26-1444). The court found that Comet runs locally on the user’s machine and that Perplexity itself does not communicate directly with Amazon’s servers. Under the CFAA it is a person who must access the computer, and the agent cannot be such a person.

“it is a tool, not a person for statutory purposes”

On that analysis it was the user who obtained access, with the agent as an aid. The court stressed that the holding is confined to access under the CFAA on the record before it and does not decide Perplexity’s liability on other bases. In a footnote the court added that the outcome does not impair Amazon’s ability to regulate access through its terms of service. A petition for rehearing en banc was denied on 10 September 2026, and the case continues in the district court. Amazon’s complaint relied solely on the two computer access statutes and not on breach of contract, although according to the complaint Amazon added specific agent terms to its conditions of use on 30 May 2025.

Is blocking AI agents lawful under Norwegian law?

A Norwegian online shop is in principle free to decide with whom it will trade and on what terms. It may therefore prohibit or restrict the use of agents in its terms of use and put technical barriers in place, for example by requiring agents to identify themselves. The terms bind consumers who have accepted them, and use contrary to the terms is a breach of contract which may justify closing the account. Under E-Commerce Act § 11 the terms must be made available in a form that allows them to be stored and reproduced, and an unreasonable term may be set aside under Contracts Act § 36.

The position against the agent provider is weaker, because the provider is normally not itself a party to the contract with the shop. Under Penal Code § 204 it is an offence to obtain access to a computer system “by breaching a protection or by any other unlawful means” (our translation). Where the consumer uses his or her own login credentials and has personally instructed the agent to make the purchase, there is in our assessment little to suggest that this condition is met. A deliberate attempt at circumvention, such as an agent concealing its nature after being blocked, may be assessed differently. Such conduct may also be contrary to Marketing Control Act § 25 on good business practice between traders. None of these questions has been settled by Norwegian case law.

Is the consumer bound by the AI agent’s purchase?

The agent is not a legal person and therefore cannot be an agent with authority under Contracts Act § 10. An order sent by the agent on the consumer’s instruction is in our assessment the consumer’s own declaration of intent, as discussed further in the article on AI agents and contracting. Internal limits that the consumer has set for the agent, such as a spending cap, bind the shop by analogy with Contracts Act § 11 only if it understood or ought to have understood that the limit had been exceeded. Errors that the shop ought to have detected may be relied on under Contracts Act §§ 32 and 33.

For the consumer the right of withdrawal is the most important protection. In distance sales of goods the consumer may withdraw from the contract within 14 days of receiving the goods under Cancellation Act §§ 20 and 21, and the right applies irrespective of whether the consumer or the agent placed the order. The exceptions in Cancellation Act § 22 include goods liable to deteriorate rapidly and goods made to the consumer’s specifications. Liability for harm caused by the agent beyond the contract itself is discussed in the article on AI agent liability.

Who bears the risk of mistaken purchases and misuse of payment details?

Under Financial Contracts Act § 4-2 a payment transaction is authorised only where the payer has consented to it, and consent may also be given via the payee. Where the consumer has given the agent the card details and instructed it to buy a particular item, the payment is authorised, and an error in the purchase itself must be resolved between the consumer and the shop. It is unsettled whether a payment that exceeds the consumer’s instruction is authorised. In our assessment the bank will often argue that the consumer personally gave the agent the means of payment, so that the transaction is authorised as against the bank.

The position is different where a third party takes over or manipulates the agent and uses the card without the consumer’s consent. The transaction is then unauthorised, and the bank is liable for the loss under Financial Contracts Act § 4-30(1). The consumer bears an excess of up to NOK 450 where a payment instrument has been misappropriated, and up to NOK 12,000 for electronic payment instruments where the loss results from gross negligence. Under Financial Contracts Act § 4-23(1) the customer must take all reasonable steps to protect personalised security credentials, and unrestricted agent access to cards and codes may be cited as gross negligence. Unless the customer has acted fraudulently, the customer is nonetheless not liable where the bank did not require strong customer authentication, under Financial Contracts Act § 4-30(5)(c).

Liability may be reduced under Financial Contracts Act § 4-31(2) where the shop understood or ought to have understood that the card was being used unlawfully. The consumer must notify the bank without undue delay and no later than 13 months after the debit under Financial Contracts Act § 4-24. Where the consumer disputes liability, the bank must as a rule refund the amount by the end of the following business day under Financial Contracts Act § 4-32.

What should online shops and agent providers do?

Online shops should regulate agent access expressly. Further articles on contractual risk and AI are collected on the artificial intelligence topic page and the contracts topic page.

1. Include a specific provision on agents in the terms of use, requiring identification and reserving a right to restrict or block agent access.
2. Make the terms available before ordering and obtain acceptance in a way that can be documented.
3. Require strong customer authentication at payment, including where the order comes from an agent.
4. Agree, as an agent provider, with the user which spending limits and confirmations apply before the agent may pay.
5. Log the instruction, the order and the payment, so that it can be documented what the consumer consented to if the bank or the shop disputes the claim.

Questions and answers

Next legal review: 15 December 2026