Appeals Court: An AI-Agent Browser Doesn't Violate the CFAA

The U.S. Court of Appeals for the Ninth Circuit has handed down a ruling that reads the infamous Computer Fraud and Abuse Act (CFAA) in a rare, sensible key. The dispute arose from a lawsuit brought by Amazon against Perplexity AI, the company that develops the Comet browser.

What the dispute is about

Comet includes an optional AI agent called “Assistant.” It can navigate websites on its own — including Amazon — for example, to compare prices. Amazon took the view that, since it had never “authorized” Perplexity to access its users' accounts, the browser violated the CFAA, and it went to court to try to shut the project down.

The court did not agree with that logic. In its view, Perplexity can hardly be held liable, because the tool is controlled by the users themselves, not by the company.

The EFF's position

The Electronic Frontier Foundation filed an amicus curiae brief in the case. Its argument is simple: the CFAA punishes unauthorized “access,” but it is not Perplexity that reaches Amazon's servers — it is the users of the Comet browser. The court acknowledged that it was the EFF's explanation that “most clearly describes the nature of the system.”

The judges noted that agentic AI may raise fundamentally new legal questions: there is virtually no precedent defining how to apportion responsibility for the actions of AI agents, all the more so in the context of the CFAA. In this case, however, there was no need to dig into the finer points of an artificial intelligence's “intent”: Assistant is “a tool, not a person within the meaning of the law,” and that tool is controlled by users. Even the fact that Perplexity received information about users' Amazon accounts and used it to instruct the agent was not, the court found, enough control to establish “access” by the company itself.

Why it matters

The court stressed that Amazon may well have other legitimate grievances against Perplexity, but its reliance on the CFAA was legally untenable and bad as policy — under such a reading, it is the users themselves who would have risked criminal liability.

The EFF calls the ruling gratifying: big players all too often wield the CFAA as a cudgel against newcomers and the authors of useful user-facing tools. According to the organization, within its Coders' Rights Project the CFAA risk is a constant topic of consultation even for developers who are merely building tools to access websites in new ways. Backing from one of the country's most influential appeals courts is, in that respect, especially valuable.

Source: EFF Deeplinks