9th Circuit: Building a Browser Isn't CFAA Hacking

Amazon spent nine months trying to convince a federal court that a web browser was a hacking tool. On August 4, 2026, the Ninth Circuit disagreed, and in doing so it put a load bearing beam under every ad blocker, tracker blocker, accessibility tool, and privacy extension in the United States.

Key Takeaways

• The Ninth Circuit vacated a preliminary injunction against Perplexity AI on August 4, 2026, in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444.
• Judge Milan D. Smith Jr. wrote that Comet's AI Assistant "is a tool, not a person for statutory purposes," so the user, not Perplexity, is the party accessing Amazon's servers under the Computer Fraud and Abuse Act.
• The panel warned that Amazon's reading of the CFAA "could expose users themselves to criminal liability" on a conspiracy or aiding and abetting theory.
• The court quoted an amicus brief from the Electronic Frontier Foundation, Mozilla, Digital Medusa, EleutherAI, and the Alliance for Responsible Data Collection, saying it "articulates the nature of the system most clearly."
• This is a preliminary injunction ruling from a single circuit; it does not decide the case on the merits, and it expressly leaves Amazon's terms of service enforcement untouched.

What Did Amazon Actually Argue?

Amazon argued that when Perplexity's software acted inside a logged in Amazon account, Perplexity, the company, became the party accessing Amazon's computers without authorization.

Comet is a Chromium style browser that runs locally, like Chrome. Its distinguishing feature is an optional agent called the Assistant, which can carry out tasks the user asks for, including shopping on Amazon.com. Per the opinion, the Assistant takes screenshots of the browser view, sends them from the user's machine to Perplexity's servers, and receives navigation instructions back. Perplexity's servers never touch Amazon's servers directly.

Amazon had told Perplexity's CEO before Comet shipped that its AI products were not welcome in the Amazon Store, and repeated that after launch. The sticking point was a technical one: Perplexity declined to send a distinguishing user agent string that would have let Amazon identify and block agent traffic. Amazon filed in November 2025 alleging violations of the CFAA and California's CDAFA. In March 2026, Judge Maxine Chesney granted a preliminary injunction, calling it a close question.

What Is the CFAA, and Why Is "Authorization" So Contested?

The CFAA is a 1984 federal anti hacking statute that punishes anyone who "intentionally accesses" a protected computer "without authorization," and the phrase has been litigated for four decades because Congress never defined it.

Two decisions frame the backdrop. In Van Buren v. United States (2021), the Supreme Court rejected a purpose based reading of "exceeds authorized access" in a 6-3 opinion, adopting what commentators call a gates up or down test: either an area of a system is off limits to you or it is not, and misusing data you were allowed to reach is not a federal crime. The Congressional Research Service summary lays out the split Van Buren resolved. The Ninth Circuit then applied that logic in hiQ Labs v. LinkedIn, 31 F.4th 1180 (2022), holding that scraping a public page cannot be unauthorized access because the site "erected no gates to lift or lower in the first place."

Worth sitting with: the statute at issue here is six years older than the first web browser. Congress wrote it to stop intrusion into other people's machines, not to govern what software a person runs on their own.

What Did the Court Hold?

The panel held that Amazon is unlikely to succeed on the merits, because the CFAA contemplates access by a person, and the Assistant is not one.

Judge Smith's reasoning is short and unusually clean. Section 1030(a)(2) punishes "whoever . . . intentionally accesses" a protected computer. "However advanced the Assistant currently is," the opinion states, "it is a tool, not a person for statutory purposes." The remaining question was whether Perplexity used that tool to access Amazon. The answer on this record was no: "It is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com."

Amazon's strongest fact, that Perplexity receives browser screenshots and sends back instructions, did not change the outcome. Those activities "by themselves, do not mean that Perplexity has 'accessed' (gained entry) to Amazon's servers."

The panel leaned on the rule of lenity, which applies because the CFAA is primarily a criminal statute. Then it named the consequence Amazon's theory carried: if Perplexity's access were unauthorized, users who invoked the Assistant could be on the hook as conspirators. The court found it unlikely Congress meant to criminalize that. The CDAFA claim fell with the CFAA claim for the same reason. Disposition: injunction vacated, case remanded.

What Role Did EFF's Amicus Brief Play?

EFF's brief supplied the technical description the court adopted, and the opinion says so by name.

The amicus brief filed by EFF with Mozilla, Digital Medusa, EleutherAI, and the Alliance for Responsible Data Collection walked through the actual request path: the browser asks Amazon's server for a page, the page renders on the user's machine, and only then does the Assistant analyze what is already on screen. "Perplexity's servers never directly access Amazon's servers." The panel called that explanation the clearest articulation of the system in the record and quoted it at length.

Look at who lined up on each side. Supporting Amazon: the National Retail Federation, News/Media Alliance, Digital Content Next, Airlines for America, and the Software & Information Industry Association, publishers and platforms that want control over client side behavior. Supporting Perplexity: EFF, the ACLU, the Knight First Amendment Institute, and Mozilla. When the organization that ships Firefox files a brief in an AI shopping case, the case was never really about shopping.

Why This Matters for Extension Developers

Amazon's theory, generalized, is that the maker of any software that acts on a website on your behalf is the one "accessing" that site, which would sweep in a large share of the extension ecosystem.

Consider what an ad blocker does: it cancels network requests a site's markup asked the browser to make. A tracker blocker rewrites what loads. A password manager fills fields. An accessibility tool restructures the DOM. Each intervenes in the transaction between a user and a server, and each does something the site did not ask for. Under Amazon's framing, every one of those vendors is arguably a party to your session.

The opinion also engaged with browser extensions directly, distinguishing Meta v. BrandTotal, 605 F. Supp. 3d 1249 (N.D. Cal. 2022), where a district court declined to extend CFAA liability to an extension that passively logged data Meta had already sent to users. The Ninth Circuit noted the Assistant does more than passive collection, and still found no access by Perplexity. That is a stronger position than BrandTotal, not a weaker one.

The practical stakes are about letters, not verdicts. EFF's Coders' Rights Project exists because a CFAA threat frequently ends a project before a judge sees it; the risk of a federal criminal statute is enough to make a developer or their institution walk away. A published circuit opinion is the kind of thing you can attach to a reply.

What This Means for Your Inbox

Email privacy tools sit squarely in the protected class. A tracker blocker for Gmail works by intercepting the remote image request a sender embedded in a message, a request the sender very much wants your client to make. Gblock is exactly that kind of software: a browser extension that changes what a page loads, on your instruction, on your machine.

The premise underneath every tool in that category is "your tools are your access." When you install something that blocks a spy pixel, you are not authorizing a third party to enter Gmail on your behalf. You are configuring your own client. Smith's opinion says the CFAA reads the same way: the statute asks who the person is, and the person is you.

That distinction matters more as agentic software spreads into email triage and inbox automation, where delegating account access to an AI agent raises real security questions that are separate from the legal one. And it is worth remembering that extensions themselves are not automatically trustworthy: a Chrome extension with 500,000 downloads was caught exfiltrating user data earlier this year. Legal protection for the category is not a substitute for vetting the specific tool.

What the Ruling Does Not Do

The panel was explicit about its limits, and overstating this holding would be a mistake.

This is one circuit, at the preliminary injunction stage, on this record. Amazon's case continues in the Northern District of California, and Amazon said it is evaluating next steps. The court declined to "establish a new legal regime governing agentic AI" and expressly reserved whether tort claims could reach the Assistant's actions. Footnote 5 is the one to read twice: the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service."

Contract law, trespass to chattels, copyright, and unfair competition all survive untouched. So does the simplest countermeasure of all, technical blocking. Amazon wanted a user agent string precisely so it could refuse the traffic itself. Nothing in this opinion stops a site from detecting a tool and closing the door.

What the ruling removes is the federal criminal statute as a bludgeon in that fight. Whether a site tolerates your software is now, in the Ninth Circuit, a question about contracts and engineering. It is no longer a question about whether the person who wrote your extension is a felon.