Amazon/Perplexity - A Case That Will Define The Future of AI Agents
A federal judge just told an AI agent it can’t pretend to be a human shopper. And the ripple effects are just getting started.
In March 2026, a U.S. District Court granted Amazon a preliminary injunction blocking Perplexity’s Comet browser from facilitating purchases on Amazon on behalf of users. This wasn’t a final ruling. But it was an important moment. The court’s answer, at least for now, was yes, platforms have a right to know when an agent is acting in a user’s name. But the question itself is what matters.
Amazon sued Perplexity in November 2025, claiming Comet, Perplexity’s AI-native browser was masking automated browsing sessions as regular traffic from Google Chrome. Essentially an AI agent was operating under a user’s credentials, completing purchases on their behalf, but Amazon had no way to distinguish it from a human user. Amazon had issued five warnings or so to stop, starting from November 2024. After Amazon implemented a technical block, Perplexity shipped a software update within 24 hours to circumvent it. That specific detail appeared in the judge’s reasoning.
Perplexity’s response, published on their own blog, was titled “Bullying is Not Innovation.” Their argument is that Comet simply automates what the user would have done anyway. The agent is acting on delegated authority. The user gave permission. What’s the problem?
The distinction the court drew is subtle and consequential.
The judge found that Amazon presented essentially undisputed evidence showing Perplexity accessed password-protected Prime accounts with user consent but without Amazon’s approval. Those are two different things. Your permission to access your own account does not automatically transfer to a third-party agent acting in your name. That gap between user authorization and platform authorization is where the entire agentic web is about to get very complicated very fast.
Think about what agents do. They log into platforms. They fill out forms. They complete transactions. They interact with systems designed for humans, at human pace, in human ways, except ofcourse they’re not human. They’re faster and automated, and they don’t generate the behavioral data on the platforms they access. An AI agent shopping on your behalf cannot be advertised to. I mean technically I guess you could have your agent watch ads for you. Wouldn’t that be grand? But hard to upsell an agent I bet. Also an agent’s behavioral data is worthless for targeting. A human will doom-scroll. An agent? Too efficient. Clicks on things it needs to. Boring. The entire ad-supported commerce model strains if the “user” is a bot that inherited your session. So this whole thing is not just a legal concern but also an economic one.
This is why self-identification of agents is becoming an unavoidable conversation.
Now we’ve had AI chatbot transparency laws for a while. But this is different. California, New York, and several other states have passed laws requiring AI chatbots to disclose themselves to users. Meaning, you have a right to know when you're talking to a machine. What the Amazon ruling nudges towards is instead AI agents identifying themselves to platforms they're operating on.
NIST launched its AI Agent Standards Initiative in February 2026, explicitly focused on agent identity, authorization, and security. The concept paper asks how existing identity frameworks OAuth, SAML, federated identity etc. apply to agents that operate continuously, trigger downstream actions, and access multiple systems in sequence. Gartner projects that by 2026, 30% of enterprises will rely on AI agents that act independently, triggering transactions and completing tasks. If those agents are operating invisibly and inheriting user credentials, we need the rules of the road, and fast.
The world the Amazon ruling (thus far) pushes us towards looks something like this.
Agents that self-identify are auditable. Agents that declare their identity can be granted appropriate permissions, or denied them. Platforms can build agent-friendly APIs instead of playing guess-who? with bot traffic. Users get clarity about what their agents can and can’t do on their behalf. Amazon’s position is that the friction is necessary to be able to establish trust at scale.
Those who disagree and there are serious and smart people who do, argue that platform authorization requirements will entrench incumbents and kill competition. If every AI agent needs explicit platform permission to operate, they ask if it would result in Amazon, Google, and Apple becoming the gatekeepers of the agentic web. Their concern being that big companies could theoretically design permission frameworks that favor their own agents and disadvantage challengers. Is the web going to be a marketplace where there is a price of admission to stock the shelves with your product OR to let you in to the store at all? And is that price too high?
There’s also a deeper disagreement between legal minds. Agency law has long recognized that one party can act on behalf of another within authorized scope. If a user explicitly instructs an AI agent to shop using their account, the argument goes, the agent is operating within delegated authority. The court drew a line between user consent and platform consent, which is a new distinction. We've never had to formally decide whether a third-party AI system, operating at scale under your credentials, is legally equivalent to a human assistant acting on your behalf. I guess it’s like you asking your client - ‘is it ok if I send my junior associate to this meeting instead of me?’ And the client can say yes or no. Perplexity says “see, we’re just the associate here!” On the other hand, Amazon’s argument is that they were never asked.
The preliminary injunction isn’t the end of the Amazon-Perplexity fight. But it’s the first judicial data point in a body of law that doesn’t exist yet. Every company building an AI agent that touches a third-party platform be it shopping, travel, healthcare, legal, finance, now has a case to read and a framework to reckon with. The question of whether agents need to announce themselves is no longer just a technical standards conversation. It’s a legal one.
Agents will knock on the door. Whether platforms are required to open it is the part that’s still being written.
