The Court Case That Will Define AI Shopping

Update, October 2026: On August 4, 2026, the Ninth Circuit vacated the preliminary injunction described below, and on September 10 it declined to rehear the case. The court found Amazon unlikely to show that Perplexity violated the CFAA. This post reflects the case as it stood in March 2026.

On March 9, 2026, Judge Maxine Chesney in the Northern District of California granted Amazon a preliminary injunction against Perplexity's Comet browser — an AI agent that makes purchases on Amazon on behalf of users. The ruling hinged on a distinction that sounds simple but changes everything: user permission is not the same as platform authorization.

TL;DR: The first federal court ruling on AI agent shopping sided with Amazon: platforms can block AI agents even when users authorize them. Perplexity appealed to the Ninth Circuit on March 10. Meanwhile, Visa, Mastercard, and Cloudflare are building the trust infrastructure that could make these courtroom fights unnecessary. The question isn't whether agents will shop — it's who gets to set the rules.

I've been tracking this story since I first tested how AI agents actually shop. That post was about product discovery — which stores show up when you ask ChatGPT for pajamas. This post is about something bigger: what happens when an AI agent tries to buy something on a platform that doesn't want it there.

What Actually Happened in the Courtroom

Perplexity launched Comet in July 2025 as a browser that lets AI complete purchases on behalf of users. You tell the agent what you want, it finds it on Amazon, and handles the checkout — all inside Perplexity's interface, using your Amazon credentials.

Amazon's objection wasn't about what Comet bought. It was about how it got in.

The timeline, as Amazon laid it out: Amazon first warned Perplexity in November 2024 and warned it at least five times in all. When Amazon deployed a technical block in August 2025, Perplexity pushed a software update that got around it within 24 hours. Perplexity kept going.

Judge Chesney's ruling cited the Computer Fraud and Abuse Act — a 1986 law originally written for computer hackers — and found "strong evidence" that Comet accessed Amazon "without authorization." The critical legal distinction: Comet "accesses with the Amazon user's permission but without authorization by Amazon" (court order, 2026).

That one sentence rewrites the rules. If you hire a personal shopper, they can walk into any store. If you authorize an AI agent, the store can still say no.

Why the Food Delivery Analogy Keeps Nagging at Me

Amazon made a comparison that stuck. In its statement on the dispute, Amazon said shopping agents should operate openly, the way others already do, "including food delivery apps and the restaurants they take orders for, delivery service apps and the stores they shop from, and online travel agencies and the airlines they book tickets with for customers." These are established platform consent norms, and the judge treated user permission and platform authorization as separate questions.

Perplexity pushed back, vowing to "continue to fight for the right of internet users to choose whatever AI they want." Your account, your data, your choice of interface.

Here's what bothers me about the food delivery analogy. DoorDash negotiates one restaurant at a time. A human on the partnerships team calls a restaurant owner, signs a contract, uploads the menu. That works when you're onboarding restaurants in a city.

An AI shopping agent doesn't work that way. It wants access to every store, every platform, every inventory feed — simultaneously and autonomously. Millions of agents needing access to millions of stores. There's no partnerships team big enough for that. The consent model that works at DoorDash's scale breaks at internet scale.

The judge sided with platform consent, and that creates precedent. Perplexity filed their appeal on March 10. But even if the Ninth Circuit rules differently, the underlying problem doesn't go away: how do you do consent when both sides are machines?

The Three Gaps the Ruling Exposed

Here's where I went down a rabbit hole I didn't expect. A comment on my LinkedIn post about the injunction — from Josh Baker, former NFL player turned tech founder who's been building what he calls the Agent Certification Framework — made me realize the court had to fill a gap that the industry should have filled itself.

Baker's point: "If Comet had operated under a certification standard that required proving platform-level authorization before executing a transaction, this ruling might have looked very different."

I spent three days mapping what exists. Three layers are missing.

Who Is This Agent? (Identity)

Perplexity's Comet had no standardized way to prove its identity to Amazon. It showed up as traffic — sophisticated bot traffic, but traffic. Amazon couldn't distinguish it from a scraper, a price-monitoring tool, or a legitimate shopping agent with bad manners.

The infrastructure being built:

Visa published its Trusted Agent Protocol (TAP) on GitHub: AI agents sign their requests with cryptographic keys, Ed25519 among them, which act as digital passports (Visa Developer, 2025). That's the big one. If an agent signs with a key registered with Visa, a merchant can check the signature against a trusted key store before letting the agent in.

Cloudflare's approach is different: it validates the cryptographic signatures of "signed agents" on its own network, so a site can decide what to do with that traffic before it reaches the origin server. And GoDaddy, of all companies, is building an Agent Name Service registry on top of an IETF draft. Think DNS for AI agents: shopping-agent.perplexity.ai resolves not to an IP address but to a verifiable identity with declared capabilities.

A HID survey of 300 IT leaders in the US and Europe, released in Q1 2026, found 16% of enterprises already issuing certificates for AI agents.

Can This Agent Be Trusted? (Behavioral Trust)

Even if Amazon knew who Comet was, it had no way to know what Comet would do. Would it respect rate limits? Follow terms of service? Avoid scraping inventory data for competitive intelligence?

Two certification systems are racing to fill this gap:

The Agent Certification Framework (ACF) runs 30 behavioral tests across 4 suites — commitment boundaries, consistency, hallucination detection, and adversarial resistance. Agents that pass get cryptographic certificates. There's a public registry of certified agents (ACF Standards, 2026).

Then there's AIUC-1, developed with Stanford, MIT, MITRE and others, which certified UiPath as the first enterprise automation platform on March 9, 2026 (UiPath, 2026). The same day as the Perplexity injunction. UiPath's agents went through more than 2,000 technical evaluations to get there. AIUC's own pitch is "SOC 2 solved SaaS trust - AIUC-1 solves AI trust": the same kind of third-party audit that enterprise software buyers already require for cloud services.

A2AS, a framework whose authors and contributors include people from AWS, Google, and JPMorganChase, focuses on runtime security: behavior certificates that declare what an agent is allowed to do, authenticated prompts, and defenses against prompt injection.

Did the User Actually Say Yes? (Authorization Records)

The court found that user permission alone wasn't sufficient. But Perplexity had no cryptographic proof that users authorized specific transactions — just session access and Amazon credentials.

Mastercard launched Verifiable Intent on March 5, 2026, with Google — four days before the ruling. It creates a cryptographic record that a human authorized a specific AI agent to make a specific purchase. Not just "I logged in" but "I told this agent to buy this item at this price" (Mastercard Newsroom, 2026).

And in February 2026, NIST launched an AI Agent Standards Initiative to foster industry-led standards and protocols so that AI agents can act securely on behalf of their users and work across systems, shopping included. Still early, but when a federal standards body gets involved, the direction is clear — this won't be left to case-by-case courtroom fights forever.

The SSL Certificate Moment

I keep coming back to this analogy. In the 1990s, the web had the same problem. Anyone could put up a storefront. No way to prove a website was legitimate. No way for users to know if their credit card was being sent to a real merchant or a scammer.

SSL certificates solved this. A cryptographic proof of identity, verified by a trusted third party. The padlock icon became a trust signal that billions of people understand without thinking about the cryptography underneath.

AI agents are in that pre-SSL moment right now. The pieces being built — Visa TAP for identity, ACF and AIUC-1 for behavioral trust, Mastercard Verifiable Intent for authorization — are the agent equivalent of the certificate authority ecosystem.

The timing is what struck me most. Mastercard launched March 5. UiPath got certified March 9. Visa's TAP is already on GitHub. These aren't roadmap slides from a conference keynote. They're shipping while the courts are still figuring out which 1986 law applies.

What Happens Next

Perplexity appealed to the Ninth Circuit on March 10 (notice of appeal, 2026). The next day, Amazon announced that its Shop Direct program now covers over 100 million products from more than 400,000 merchants, with tens of millions of them available through Buy for Me (About Amazon, 2026) — building its own agent shopping layer inside the walled garden while the legal fight keeps external agents out.

I see three paths from here, and they're not mutually exclusive.

The Ninth Circuit upholds the ruling. Platform consent becomes the law for AI agents — the DoorDash model at internet scale. Amazon, eBay (which banned unapproved AI shopping agents in January), and any platform with enough leverage gets to dictate terms.

Or the Ninth Circuit reverses, siding with consumer autonomy. Your account, your agent, your choice. This favors Perplexity and anyone building cross-platform agents — but it creates chaos without behavioral standards. Agents flooding platforms with no identity, no trust verification, no audit trail.

The path I keep coming back to: the trust infrastructure matures fast enough that the legal question becomes secondary. Agents carry cryptographic credentials. Platforms verify identity at the edge. Behavioral certifications become table stakes. The padlock icon, but for agents.

I think we get some combination of the first and third. The courts draw a line. The infrastructure fills the space the courts can't reach. I think this because of the timing — Visa, Mastercard, and the certification bodies aren't waiting for the Ninth Circuit. They're building as if the answer is already obvious.

The Question That Won't Go Away

Four posts into this investigation — from testing which stores AI recommends, to the infrastructure gap, to China's head start, to Amazon's walled garden — I thought the questions were technical. Which protocols work? Whose products show up?

This ruling shifts the frame. The question isn't "can your store serve AI agents." It's "who decides whether an agent can enter your store in the first place?" And underneath that: who decides what counts as a trustworthy agent?

Four competing protocols — UCP, ACP, MCP, A2A — each backed by different tech giants, each with a different answer to that question. That's where I'm digging next.

Frequently Asked Questions

Can AI agents legally shop on websites without platform permission? Not according to the March 2026 ruling in Amazon v. Perplexity, which found that user authorization is not the same as platform authorization under the CFAA. The court ordered Perplexity's Comet browser off Amazon accounts despite user permission, because Amazon never authorized agent access. Perplexity appealed to the Ninth Circuit.

What is the Agent Certification Framework? Think of it as a trust seal for AI agents. ACF runs 30 behavioral tests across 4 suites — commitment boundaries, consistency, hallucination detection, and adversarial resistance. Agents that pass receive cryptographic certificates and appear on a public registry at acfstandards.org.

What is Mastercard Verifiable Intent? A cryptographic receipt proving a human authorized a specific AI purchase. Launched March 5, 2026, in partnership with Google, it creates an auditable record that goes beyond session-level access — exactly the kind of proof that was missing in the Perplexity case.

How does Visa TAP work for AI agents? Visa's Trusted Agent Protocol has AI agents sign their HTTP requests with cryptographic keys (Ed25519 is one supported algorithm), digital passports, essentially. Merchants verify the signature against a trusted key store before granting access. The code is published on GitHub under Visa's developer terms, and Visa says it will align the protocol with standards bodies such as the IETF, a push toward an industry standard rather than a closed scheme.

Will this ruling affect other AI shopping tools? Almost certainly. It was the first federal ruling that platforms can block AI agents even when users authorize them. The question extends beyond shopping to travel booking, food delivery, and any service where an agent acts on behalf of a user on a third-party platform.