The 9th Circuit's Browser Loophole Leaves AI Scrapers in a Legal Black Hole

The core conflict: public-data law meets logged-in AI browsing

The real issue is no longer whether an old computer-fraud law can be stretched to cover modern software. It is whether a public-data rule can survive an AI agent acting inside private, logged-in sessions. That is why this matters now: the 9th Circuit spent thirty-seven minutes on that mismatch, and a federal judge already issued a temporary block in March before the appellate court stayed it.

User choice versus platform control

Perplexity frames the case as a user-autonomy fight. Its spokesperson said users have the right to choose their own AI. Amazon's counter is sharper: even if the user consents, the platform may still control access to its systems. Lower-court findings found strong evidence that Perplexity continued accessing Amazon after notices and technical blocks, which makes this more than a clean public-scraping dispute.

That distinction matters. Earlier hiQ-style debates about public data were more favorable to scrapers. Amazon v. Perplexity is narrower on the facts but broader in implication because it asks a harder question: when authentication is involved, does user consent override an explicit platform refusal?

What the Ninth Circuit already said about public-data scraping

The prior shield was real - but limited

In the Ninth Circuit, hiQ and Van Buren did carve out a real defense for public-data scraping. The court held that scraping publicly available information likely does not count as accessing a computer "without authorization" under the CFAA. It also limited LinkedIn's ability to use technical means taken to prevent data mining against publicly accessible profile data, even after multiple cease and desist letters.

That created a workable public-data thesis for companies that relied on open harvesting: if the content is public, a platform's later change of mind may not automatically turn scraping into federal computer fraud.

Why Perplexity falls outside that lane

Perplexity does not fit neatly into that precedent because the dispute has shifted from open harvesting to user-authenticated browsing plus active resistance. Amazon obtained a court injunction in March, and the Ninth Circuit later halted the order on March 16.

The factual problem for Perplexity is more direct than the doctrinal one. A lower-court review found strong evidence that Perplexity kept accessing Amazon after notices and blocks, and Reuters reported the system allegedly ignored repeated requests to stop. That moves the case away from hiQ's public-data fact pattern and into the harder territory of authenticated access, circumvention, and explicit refusal.

hiQ narrowed the CFAA, but it did not create blanket immunity for logged-in bypass. That is the distinction the court is now addressing: user consent may authorize the tool, but it may not automatically override a platform's decision to block access.

The liability gap created by an unanswered question

Ambiguity is the real exposure

The missing outcome is itself the signal. The 9th Circuit heard the case, but no ruling came and the case was submitted without a decision. That leaves a practical gap: platforms still have a live argument that user authorization and platform authorization are legally distinct, while defendants can still argue that the old public-data shield covers parts of agentic browsing.

That uncertainty cuts both ways. Perplexity can still say it is defending the right to choose their own AI, and the case involves a fast-growing sector of the AI industry. But the practical risk remains: this is not a clean public-data dispute, and lower-court findings still pointed to strong evidence of access after notices and blocks.

What to watch next

The key question is whether the final opinion keeps agentic browsing close to the hiQ public-data lane or treats logged-in access plus blocking as a separate category. Investors and operators should watch for that split, because it will determine whether the CFAA remains a limited anti-hacking statute or becomes the main rulebook for AI agents operating inside authenticated sessions.