WarGames, Shopping Bots, and the Statute Trap: The CFAA and Amazon v Perplexity
When the 9th U.S. Circuit Court of Appeals hears oral argument later today in Amazon.com Services LLC v. Perplexity AI, Inc., it will confront a novel question: how should the Computer Fraud and Abuse Act (CFAA), a statute designed to punish computer break-ins, apply to an AI agent that browses the web on a user’s behalf?
The underlying facts are not especially favorable to Perplexity. In granting a preliminary injunction, Judge Maxine Chesney of the U.S. District Court for the Northern District of California found “strong evidence” that Perplexity violated both the federal CFAA and California’s analogous statute. According to the court, Perplexity continued accessing Amazon’s systems after receiving a cease-and-desist letter and deliberately evaded the technical measures Amazon deployed to block that access. The 9th Circuit stayed the injunction pending appeal.
The doctrinal question is the easy one. Amazon will probably win, and probably should. It is also the less interesting question.
The harder and more consequential issue is whether the CFAA is the right body of law to govern this kind of dispute at all. More broadly, it raises a recurring problem in technology law: whether it is sustainable to keep asking statutes written for the technological realities of the mid- and late-20th century to govern technologies their authors could not have anticipated.
We think the answer to both questions is no. As Greg Dickinson puts it in his masterful article, “Law Proofing the Future”:
Technological breakthroughs provoke wonder, then fear, then legislation. The resulting legal regimes entrench incumbents, suppress experimentation, and displace long-standing legal principles with bespoke but brittle rules. . . . [Meanwhile,] the most powerful tools for governing technological change—the general-purpose tools of the common law—are in fact already on the books, long predating the technologies they are now called upon to govern, and ready also for whatever the future holds in store.
The interests Amazon seeks to protect are real. But they are fundamentally interests in property and contract, and courts developed the core principles governing those interests long before Congress enacted the CFAA. When statutes track those common-law principles, they often work well. When they depart from them—or prevent the sort of incremental adaptation that characterizes the common law—they tend to generate exactly the kind of doctrinal strain the CFAA now exhibits.
The lesson for agentic AI is not that Congress needs to enact a new statute. The legal system already possesses a framework capable of absorbing these new facts. Under current political and institutional conditions, any new legislation is more likely to depart from that framework than to reinforce it.