Can Retailers Block AI Shopping Agents? What the Ninth Circuit's Amazon–Perplexity Ruling Means for Bot Policy

Key Takeaways

• Suing got harder. The Ninth Circuit decided that the shopper, not Perplexity, was the one using Amazon’s servers when Comet’s AI assistant shopped for them.
• Website terms still count. The ruling does not stop Amazon from controlling access through its terms of service.
• The stakes are large. McKinsey estimates U.S. B2C agentic commerce could reach up to $1 trillion in revenue by 2030.
• Identity beats labels. Bots made up 53% of internet traffic in 2025, and signed-agent standards are becoming the practical tool for AI agent access control.
• Oversight pays off. Only about 6% of companies are AI high performers, and they are far more likely than others to actively manage AI risks.

Introduction

Thales’s annual Bad Bot Report used to sort web traffic into good bots and bad bots. This year, it added a third group: AI agents.

AI shopping agents are a big reason why. They work inside a real person’s browser and shop for what that person asks for.

On August 4, 2026, in the Amazon Perplexity lawsuit, the U.S. Court of Appeals for the Ninth Circuit cancelled a preliminary injunction that would have kept Perplexity’s Comet assistant off Amazon.com. On September 10, it refused to rehear the case with its full bench. So what should a good AI bot policy look like now?

What the Court Decided

The case turned on one question: who “accessed” Amazon’s computers? According to the published opinion, Comet sends screenshots of the user’s browser to Perplexity’s servers, which reply with where to click. Based on the record, Perplexity’s servers never talked to Amazon’s servers directly.

Judge Milan D. Smith Jr. explained that the CFAA punishes a person who accesses a computer, and an AI assistant is a tool. So Amazon was unlikely to win under the Computer Fraud and Abuse Act (CFAA) or under California’s similar law, the CDAFA. The court also found Amazon’s evidence of harm weak and warned that blocking the tool would “impair consumer choice and needlessly limit development of a nascent technology.”AB

What the court left open

For anyone following AI shopping agent regulation, the ruling is narrow. It:

• Does not stop Amazon from controlling access through its terms of service (footnote 5).
• Does not create new rules for AI agents.
• Leaves open cases with different facts, such as an agent that reaches a store’s servers directly.
• Does not settle other claims, such as tort claims.

Amazon has since filed an amended complaint saying Comet posed as a human to get past its blocks.

Why This Matters to Retailers

The real fight is over who owns the customer when software shops. McKinsey estimates that agentic commerce could drive $900 billion to $1 trillion in U.S. B2C retail revenue by 2030. Shoppers are already changing their habits: 44% of people who have tried AI-powered search now prefer it, compared with 31% who prefer traditional search.

• Sales: Agents may become the new gatekeepers of commerce, so products must be easy for agents to find.
• Security: In the Amazon case, the agent worked inside password-protected customer accounts that hold payment details and delivery addresses.

The Thales 2026 Bad Bot Report found that bots made up 53% of internet traffic in 2025, and harmful bots alone made up 40%. Retail was the top target of AI-driven bots. Generative AI in e-commerce is no longer just a chatbot on a website. It is a new kind of visitor that retail website security teams must plan for.

So, Can Stores Still Block AI Shopping Agents?

Yes. The ruling made one path harder: suing an AI company under anti-hacking laws. It did not take away a store’s technical tools or its contracts.

Relying only on the threat of a lawsuit is now the weakest plan. AI agent access control has to be written into a site’s terms and built into its systems. Companies should check any legal strategy with a lawyer.

The Detection Problem

Stores can only enforce rules against traffic they recognize. The court’s opinion says the heart of the conflict was Perplexity’s choice not to use a user-agent string that would show an AI agent was active. Whether Perplexity changed that label on purpose is still disputed.

Labels are easy to fake. In August 2025, Cloudflare reported that when Perplexity’s declared crawler was blocked, a hidden crawler posing as Chrome on macOS made another 3 to 6 million requests a day. Perplexity disputed the claims. Here, AI web scraping and AI shopping look alike, though their value to a store differs.

Since harmful bots now use real browsers and residential proxies, Thales says IP addresses and user-agent labels no longer work well as signals. A better answer is cryptographic agent identity, a signature that is very hard to fake. Visa’s Trusted Agent Protocol was built with Cloudflare and lines up with Web Bot Auth. It lets approved agents sign their requests.

From Blocking to Managing: A Simple AI Bot Policy

McKinsey says stores must decide when and how to welcome agentic traffic. A policy you can enforce has five parts:

1. Sort traffic by identity: signed agents, declared bots, and hidden automation.
2. Update your terms: require agents to identify themselves and ban disguised bots.
3. Give trusted agents a better entrance: Clean product data, agent-ready APIs, and tokenized checkout reduce AI web scraping of the storefront.
4. Add checks at risky moments: logins, checkout, and address changes need shopper approval.
5. Measure agent traffic: track the sales and fraud that agents bring.

This turns e-commerce bot management from a simple filter into a permission system.

The ROI View

Handling agents is really a decision about AI investment and its return (ROI). In McKinsey’s State of AI in 2026 survey of 1,719 people, only 37% said AI had any effect on EBIT, a common profit measure, unchanged from 2025. Among companies with more than $1 billion in revenue, 40% report scaling AI agents, up from 27%, while smaller companies stayed at 22%.

Only about 6% of respondents qualify as AI high performers. Compared with everyone else:

• Nearly 3 in 4 have fully redesigned how work gets done, versus about 1 in 4.
• They are more than 3x more likely to be scaling agents across most business areas.
• They are much more likely to work to prevent unauthorized AI actions.

Governance is where many companies fall short. Deloitte’s State of AI in the Enterprise 2026 found that only one in five companies has mature oversight of AI agents. Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027.

Conclusion: Bot Policy Is Now Business Strategy

The Amazon Perplexity lawsuit now returns to the trial court in Northern California, and Perplexity says it will keep fighting for people’s right to choose their own AI. The Ninth Circuit did not give AI agents a free pass, but it signaled that anti-hacking law cannot reliably police agents acting for real users. That puts the weight on a clear AI bot policy. Blocking alone means giving up a channel McKinsey values at $3 trillion to $5 trillion worldwide by 2030.

The winners in generative AI in e-commerce will rethink the whole process, making their sites easy for trusted agents to use and for security teams to verify.

Your AI tools are only as powerful as the workflow they’re built into.

The brands seeing the strongest returns from AI aren’t just using better tools. They’re running smarter systems. While 88% of organizations have adopted AI in some capacity, only 6% are achieving the kind of transformative results that actually move revenue. The difference isn’t access. It’s architecture.

Turning customer data into actionable marketing insights requires more than automation. It requires a content and campaign infrastructure where AI works across the full pipeline: from audience intelligence and personalization to content production, deployment, and performance measurement. Brands that have built this kind of integrated system are already seeing $3.70 returned for every dollar invested in generative AI, and 73% of their customers feeling genuinely understood rather than just targeted.

Makebot’s AI Strategic Whitepaper Vol.02, From Scattered AI to a Single Core: CX·EX Innovation with a Unified Intelligence Core, takes this idea beyond bot policy. It argues that the AI performance gap comes from the operating model rather than the model itself, and that Human-in-the-Loop should be the standard way AI work is executed. AI proposes, and people approve at clear control points. That is the same principle behind requiring shopper approval at login, checkout, and address changes. For teams deciding how far to trust AI agents, download the whitepaper for a practical framework for managed autonomy.

MagicSuite is built for marketing teams ready to move from isolated AI experiments to a fully connected content operation. Whether you’re looking to tighten your data-to-insight loop, scale personalized content without scaling headcount, or finally get consistent ROI from your AI investment, MagicSuite gives your team the infrastructure to make it happen. This is how the 6% are built.

Start building your AI-powered content system with MagicSuite