Your Terms of Service Were Not Written for AI Agents

This post is informational and reflects the state of the law as of September 2026. For your situation, consult a licensed attorney.

If you run a website or a platform, the Ninth Circuit has told you where your leverage over AI agents actually sits, and it is not the Computer Fraud and Abuse Act.

In amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), the panel held that an AI agent is “a tool, not a person for statutory purposes,” which put the CFAA out of reach against the agent’s vendor on that record. The court’s own footnote is the part worth pinning up:

“This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.”

So the contract is the lever that survived. The problem is that terms written before agentic browsers existed tend not to reach agents at all. The repairs are more specific than adding a clause about AI.

1. Bind the person you can actually bind

You cannot bind an operator whose servers never touch yours and who never accepted anything. You can bind the account holder who did.

Say that access rights are personal and non-delegable, that pointing an agent at the service counts as the user’s own access, and that the user answers for what the agent does. The remedy then runs against an account you can suspend, which is a remedy you can actually exercise.

Note the limit honestly: this only reaches agents riding a logged-in session. On public pages there is no counterparty at all.

2. Fix how the AI restriction reads

A prohibition on using your content to “train” a model misses a retrieval agent entirely, because nothing gets trained. The agent reads the page, passes it to a model, and produces an answer. No weights change.

Reaching that conduct takes language about use as input to or output from an AI system, including retrieval and inference, whether or not any model is trained or modified.

3. Check your survival clause

This is the one almost nobody checks. If your automated-access section says that a violation results in immediate account termination, and your survival clause does not name that section, then the breach kills the provision that gives you the damages.

Adding a section renumbers everything below it. Survival clauses are exactly where renumbering goes unnoticed, because nobody rereads them after a routine amendment.

4. Require agents to identify themselves

The case itself is the argument for this one. Per the opinion’s own background, a core part of the dispute was Perplexity’s decision not to send a user-agent string, “a mechanism ‘that would communicate that the user has activated an AI agent,’” which would have let Amazon block the Assistant.

Terms can require automated access to declare itself, and make concealment its own breach. That converts a detection problem into a contract claim, which is a considerably better position than arguing about statutory access.

The two questions are different

The statutory question turned on whose machine made the request. The contract question turns on who agreed to the terms, and for an agent the answer can be nobody.

That is not a reason to skip the drafting. It is the reason to do it deliberately, and to be clear-eyed about which surfaces your terms actually cover.

One caution on scope: the panel was explicit that it did “not establish a new legal regime governing agentic AI” and did not address other theories, including tort claims. This was a preliminary-injunction ruling on a particular record, and the litigation continues.

If your terms of service predate agentic browsing, talk to MB Legal about what they currently reach. See also AI agents and the CFAA, contracting with agentic AI vendors, and the firm’s technology transactions practice.

This post is informational and does not constitute legal advice. The cited decision is a preliminary-injunction ruling and the litigation is ongoing. For guidance on a specific situation, consult a licensed attorney.