The Ninth Circuit's August 4 decision in Amazon.com Services, LLC v. Perplexity AI, Inc. draws one of the first appellate lines around agentic AI and computer access law.

The immediate holding is narrower than the headlines make it sound. The court vacated a preliminary injunction that had blocked Perplexity's AI-enabled browser assistant from interacting with Amazon on users' behalf. The panel said Amazon was unlikely to succeed, on the record before it, in showing that Perplexity itself "accessed" Amazon's computers within the meaning of the federal Computer Fraud and Abuse Act and California's parallel statute.

That is not a general license for AI agents to operate on third-party platforms. The opinion instead suggests that, for purposes of the CFAA's access element, some user-directed AI activity may be treated as the customer's use of a tool rather than the tool provider's own entry into a platform's computers.

What the Fight Was About

Amazon's theory was straightforward. Perplexity's Assistant, an optional feature in its Comet browser, could use a customer's Amazon session to browse and carry out tasks on the user's behalf. Amazon said Perplexity lacked permission for that activity under the CFAA and California's Comprehensive Computer Data Access and Fraud Act. Central to the dispute was Perplexity's decision not to use a user-agent string that would identify the Assistant and allow Amazon to block it.

The district court had granted Amazon a preliminary injunction in March. The Ninth Circuit vacated that order and sent the case back.

The key question was easy to state and harder to answer: when a user tells an AI agent to act on a website, who is doing the "accessing" for computer fraud purposes?

Why the Ninth Circuit Matters

The Ninth Circuit answered that question narrowly, based on the technology and record before it.

The panel concluded that the user accessed Amazon's computers with the Assistant's help. Perplexity's servers received browser screenshots and sent instructions back to the Assistant, but did not directly communicate with Amazon's servers. Those facts did not show that Perplexity itself had gained entry to Amazon's systems, the court reasoned.

That reasoning matters because Amazon's CFAA claim required proof that Perplexity accessed a protected computer. The panel did not reach authorization or the statute's remaining elements, including its loss requirement.

The same user-versus-provider question is likely to arise again as AI agents move from answering questions to logging in, navigating sites, filling forms, pulling account data, and initiating transactions.

This Is Bigger Than One Shopping Dispute

Amazon v. Perplexity does not resolve agentic AI access disputes. It shows courts beginning to decide how older computer access laws apply when software takes multiple steps at a user's direction rather than waiting for each click.

That problem is not limited to e-commerce. The same legal tension can show up in:

• enterprise automation tools that log into third-party services on behalf of employees;
• consumer AI assistants that navigate password-protected sites;
• browser-based agents that compare products, prices, or terms across platforms;
• internal legal and compliance tools that automate retrieval from external systems; and
• research workflows that rely on user-authorized scraping or session-based access.

The Knight First Amendment Institute, joined by the ACLU and ACLU of Northern California, raised another concern in an amicus brief: reading the CFAA too broadly could chill journalism and public-interest research that depends on automated tools operating with user-provided access.

The argument does not immunize researchers or AI vendors, but it shows why the stakes extend beyond this dispute.

What Companies Should Take from It

The safest reading is not "AI agents are fine now." It is that the technical path matters: who directs the tool, which computers communicate, where data goes, and how much control the provider exercises. Although user direction was important to the panel's access analysis, the opinion did not decide whether a user's permission would defeat a platform's authorization argument.

For companies building agentic products, a few practical questions now look more important:

• Is the agent acting with clear, documented user authorization?
• Does the product rely on the user's own credentials and permissions, or does it bypass technical controls?
• What signals does the system send to the platform about the nature of the interaction?
• Does the workflow create separate data-use, contract, privacy, or state-law risk even if the CFAA theory weakens?
• How much of the task is user-directed versus autonomously optimized by the vendor?

For platforms, the decision shows the difficulty of a CFAA claim when the record depicts the user, rather than the tool provider, as entering the platform's systems. Contract claims, technical controls, API design, bot-detection systems, privacy arguments, and data-use restrictions may still matter.

Why Clearon Readers Should Care

This case sits at the intersection of AI product design, litigation risk, and platform governance.

Agentic AI marketing often assumes that if a user can do something, an AI agent can do it without changing the legal analysis. The Ninth Circuit did not endorse that broad claim. It instead held that Amazon was unlikely, on the current record, to prove that Perplexity was the party that accessed its computers.

That is an important early signal for legal teams reviewing AI assistants that operate inside customer accounts or interact with third-party services.

Future disputes are therefore likely to turn on details: credentials, disclosure, technical barriers, autonomy, data handling, system architecture, and the relationship among the user, vendor, and platform.

Bottom Line

Amazon v. Perplexity is one of the first appellate opinions to test how the CFAA applies to agentic AI.

The Ninth Circuit did not give AI agents blanket immunity. At the preliminary-injunction stage and on the record before it, the court held that Amazon was unlikely to show that Perplexity "accessed" Amazon's systems when the user accessed them with the Assistant's help.

That is a meaningful development for AI companies, platforms, and in-house legal teams.

The next question is whether other courts follow the same user-versus-tool framing, or whether different facts push them toward a narrower view of what agentic systems can do inside someone else's digital environment.

Sources and Related Clearon Coverage

• Ninth Circuit opinion in Amazon.com Services, LLC v. Perplexity AI, Inc.
• Knight First Amendment Institute case page
• Ropes & Gray analysis via RopesDataPhiles
• Cooley summary of the Ninth Circuit ruling
• Reuters report on the dispute and oral-argument framing

California's AI Transparency Act is in force, but a lot of quick summaries still flatten it into something simpler than it is.

That is a problem because the law matters, and it arrives in stages.

If a company walks away with "California now requires AI labels," it will miss the more useful question: which entities have duties now, which entities pick them up later, and what technical or workflow evidence should already exist before anyone starts asking more exacting compliance questions.

That is the frame worth using now.

The Statute Is Live, But Not All At Once

The original California AI Transparency Act came from SB 942. AB 853 amended it before the law took effect and expanded the structure.

The result is not one date with one compliance moment.

The staged dates matter:

• covered-provider duties and the chapter's general enforcement provisions became operative on August 2, 2026;
• large-online-platform and GenAI-hosting-platform duties become operative on January 1, 2027; and
• capture-device-manufacturer duties become operative on January 1, 2028, for covered devices first produced for sale in California on or after that date.

Some companies are already inside the law. Others should be using the current window to prepare instead of treating the statute as a future issue.

Who Is Covered Right Now

The present-tense obligations fall first on a covered provider.

California defines that term to reach a person that creates, codes, or otherwise produces a generative AI system with more than 1,000,000 monthly visitors or users that is publicly accessible in California.

That threshold matters because it narrows the immediate field. Not every company using generative AI is covered today. Not every enterprise deploying internal tools is covered today either.

But for the companies that do clear that threshold, this is not mainly a statement of transparency values. It is a set of tooling and content-handling duties.

The chapter also excludes products, services, internet websites, and applications that provide exclusively non-user-generated video game, television, streaming, movie, or interactive experiences. That carveout matters when companies try to analogize every media product into the statute.

What Covered Providers Have To Do

The first major duty is an AI detection tool.

The law requires a covered provider to make available, at no cost, an AI detection tool that allows users to assess whether image, video, audio, or combined content was created or altered by that provider's GenAI system. The tool must output any system provenance data detected in the content, must not output detected personal provenance data, must accept an upload or URL, and must support an API. It must be publicly accessible, although reasonable access limits are permitted to address demonstrable risks to the system's security or integrity. Covered providers must also collect efficacy feedback and comply with restrictions on collecting or retaining user information, submitted content, and personal provenance data.

That is already a substantial operational requirement. This is not just a disclosure sentence in a terms-of-use page.

The second major duty is disclosure.

Covered providers must offer users the option to include a manifest disclosure in image, video, audio, or combined content created or altered by their GenAI systems. That disclosure must identify the content as AI-generated, be clear and conspicuous, and be permanent or extraordinarily difficult to remove to the extent technically feasible. Providers must also include a latent disclosure in AI-generated covered media created by their systems. To the extent technically feasible and reasonable, that disclosure must convey the provider name, system name and version, creation or alteration date and time, and a unique identifier, either directly or through a permanent website link. It must also be detectable by the provider's detection tool, consistent with widely accepted industry standards, and permanent or extraordinarily difficult to remove to the extent technically feasible.

The law also pushes into licensing relationships. If a covered provider licenses its system to a third party, the provider must require by contract that the licensee preserve the system's latent-disclosure capability. If the provider knows the licensee modified the system so that capability no longer exists, the provider must revoke the license within 96 hours. A licensee must stop using the system after a revocation under that provision.

That piece is easy to miss, but it matters. California is not only regulating outputs. It is also reaching contractual controls and downstream system integrity.

What AB 853 Changed

AB 853 made this a broader statute than the original SB 942 version many people still have in mind.

Beginning January 1, 2027, qualifying large online platforms must detect standards-compliant provenance data, disclose its availability and specified authenticity information through a user interface, permit users to inspect available system provenance data, and, to the extent technically feasible, refrain from knowingly stripping compliant system provenance data or digital signatures. On the same date, GenAI hosting platforms may not knowingly make available systems that fail to place the disclosures required by Section 22757.3. Beginning January 1, 2028, capture-device manufacturers must offer and enable by default specified latent disclosures for covered devices first produced for sale in California on or after that date, subject to technical-feasibility and standards-compliance conditions.

Companies should stop relying on any summary that still says the whole law simply took effect on January 1, 2026. That is outdated. Companies that are not yet directly covered by the August 2026 provider duties may still be moving into the law's later phases. If they wait until late 2026 or late 2027 to think seriously about provenance, labeling, or product controls, they are likely already behind.

The Real Compliance Work Is Technical And Procedural

The practical challenge here is not writing one good disclosure sentence.

It is proving that the right information survives the actual distribution path.

Companies should be asking questions like these now:

• Which systems generate image, video, or audio outputs that may fall inside the statute?
• What provenance or metadata is currently attached to those outputs?
• Does that data survive export, reposting, resizing, transcoding, or partner distribution?
• Can the company actually detect its own output reliably through a free user-facing tool?
• If the system is licensed out, where is the contractual requirement preserving latent disclosure capability?
• What happens when a downstream user strips, breaks, or disables provenance markers?

Those are engineering, product, legal, and vendor-management questions at the same time.

That is also why this law matters. It forces a more operational version of AI transparency than a lot of commentary admits.

What Records Companies Should Keep

The statute does not prescribe a general recordkeeping program. As a compliance and defensibility measure, however, a company that may be covered now or later should document its scope analysis and implementation work.

At a minimum, that record should include:

• system inventory for covered media-generation tools;
• monthly-visitor-or-user basis for any threshold analysis;
• detection-tool design and testing records;
• provenance and disclosure specifications;
• documentation showing whether manifest and latent disclosures are technically feasible in each workflow;
• API availability and user-access controls for the detection tool;
• contract terms for licensed systems;
• incident or exception handling when provenance is stripped, broken, or unavailable; and
• decision logs for scope calls, especially where the company concluded a system or workflow was outside the statute.

That kind of documentation matters because California's law is enforceable through civil actions, even though the statute does not itself create a general recordkeeping section.

The Penalty Structure Should Get Attention

The statute authorizes a civil penalty of $5,000 per violation, enforceable by the Attorney General, a city attorney, or a county counsel. Each day of noncompliance is a discrete violation for a covered provider, large online platform, or capture-device manufacturer. The statute separately provides an injunctive remedy and fees and costs for a third-party licensee's failure to cease using a revoked system.

That does not automatically mean immediate aggressive enforcement. It does mean the law should not be treated as symbolic.

The per-day structure is exactly the kind of thing that makes delayed operational fixes more expensive later.

What Companies Should Do Now

The short version is simple.

If you are clearly a covered provider, this should already be implementation and validation work.

If you are more likely to be affected by the January 2027 or January 2028 phases, use the current window to map systems, test provenance behavior, and clean up any workflow that assumes transparency can be bolted on at the last minute.

The best immediate steps are:

1. Identify which products and workflows generate image, video, or audio content that may be covered.
2. Confirm whether any system crosses the current monthly-user threshold.
3. Test whether provenance data survives the real channels where content is shared.
4. Review whether a free user-facing detection tool and API are actually ready.
5. Check license agreements and downstream controls for any third-party distribution of the system.
6. Build a written record of scope, exceptions, testing, and fixes.

Bottom Line

As of August 2, 2026, the covered-provider provisions are operative and should be treated as current compliance requirements.

The deeper point is that this statute is not mainly about slogans like "AI-generated content should be labeled." It is about whether a company can produce working detection tools, persistent provenance, durable disclosures, and defensible records across real content workflows.

That is where the compliance work actually is.

Sources

• California SB 942 bill text
• California AB 853 bill status
• California AB 853 bill text
• Clearon Laws, Bills & Regulations tracker

Minnesota's new nudification law is already in court.

That matters because the statute is broader than a simple downstream ban on abusive deepfake distribution. It targets covered nudification services at the tool layer, reaches realistic depictions of intimate parts not shown in the original image or video, and uses a liability structure that puts real pressure on the companies that build or offer those services.

The immediate headline is simple. xAI sued to block the law. The court refused to stop it on an emergency basis. So Minnesota's Chapter 72 is now live while the constitutional fight continues.

That is enough to make this one of the clearest current test cases for how far a state can go when it tries to impose liability on AI-enabled image tools themselves.

What Minnesota Actually Enacted

Minnesota's enacted law is Chapter 72, drawn from H.F. 1606.

The core operative section is new Minnesota Statutes 325E.91, titled PROHIBITION ON NUDIFICATION TECHNOLOGY.

The law defines "nudify" in a specific way. It covers altered or generated images or video that depict an intimate part not shown in the original image or video of an identifiable individual, where the result is realistic enough that a reasonable person would believe the intimate part belongs to that person.

That definition matters because the incorporated concept of an "intimate part" is broader than ordinary references to nudity. It reaches areas including the inner thigh, buttocks, groin, and breast. The statute is also not limited by an express consent requirement.

The prohibition is directed at the service layer. Under subdivision 2, a person who owns or controls a service may not:

• allow a user to access, download, or use a website, application, software program, or other service to nudify an image or video; or
• nudify an image or video on behalf of a user.

The statute also bars advertising or promoting a service that performs those actions.

At the same time, the law is not drafted as a universal ban on every image-editing capability that could be abused. Subdivision 3 excludes a service that requires user technical skill to nudify an image or video. That carveout will matter in any fight over how broadly the statute can reach practical product design choices.

That design choice is the important part. Minnesota did not just create a takedown rule or a disclosure rule. It wrote a direct prohibition on covered automated nudification functionality aimed at the service itself.

Why Companies Are Paying Attention

The penalty structure is severe enough to get attention even before any final ruling on the merits.

The law authorizes enforcement by the Minnesota Attorney General under section 8.31. In addition to other remedies, a violator is subject to a civil penalty of up to $500,000 for each unlawful access, download, or use under subdivision 2.

That is a very large number for a statute aimed at a consumer-facing tool category that can generate high-volume activity quickly.

But the Attorney General penalty is only part of the pressure. Subdivision 4 also creates a private cause of action for the depicted individual, including compensatory damages of up to three times actual damages, punitive damages, injunctive relief, costs, attorney fees, and other equitable relief.

The enacted text also routes collected penalties into victim-service funding through the Office of Justice Programs. That feature helps explain the statute's posture. This is being framed not as a labeling problem, but as a victim-protection and platform-liability problem.

The effective-date clause is also direct. Chapter 72 says the section is effective August 1, 2026, and applies to causes of action accruing on or after that date.

What xAI Is Challenging

According to the challenge as described in AP reporting and the emergency litigation, xAI does not deny the state's interest in addressing synthetic sexual abuse.

Its argument is narrower and more structural. The company says the law reaches too far, lacks a safe-harbor path for companies making good-faith efforts to block misuse, and sweeps in protected material because of how it defines the prohibited conduct.

That overbreadth framing matters because the challenge is not only about sexual deepfakes in the colloquial sense. xAI argues the statute lacks limiting elements such as consent, scienter, and purpose requirements, and can reach realistic altered imagery that is nonsexual, consensual, or otherwise protected.

That is a familiar pattern in AI litigation. The company is not arguing that the underlying harm is fake. It is arguing that the state's chosen regulatory mechanism is overbroad.

For Minnesota, the important point is that this challenge is not mainly about disclosure, watermarking, or post hoc removal. It is about whether a state can prohibit covered nudification functionality and tie that prohibition to very large per-use penalties and private civil exposure.

The First Court Ruling Matters, But Only In A Limited Way

The court has already made one important move, but it is easy to overread it.

In the July 31, 2026 order cited above, the District of Minnesota denied xAI's request for a temporary restraining order before the law took effect. The order emphasized timing. The court noted that xAI filed its emergency motion on July 29, nearly three months after the law was signed and only three days before the effective date. The court said that delay suggested the harm was not immediate.

That is a procedural loss, not a final merits ruling that the statute is constitutional.

Still, it matters in practice. It means Minnesota's law took effect while the litigation continues. It also means challengers to new AI laws can lose early if they wait too long to seek emergency relief, even when the underlying constitutional arguments remain open.

The same order also moved the case onto an expedited preliminary-injunction track, with Minnesota's opposition due August 12, xAI's reply due August 17, and a hearing set for August 19. So the procedural story is no longer just a TRO denial. The case is already in active merits-stage briefing over whether Chapter 72 can stay in force while the lawsuit proceeds.

Why This Case Matters Beyond Minnesota

This dispute deserves attention because it regulates a different part of the stack than many earlier AI laws.

Some AI statutes focus on disclosures. Others focus on impersonation or downstream misuse. Minnesota's nudification law is more direct about restricting access to covered nudification services themselves.

That makes the case useful for companies that operate image-generation, editing, or transformation systems, even if they do not market them for sexualized use.

The practical questions are concrete:

• How much misuse prevention is enough if a statute has no explicit safe harbor?
• How broadly can a state define a prohibited nudification category before ordinary editing, consensual uses, or protected depictions start to matter?
• When a law imposes penalties per access, download, or use, how does a court think about scale?
• Does the state's interest in preventing deepfake sexual abuse justify tool-level restrictions that go beyond after-the-fact takedown or civil remedies against users?

Minnesota has put those questions into a live case.

What Companies Should Do Now

Companies offering image-generation or image-editing features should not treat this as a Minnesota-only oddity.

Even if other states do not copy this exact statute, the enforcement logic is now visible. A state can try to move upstream from punishing bad actors to restricting covered automated functionality that can be used to generate abusive synthetic intimate imagery.

That means product teams should be reviewing:

• whether any feature can realistically be used to create realistic altered depictions of intimate parts of real people;
• what safeguards exist before image generation, editing, export, and sharing;
• whether abuse-prevention controls, product boundaries, and escalation rules are documented clearly enough to support a regulator, court, or internal response;
• whether the company has a defensible position on minors, consent, identity, and realistic depictions; and
• how quickly the company could respond if another state adopts a tool-access model instead of a narrower misuse model.

The legal issue here is not only whether a bad image can be removed later. It is whether a covered service can be offered in its current form under a state law aimed at the tool itself.

Bottom Line

Minnesota's Chapter 72 is one of the clearest new examples of a state trying to regulate AI-enabled synthetic intimate imagery at the platform-access level, not just at the takedown level.

xAI's early loss on emergency relief does not resolve the constitutional merits. But it does mean the law is in force while the fight continues.

That is enough to make this case worth close attention. If Minnesota's model survives, it may become a template for other states looking for a more aggressive way to regulate synthetic intimate-imagery tools.

Sources and Related Clearon Coverage

• Minnesota Chapter 72 enacted text
• Minnesota HF 1606 bill text
• District of Minnesota July 31, 2026 order denying temporary restraining order in X.AI LLC v. Ellison
• AP report on xAI's challenge to Minnesota's nudification law
• TechCrunch report on denial of xAI's request to block the law