An AI assistant can compare flights, shop for a product and inspect a bank balance. Whether it may act on a third-party website is a separate question. Amazon’s fight with Perplexity, Chase’s agent-specific terms and travel-platform restrictions reveal the next challenge for the agentic web: establishing who the agent represents, what it may do and who answers when something goes wrong.
Quick Take
- Amazon: Amazon has objected to Perplexity’s Comet agent shopping on its marketplace. An appellate court vacated a preliminary injunction against Perplexity in August 2026; the decision has a limited legal scope.
- Banking: Chase’s website terms impose identification and conduct requirements on AI agents and reserve its ability to restrict access. Chase also offers controlled third-party data sharing.
- Travel: Airbnb’s consumer terms prohibit automated interaction with its platform; Delta’s agent code restricts scraping its websites; Expedia offers partner APIs and is building AI travel tools.
- The real shift: A user request alone does not supply an identity, integration or reliable permission system for every website. The emerging answer is verified agents and explicitly authorized access.
What Is the Agentic Web Collision?
Most of the web was built for people using browsers, for search engines collecting public pages, and for business partners with contracts and APIs. An AI web agent introduces a different visitor: software acting on a user’s instructions, potentially navigating logged-in pages, selecting products or changing reservations.
That creates a collision between two reasonable aims. A customer wants an assistant to complete a legitimate task; a website wants to know which software is touching an account and whether it is allowed to browse, transact, store data or reuse content. A product-search crawler, a model-training bot and an agent that buys a ticket are different operations. Treating all three as the same kind of traffic hides their different risks.
Cloudflare’s 2026 AI-traffic controls reflect that distinction by grouping search, agent and training traffic separately. This is a useful framework for the broader debate: sites may want customers to discover their products through AI while withholding access to account actions or bulk data collection.
Amazon vs. Perplexity: Who Gets to Shop on a User’s Behalf?
Amazon said it had repeatedly asked Perplexity to remove Amazon from the Comet shopping experience. Amazon argued that third-party purchase assistants should identify themselves and respect a retailer’s choice to participate. That is Amazon’s position, not a general legal rule.
The court history matters. A district court granted Amazon a preliminary injunction in March 2026. On 4 August 2026, the U.S. Court of Appeals for the Ninth Circuit vacated that injunction and sent the case back. On the record before it, the appeals court concluded that the user, aided by Comet, accessed Amazon’s computers for purposes of the specific computer-access statutes at issue. The court expressly said it was not creating a general legal regime for AI agents or deciding other possible claims.
Here is the business question beneath the lawsuit: a retailer may lose control over how products are presented, how ads are measured, which recommendations appear and how checkout issues are resolved when another company’s assistant becomes the primary interface. Those possible commercial effects are analysis, not findings from the court. An agent provider, meanwhile, can argue that customers should be able to use their chosen tools to navigate the accounts they own.
The practical lesson is narrower than “all agents are banned” or “all agents are allowed.” Browser automation, contractual access, account security and user authorization are different questions. The Amazon ruling addressed a preliminary injunction under particular computer-access laws and facts.
Why Banks Place More Conditions on AI Agents
A banking agent may read balances, inspect transactions or eventually initiate payments. Errors can expose sensitive financial data or create real losses. It is understandable that banks want to know whether activity comes from a person, an authorized application or an unidentified program running inside a browser.
JPMorgan Chase’s website terms explicitly address AI agents. They require agents to identify themselves, label agentic traffic, follow the terms and stop interacting if Chase asks them to. Chase also says it may limit or prevent access through technical measures. These are conditions on access; the terms do not say that every authorized integration is prohibited.
There is also a path for customer-approved data sharing. Chase’s Data Security Center announcement describes a phased rollout allowing customers to review connected apps, adjust permissions and unlink access. An illustrative Chase developer flow shows customer consent for sharing data with an approved third-party application. Reading account data through an authorized connection is a different activity from giving an unrecognized browser agent full account control.
For builders, the key design problem is limited, revocable authority: Can the agent see only the needed account? Can it act only within a specified task? Will the customer confirm a transfer before execution? Can the bank and customer identify what happened afterward? These are design questions; product availability and permitted actions depend on the actual bank and integration.
Travel Websites Are Drawing Their Own Boundaries
Travel agents need up-to-date availability, fares and booking rules. A missed baggage fee, a duplicate reservation or an incorrect cancellation can turn a convenient demo into a costly customer-support case. Different travel companies have responded in different ways.
Airbnb’s consumer terms say users must not use bots or other automated means to access, collect from or interact with its platform. Its API terms describe a separate approved partner program with security reviews and usage conditions. That distinction is more informative than assuming Airbnb opposes all software integrations.
Delta’s December 2025 code of conduct for travel agents outside North America prohibits agents covered by that document from using scraping tools or automated algorithms to extract data from Delta websites. This is a travel-industry agent policy; the word “agent” there primarily refers to a travel seller, so it should not be mistaken for a standalone universal rule about every consumer AI assistant.
Expedia illustrates another route. Its Rapid API supports approved booking integrations, and its developer hub invites work on AI travel capabilities. An API partnership gives the platform a way to govern inventory, pricing, customer service and data use while still participating in AI-driven discovery.
Amazon, Banks and Travel Sites: What Do Their Policies Actually Show?
| Example | Documented approach | What an agent builder should check |
|---|---|---|
| Amazon | Objected to Comet shopping access; its preliminary court win was later vacated on appeal. | Current permissions, identification requirements, applicable terms and the limits of the court decision. |
| Chase | Allows agent activity only subject to specific terms; offers controlled connected-app data sharing. | Approved access route, user consent, available permissions, revocation and transaction controls. |
| Airbnb | Consumer terms restrict automated platform interaction; partner API access has separate conditions. | Whether the use case qualifies for an approved integration. |
| Delta | Its published travel-agent code restricts automated website data extraction by covered agents. | Which distribution agreement, region and booking channel apply. |
| Expedia | Publishes travel partner APIs and describes planned AI travel solutions. | API eligibility, inventory rights and fulfillment responsibilities. |
These examples show distinct policies, not a shared industry-wide ban. They also show why a working browser script is not the same thing as an approved commercial integration.
What Should an Agent’s “Passport” Contain?
For an agentic web to function at scale, a site needs more information than a browser user-agent string claiming to be “human.” A workable access layer would tell the site which agent is visiting, which user authorized it, what actions it may take and when that authority expires.
- Verifiable identity: identify the software provider and distinguish it from anonymous automation.
- Permission by task: allow price comparison without automatically permitting checkout or account changes.
- Customer confirmation: require an explicit final decision for a payment, booking, transfer or cancellation.
- Technical limits: use rate controls, session expiry and narrowly scoped credentials.
- Audit and recovery: record what was requested, what the agent did and how a person can reverse or dispute it.
This is an architectural proposal, not a single deployed standard. Pieces already exist: Cloudflare’s signed-agent classification aims to identify user-directed agents, while Visa’s Trusted Agent Protocol aims to help merchants recognize approved shopping agents during a transaction. Neither one, by itself, grants universal permission to browse or buy from every website.
What This Means for Companies Building AI Agents
Start with an authorized route for each task: a bank data-sharing connection, a retailer partnership or a travel supplier API where available. Where there is no approved route, treat the gap as a product and business-development constraint. Disguising automated traffic as a person can create security and trust problems and may conflict with the site’s terms.
Separate read-only discovery from consequential action. A tool that compares public prices has a different risk profile from one that logs in, buys a nonrefundable flight or changes a payment instruction. Test both the ordinary flow and failures: expired sessions, changed prices, captchas, misleading page content, duplicate submission and interrupted confirmation.
Give the customer clear control over which sites are connected, which data leaves a site and when the connection ends. In the EU, personal-data processing should be assessed against GDPR principles, including a lawful basis, purpose limitation, data minimization and security. Evaluate EU AI Act duties against the actual system and use case; a travel search assistant, an account-access tool and an application used for regulated decisions need separate assessments. User consent to access an account does not automatically license an agent to reuse a website’s copyrighted text, photos or product descriptions.
Will the Open Web Survive AI Agents?
It can, if sites have a meaningful way to accept useful agent traffic without accepting every automated request. Agents can bring customers to merchants and help people use complex services. Sites can also insist on clear identification, sensible limits and reliable dispute handling.
Three signals will matter over the next year: whether more platforms publish partner access rules for agent actions; whether identity and customer permission become portable across providers; and whether real users can fix a failed purchase or booking without navigating several companies’ support systems. The likely result is selective access, negotiated by task and trust level, rather than an internet that is uniformly open or uniformly closed to AI agents. This is an inference from the different approaches documented above.
MaGeN-AI View
The Takeaway
The agentic web is colliding with existing rules for accounts, content and payments. Amazon’s Comet dispute tests a narrow legal question; Chase’s agent terms show the demand for identification; travel companies show that approved integrations can coexist with restrictions on automated website use. An AI agent becomes a dependable customer interface when people, sites and developers can agree on identity, permission and accountability for each action.
Frequently Asked Questions
Why are websites blocking AI agents?
Sites restrict unauthorized automation to protect accounts, control bot traffic, protect content, and preserve reliable transactions. Policies vary by website and by the kind of agent.
Does Amazon ban every AI shopping agent?
No blanket conclusion follows from its dispute with Perplexity. Amazon objected to Comet shopping on its site. An appeals court vacated a preliminary injunction in August 2026, and the litigation did not establish universal rules for agents.
Can an AI agent access a bank account with the customer’s permission?
Customer permission matters, but access must also satisfy the bank’s applicable terms and approved security flow. Chase’s website terms require agent identification and let the bank restrict access.
Do travel sites allow AI booking agents?
Rules differ. Airbnb restricts automated access under its terms, Delta restricts scraping by travel agents under its code of conduct, and Expedia offers partner APIs and AI solutions. An approved integration is different from automating an ordinary consumer page.
What is the safer way to build an agent for shopping, banking or travel?
Use an authorized API or partner route, identify the agent, obtain narrow customer permission, limit access to the task, ask for confirmation before consequential actions, and keep an auditable record.
