AI assistants are changing how consumers shop online.
But a recent conflict between Amazon and Meta raises an important legal question:
Can an AI assistant shop on a website without the company’s permission?
On September 20, 2026, Amazon blocked Meta’s new AI assistant, Muse, from making purchases on Amazon.com.
Amazon argues that Muse accessed its marketplace without authorization, raising concerns about customer privacy, security and compliance with its terms of use.
The move could have significant consequences for AI developers and online retailers.
As automated shopping becomes more common, questions surrounding data protection, third-party access and contractual rights are becoming harder to ignore.
What Happened?
Meta launched Muse on September 8, 2026, as an AI assistant capable of completing tasks on behalf of users.
Unlike traditional chatbots, Muse can browse websites, compare products and help consumers make purchases.
This technology is commonly known as agentic AI.
Rather than simply recommending products, these tools can take steps toward purchasing them with the user’s approval.
But Amazon says Meta never received permission to operate this way on the online retailer’s website.
The retailer reportedly raised concerns that Muse failed to identify itself when accessing Amazon.com and appeared to collect or store customer credentials.
Meta maintains that its assistant cannot view users’ passwords or payment information and that credentials are securely stored.
Amazon nevertheless blocked the service.
Customers attempting to shop through Muse received a warning that unauthorized AI agents violated Amazon’s Conditions of Use.
Why Does This Matter?
The conflict highlights an important distinction between consumer authorization and platform permission.
Meta’s technology makes it more convenient for its users to shop. But Amazon argues that outside AI services must follow its rules.
A user may authorize an assistant to make a purchase, but that authorization does not override a website’s terms and conditions.
For developers, these two distinctions are separate considerations. Understanding the difference could become increasingly important as automated tools handle more commercial transactions.
The Legal Battle Over AI Agents
Amazon’s confrontation with Meta is not its first attempt to restrict third-party shopping assistants.
The company previously sued Perplexity over its Comet browser, which allows users to make purchases through AI.
In March 2026, Amazon obtained a preliminary injunction restricting Perplexity’s access.
However, the Ninth Circuit overturned that injunction in August.
The appeals court concluded that Amazon had not established its theory of unauthorized access under federal computer-hacking law because customers themselves authorized the activity.
But that ruling did not resolve every issue surrounding the technology.
Contractual claims involving website terms of service remain a potential avenue for litigation. Amazon’s reliance on its Conditions of Use when blocking Muse reflects that distinction.
This controversy extends beyond whether automated software can legally enter a website. It also concerns whether doing so violates enforceable agreements.
Who Controls the Customer Relationship?
The disagreement goes beyond website restrictions.
Online retailers invest heavily in advertising, product recommendations and customer engagement.
AI shopping assistants disrupts that business model.
Instead of browsing Amazon.com and viewing sponsored products, a shopper might direct an automated service to find the best price and complete a transaction.
Such bot interaction completely bypasses any advertising, product recommendation, or active engagement from the customer. That person may never interact directly with the retailer’s website.
For companies that depend on advertising revenue and customer relationships, this shift could have substantial financial consequences.
What Businesses Should Consider
The Amazon-Meta conflict offers an important lesson for companies developing or integrating AI agents.
Technical capability does not automatically establish legal permission.
Businesses should evaluate contractual and regulatory risks before launching tools that interact with third-party websites.
That includes reviewing website terms of use, privacy obligations, cybersecurity practices and applicable agreements governing how AI agents interact with third-party platforms.
Companies should also consider who bears responsibility when an automated service makes an incorrect purchase, mishandles sensitive information or violates a site’s restrictions.
These issues can create exposure under consumer protection legislation, privacy regulations, and contract law.
Romano Law advises businesses on technology-related matters, contract negotiation, regulatory compliance and commercial disputes.
For companies entering this emerging field, clearly defining operating rights and responsibilities can help reduce risk and uncertainty.
What Comes Next?
Amazon and Meta’s disagreement reflects a broader challenge facing the technology industry.
AI agents can now perform tasks that previously required direct human interaction. But almost all existing laws were not designed for software that independently navigates websites and completes transactions.
Courts may increasingly be asked to determine how computer access statutes, consumer protection rules, and contract law apply to these services.
For businesses, the message is clear: Just because a website grants access to an individual user does not mean it automatically authorizes an AI assistant to access its platform on that user’s behalf. Companies
should ensure they have the necessary permissions before deploying AI agents that interact with third-party websites.
As agentic commerce expands, balancing innovation with contractual restrictions and marketplace realities will become increasingly important.
Contributions to this blog by Kennedy McKinney.
