The Ninth Circuit Court of Appeals has endorsed a commonsense technical interpretation of the Computer Fraud and Abuse Act (CFAA), a law not usually given to such interpretation. Amazon had sued Perplexity AI to try to shut down its Comet browser, claiming the browser’s optional agentic AI “Assistant” that can browse websites like Amazon for comparison shopping purposes, violated the CFAA because Amazon did not “authorize” Perplexity to access Amazon users’ accounts. Rejecting that theory, the Ninth Circuit held that Perplexity was unlikely to be liable because users operate the tool, not Perplexity.

That’s the right conclusion, as both a legal and technical matter. As we explained to the court in our amicus brief, the CFAA requires unauthorized “access,” and Perplexity itself does not access Amazon’s servers—users of the Comet browser do. The court agreed, noting that EFF’s explanation “articulates the nature of the system most clearly.”

The court noted that agentic AI may present novel legal issues, and there is “little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant, let alone caselaw specifically dealing with agentic AI in the CFAA context.” Ultimately, though, thorny questions of AI “intent” were irrelevant to this case, because the Assistant “is a tool, not a person for statutory purposes.” And, the court concluded, it is a tool operated by users, not Perplexity. Even where Perplexity received information from users about their Amazon accounts and used this information to instruct the Assistant, the court found that that did not constitute the sort of control needed to find access by Perplexity. As the court noted, Amazon might have other viable claims against Perplexity, but invoking the CFAA was both legally baseless and bad policy that “could expose users themselves to criminal liability. 

This is a gratifying decision because all too often, big players use the CFAA to bully upstarts and innovators who offer potentially helpful user tools. When we counsel clients as part of EFF’s Coders Rights Project, CFAA risk is a frequent topic of conversation, even for developers who merely create tools that allow others to access websites in new or different ways. We’ve stood up for these creators before, and we’ll do it again, but it’s helpful to have back up from one of the most influential appellate courts in the country.

You have an expectation of privacy in location data that reveals your movements in the physical world, and even short-term surveillance of these movements is a search subject to the Fourth Amendment, the U.S. Supreme Court ruled today in Chatrie v. United States.  

The case involved geofence warrants, a form of dragnet surveillance police have used to vacuum up location data from electronic devices of people who happen to be in the vicinity of a crime. EFF had joined the American Civil Liberties Union, the ACLU of Virginia, and the Center on Privacy & Technology at Georgetown Law in filing an amicus brief in the case. 

JOIN EFF

The decision in Chatrie is important: It is the first digital surveillance decision by the Court since its landmark 2018 ruling Carpenter v. United States, which involved prolonged tracking of people’s movements using cell phone location data. The new case expands that ruling by confirming that even shorter-term surveillance of location data can constitute a search because it can still reveal “private matters,” including “a wealth of detail about a person’s familial, political, professional, religious, and sexual associations.”  

The case is also important because the Court also recognized the records generated by the apps on a user’s phone—records we necessarily share with third-party tech company—are a user’s “own” and require Fourth Amendment protection. This is true, regardless of whether those records are “emails, documents, photographs, [ ] calendars” or location data. This will likely have broad implications for data generated by other apps on our phones, even if we click “agree” to sharing that data with third-party tech companies.  

Geofence warrants don’t name a suspect or a specific individual or device the way typical warrants do. Instead, they compel companies—almost always Google—to provide information on every electronic device in a given area during a given time period. This creates a high risk of suspicion falling on innocent people and can reveal sensitive and private information about where individuals have traveled in the past. 

Geofence warrants are the digital equivalent of police going person to person, home to home, without suspicion that any device holder has a connection to a crime. This turns innocent bystanders into suspects, just for being in the wrong place at the wrong time.  

In Chatrie, a 2019 geofence warrant compelled Google to search the accounts of all its hundreds of millions of users to see if any one of them was within a radius police drew around a Northern Virginia crime scene. This area amounted to several football fields in size and encompassed numerous homes, businesses, and a church. 

A federal district court in Virginia in 2022 held that the geofence warrant plainly violated  the Fourth Amendment. If the police want to get information on every device in the area, they must also establish probable cause to search every person in the area, the court said. The judge noted the government lacked particularized probable cause as to every individual within the geofence, which swept up innocent people and covered over 70,000 square meters in a busy area. 

The decision set an important precedent in finding the warrant overbroad and unconstitutional and was later followed by a 2024 federal Fifth Circuit Court of Appeals ruling holding that geofence warrants are “categorically prohibited by the Fourth Amendment.” However, the Chatrie lower court allowed the government to use the evidence it obtained because it relied on the warrant in “good faith.” A much divided en banc panel of the U.S. Court of Appeals for the Fourth Circuit in 2025 affirmed this “good faith” finding in the lower court’s opinion. 

Google in 2023 announced changes to how it stores location data, with the effect of eventually making it impossible for the company to respond to geofence warrants. Since July 2025, mass geofence searches of Google users’ location data have not been possible.  

However, Google is not the only company collecting location data, nor the only way for police to access mass amounts of data on people with no connection to a crime. As we’ve written about extensively, data brokers collect and aggregate location data from many different apps on our phones and provide that data to police. And police can use “cell tower dump” warrants to get access to data on everyone within range of specific cell towers. Suspicionless searches like these drag a net through vast swaths of information in hopes of identifying previously unknown suspects—ensnaring innocent bystanders along the way. 

Chatrie could have wide-ranging implications beyond location data as well. The Supreme Court affirmed that app data is subject to the Fourth Amendment, because users “reasonably view” it as their own and reasonably expect it “to be shielded from the ‘inquisitive eyes’ of the government.” Justice Gorsuch, in an opinion concurring in the judgment, called location data a user’s “personal property,” no different from myriad other “effects” explicitly protected by the text of the Fourth Amendment.  As the Court concluded, “the point of carrying smartphones is to use what is on them,” so the Fourth Amendment has to protect more than just location data generated by the act of carrying the phone itself. 

The Court ultimately did not decide whether the particular warrant at issue in Chatrie was “reasonable” or whether the “good faith” doctrine applied. The case now heads back to the Fourth Circuit Court of Appeals to address these questions.  

But regardless of how the Fourth Circuit rules on remand, this Chatrie opinion will shape how lower courts address police access to location and other data going forward. We look forward to citing Chatrie to press future courts to recognize broad Fourth Amendment protections for user data.