Courts Cleared AI Shopping Agents. India's Payment Rails Have Not.

You tell your AI browser to find the cheapest 65-inch TV under Rs 60,000 and buy it. It finds one in about eleven seconds. Then it stops. Not because Amazon blocked it, and not because a judge did. It stops because nothing in India's payment plumbing knows how to let a piece of software hold your wallet.

TL;DR: A US appeals court has ruled that when you send an AI agent shopping, you are the one visiting the store. That settles one fight and leaves the harder one untouched. In India, no payment rail yet exists that will let the agent pay.

Why It Matters

On 9 March 2026, a federal judge in the Northern District of California ordered Perplexity to keep its Comet browser off Amazon. On 4 August the Ninth Circuit vacated that order in Amazon v. Perplexity, No. 26-1444, and the reasoning is the part worth keeping. Where the AI company's servers never speak to the retailer directly, and every request routes through the shopper's own machine, the panel held that it is the shopper who "accessed" Amazon's computers under the Computer Fraud and Abuse Act. Not the software vendor.

Read the coverage and you would think agentic shopping just won outright. It didn't, quite. The panel left Amazon's contract and tort claims standing, terms-of-service breach included, and went out of its way to say it was not foreclosing liability for agents with greater autonomy, or for designs where the vendor's own servers hit the retailer. So the decision protects one narrow shape: a local agent driving your session, on your hardware, with your login. Build it any other way and you are back in front of a judge with worse facts. There is a second thing the ruling did not do. It did not stop Amazon from blocking agents by other means. Nothing in the opinion obliges a retailer to serve a request it can detect and refuse, and detection is a product problem rather than a legal one. A platform that loses on the statute can still rate-limit, fingerprint, challenge or quietly terminate the account, and none of that needs a judge's permission.

None of which is why your agent stalls at checkout in Bengaluru. The Reserve Bank of India's Digital Payments E-Mandate Framework, in force since 21 April 2026, requires your issuer to notify you at least 24 hours before any recurring debit lands. Sit with that for a second, with an agent in mind. The one rail built for automatic payments comes with a mandatory day of warning attached. It is the same instinct now shaping how platforms decide what software may act on your behalf, applied to money instead of apps, and it lands harder here. E-mandates were designed around a repeating charge whose amount and merchant you already know, on a date fixed well in advance. An agent's entire value is the opposite of that: an unpredictable amount, at a merchant you have never used, on the day it finally finds the thing. The rail and the use case were built for different worlds.

Four numbers frame the standoff: how long the ban actually held, what the retailer stands to lose, how fast agent buying is climbing, and how much of the open web is already machine traffic. Together they explain why Amazon spent five months fighting this, and why losing once has not ended it.

Injunction Held

148 days

Before the panel vacated it

Ad Revenue At Risk

$19.8 bn

Amazon, one quarter of 2026

Agent-Driven Orders

3x

Year on year, second quarter

Machine Traffic Share

1 in 30

Of all web visits, 2026

Take the order growth. Shopify's second-quarter 2026 earnings set it against a figure that matters more: 75% of AI-attributed purchases fell outside the company's top hundred product categories. Agents are not winning the things people already know how to buy. They are finding the awkward, badly-named, three-pages-deep thing you would have given up on by the second search.

"

A payment rail that must warn you a full day before it moves your money was built for gym subscriptions, not for an agent that just found your shoes.

Three Routes, One That Pays

So where does this leave an Indian shopper who actually wants the thing? Three routes exist right now, and the gap between them is not about how clever the model is. It is about who holds the authority to move money and who answers when the money moves wrongly. The third column deserves a note, because it is the one people picture when they hear the phrase. A delegated-payment agent is not an agent holding your password. It is an agent holding its own credential, one your bank recognises as separate from you, spending inside limits you fixed beforehand, leaving a trail that records which instruction came from a human and which from software. That is a great deal of new infrastructure, and not one piece of it is a model-quality problem.

Dimension	Local Agent On Your Device	Retailer's Own Assistant	Delegated-Payment Agent
Legal Status	Cleared on 2 statutes, CFAA and California's CDAFA	Never at issue, you are the merchant's logged-in user	Untested, no agent has settled on UPI rails
Contract Risk	2 claim families survive on remand: contract and tort	None, the retailer wrote the terms it is enforcing	Undefined until a protocol publishes its terms
Payment Rail	Your saved card or UPI, you press the final button	Retailer wallet or saved instrument, one tap	Reported UPI extension, nothing in production
Auth Interrupt	Second factor required above Rs 15,000 per transaction	Same threshold, prompt raised on the retailer's screen	No published exemption, assume the threshold applies
Purchase Latency	Seconds, capped by how fast you type the OTP	Seconds, instrument already on file	1 day floor, set by the pre-debit notice rule
Dispute Route	Card or UPI chargeback, unchanged by the ruling	Retailer grievance desk, then your issuer	None defined, chargeback rules still to evolve
Setup Steps	3 steps: install browser, sign in, grant site access	1 step: open the retailer's existing app	Not installable, no consumer-facing build exists
Live In India	Yes, for search, comparison and cart building	Yes, bounded to that one retailer's catalogue	No, stakeholder consultation stage only
Best Suited For	Comparison hunting where you still approve the buy	Repeat orders inside one retailer you already trust	Nobody yet, watch the consultation instead

Notice what the table does not contain. There is no column where an agent both chooses freely across the whole market and pays without you. That combination is the product everyone is describing, and in India it currently exists nowhere. The court fight was about the first half. The second half is a payments question, and payments questions in this country are settled by the regulator, not by the Ninth Circuit. It is tempting to read all this as a delay, as though the parts are on order and the launch is a scheduling matter. That reading is too generous. Granting payment authority to a non-human actor is a genuinely hard design question, and the countries working on it are not converging on a shared answer.

Four things have to exist before software can pay on your behalf in India: a way to identify the agent, a mandate you actually granted it, authority to move the money, and a route to complain when it goes wrong. Not one of the four is finished.

Friction Points

India does have an answer in progress. Business Standard reported in July 2026, citing industry sources, that the National Payments Corporation of India is building a Unified Agent Protocol to authenticate agents and set transaction limits without rebuilding UPI underneath. That is the right shape. It is also, as of today, a reported development rather than an announced product: no official NPCI statement, no timeline, no pilot, no published limits. The protocol is real, or at least the consultation is; the protocol itself is still slideware.

Which brings up the thing that irritates me about the current commentary. Specific per-transaction caps have been circulating as though they were policy. They are not. They come from one writer's proposal about what NPCI ought to do, and they have been repeated until they read like a specification. If you are planning around numbers nobody at the regulator has published, you are planning around fiction, and the correction will be expensive.

Then there is the hole nobody wants to own. An agent buys the wrong size, the wrong variant, the wrong seller. Under a card payment you dispute it. Under an agent-initiated debit, who is the counterparty: you, because a court just said the agent is your hands, or the vendor, whose model picked the listing? Reporting on the protocol work concedes that chargeback and dispute mechanisms will need to evolve. That concession is doing a lot of work. The same framework already obliges the issuer to send a post-transaction notification carrying its grievance redressal details, which tells you plainly how the regulator pictures recourse: a named human at both ends of every debit. An agent-initiated purchase breaks that assumption at the first step, and no amount of protocol design makes the question of who authorised the spend disappear.

• Check where the agent actually runs. If it drives your browser on your machine, the Ninth Circuit's reasoning covers you. If it calls the retailer from a vendor's cloud, that protection was explicitly not extended.
• Read the retailer's terms before you point an agent at it. Contract claims survived this ruling untouched, and account termination needs no court at all.
• Keep the final confirmation yours. The moment you hand over the button, your chargeback story gets harder to tell.
• Treat any agent asking for a standing payment mandate as premature. Nothing in India authorises it yet.

Three questions that decide your exposure

Where does it run? The machine the request leaves from is what determines whose legal problem an agent's shopping becomes.

Who presses confirm? Your finger on the last button keeps the dispute path you already understand. Delegating it swaps a known process for one that has not been designed.

What do the terms say? A retailer that bans automated access can close your account tomorrow, and no appellate reasoning about statutes will reopen it.

Use an agent to shop, not to pay. Let it hunt and fill the cart, then check the total yourself and press the button with your own thumb. That is not caution for its own sake, it is the only configuration where you keep both the legal cover the Ninth Circuit just described and the dispute rights India's payment rules already give you. Revisit it the day NPCI publishes an actual specification. Until then, the agent works for you right up to checkout, and that is genuinely useful on its own.