Who Gets to Choose Your AI? Platform Power and the Limits of User Choice
Disputes involving Apple, Meta, Amazon, and other platforms expose the limits of user choice. This essay argues for a defined right to delegate lawful tasks, duties of agent loyalty, and a practical private remedy.
By J.R. Howell | The American Counsel | October 4, 2026
Apple announced on October 2 that it would add controls over applications’ broad access to information on a Mac. Those controls will help determine which AI assistants people can authorize to act on their behalf. Apple’s developer notice[1] calls for more explicit user authorization. It neither names Meta’s Muse assistant nor announces a blanket ban. It provides no implementation date. The eventual design will matter. Apple can make permission more meaningful. It can also make an independent assistant difficult to use while developing its own.
The conflict extends beyond Apple. Amazon challenges a rival shopping agent while offering an agent that purchases from other merchants. Meta seeks access for Muse while defending restrictions on competing assistants within WhatsApp. Across these disputes, the company deciding whether an intermediary is safe may also profit from supplying the intermediary itself. That conflict does not establish unlawful conduct. It does establish a reason to require more than the company’s assurance that its preferred arrangement serves the user.
Users should have an enforceable right to choose an accountable intermediary for activities they may lawfully undertake. A platform should be able to impose justified security protections. An agent should be bound by the authority its user actually grants. An affected person should have a practical way to challenge a refusal that violates those limits. Private rights of action belong in that framework from the beginning.
This principle would protect Meta where a customer knowingly wants Muse’s assistance. It would impose the same obligation on Meta where a customer prefers a competing assistant. The identity of the company seeking access cannot determine the scope of the right.
Congress has an opportunity to address these questions in Senator Mark Warner’s proposed AI AGENT Act. The difficult work is to define the authority a user can delegate and make that authority effective when a platform objects. Existing litigation and emerging regulatory measures show why a right of access needs duties on both sides of the connection. They also show why a person should not always have to persuade a public agency to act before that right becomes usable.
The company controlling access may have an interest in the answer
A platform can protect its customers while competing for their business. Those roles become difficult to separate when the protection determines which other companies may serve them. An access condition can address a vulnerability, preserve a commercial advantage, or do both. The law needs a way to examine the condition without giving either side the power to settle the dispute by describing its own motives.
Apple illustrates the problem. Its September Siri AI announcement[2] describes assistance using personal context, including messages, email, and photos. Its App Intents guidance[3] explains how developers can expose app functions to Siri. Those ambitions overlap with the tasks that independent assistants seek to perform. Differences in architecture may justify different safeguards. The comparison should concern whether a rival has a practical opportunity to satisfy those safeguards and deliver the function the user wants.
John Gruber’s October 2 commentary[4] supports protecting people who do not understand broad access while preserving powerful tools for informed users. That is a useful starting point. Permission to examine a selected folder is different from continuing access to a personal archive. People should understand that difference and be able to withdraw access. A person who knowingly chooses the broader task should also have a workable route to authorizing it. A permission system that keeps asking after the choice is understood can eventually become a system for preventing the choice.
Amazon’s position makes the commercial comparison more concrete. Todd Bishop’s GeekWire reporting[5] attributes to Amazon a decision to block Muse and objections concerning automation and credential handling. Amazon’s own Buy for Me offering[6] supplies an intermediary that can purchase goods from other brands’ websites. Its Shop Direct materials[7] describe merchant feeds, participation choices, and customer confirmation. Amazon should explain why a competing transaction creates an unacceptable risk under conditions it regards as adequate for its own agent. The comparison requires evidence about credentials, data retention, confirmation, and cancellation. Similar marketing language alone cannot establish equivalent systems.
The merchants’ interests matter too. Allison Smith’s Modern Retail report[8] describes objections from five merchants alongside Amazon’s account of removal on request. Bobo Design Studio[9] says it did not opt in and reserves the right to cancel Amazon-associated orders. These accounts establish a participation dispute. A customer’s choice of assistant does not ordinarily compel every seller to accept every transaction. Legislation directed at a dominant marketplace should explain why its access duties belong there. It should not require every small merchant to become an infrastructure supplier for the largest AI companies.
Meta faces the same principle from the other side. In its WhatsApp competition proceeding[10], the European Commission ordered interim restoration of rival assistants’ access on June 9. The measure sought restoration of the terms preceding October 15, 2025, while the Article 102 investigation continued. OpenAI’s July release notes[11] report ChatGPT’s return in the European Economic Area through a qualified rollout tied to the phone number’s country code. Microsoft separately announced Copilot’s January departure[12]. These are distinct product histories. The concrete lesson is that access to a major communications service can determine whether people can use an assistant where they already communicate.
X also occupies both positions. Its developer agreement[13] restricts specified model-training uses. Its Grok documentation[14]describes an affiliated AI product and related data practices. In X Corp. v. Bright Data Ltd.[15], a federal court allowed antitrust counterclaims challenging restrictions on public X data to proceed at the pleading stage. In X Corp. and X.AI LLC v. Apple Inc.[16], X and its AI affiliate alleged that Apple and OpenAI unlawfully restricted AI distribution. A later motion sought Apple’s dismissal[17] following resolution of that dispute. The court’s settlement-production order[18] confirms a confidential agreement. OpenAI’s summary-judgment motion[19] disputes the remaining claims, including exclusivity and foreclosure. Neither those contested allegations nor the unpublished settlement terms supply a public access standard.
These reversals reveal the weakness of relying on the companies’ preferred rules. A company seeking entry has reasons to emphasize openness. A company controlling a valuable service has reasons to emphasize permission. A durable rule should ask what the user authorized, what the intermediary will do, and what harm the proposed restriction prevents. It should apply when the companies exchange positions.
The user’s authority must define the agent’s authority
The right to appoint an assistant needs an identifiable boundary. A person may authorize software to complete a purchase without authorizing its provider to collect a commercial dataset. A request to read a discussion may require temporary processing without permitting indefinite retention or general model training. These distinctions determine whose interests the software serves.
The Ninth Circuit’s August decision in Amazon.com Services, LLC v. Perplexity AI, Inc.[20] makes the identity of the actor especially important. The panel vacated a preliminary injunction against Perplexity’s Comet browser because Amazon had not made the required showing that Perplexity itself accessed Amazon’s computers through the desktop architecture presented at that stage. It also rejected Amazon’s generalized showing of irreparable injury. The decision protects an important distinction between a customer’s use of software and the developer’s own access. It leaves the remaining litigation to proceed on the applicable law and evidence.
Amazon’s amended complaint[21] alleges additional control and a different cloud implementation used by iOS Comet. According to Amazon, the mobile system directly contacted its service through infrastructure using copied authentication cookies during a period beginning in March. Amazon also alleges intentional interference with customer contracts. Those allegations make architecture central to the continuing dispute. A program acting inside a customer’s browser can present a different attribution question from a provider operating a remote browser. A customer may intend to authorize either arrangement. That intention does not answer which computer was accessed or who performed the legally relevant act.
Existing computer-access law gives user permission an uneven role. In Van Buren v. United States[22], the Supreme Court rejected a reading of the Computer Fraud and Abuse Act that treated an improper purpose as exceeding authorized access to information the person was entitled to obtain. It reserved whether relevant restrictions must be technological or may also arise from contracts and policies. The decision limits one route to liability without resolving every dispute over a service operator’s objection.
In Facebook, Inc. v. Power Ventures, Inc.[23], customer permission did not authorize continued access after Facebook expressly revoked permission and the defendant circumvented blocking. The Ninth Circuit also rejected treating a mere terms-of-use violation as sufficient. Its later decision in hiQ Labs, Inc. v. LinkedIn Corp.[24] distinguished publicly available information from information behind an authorization gate while preserving possible claims under other law. California Penal Code section 502[25] adds its own distinctions between unauthorized access and unauthorized taking, copying, or use after access. A statute protecting delegation would need to address these differences directly.
Orin S. Kerr’s analysis of shared-credential access[26], published before the Comet appellate decision, proposes examining whether the intermediary acts for the credential holder or pursues an independent purpose. That proposed agency analysis helps identify the conduct an access right should protect. Faithfully completing a customer’s purchase is different from using the same session to collect information for a separate business. It is an analytical proposal, not a test adopted by the Comet panel.
The competing briefs show what is at stake. EFF’s Andrew Crocker[27] welcomed the appellate result as protection for user-selected browsers and tools. A Knight Institute and ACLU brief[28] connects the question to voluntary data sharing and independent research. The Software & Information Industry Association’s rehearing brief[29] challenges the treatment of corporate control and warns that evasion can disadvantage developers that follow identification and permission standards. A delegation right can take both concerns seriously. It can protect a customer’s chosen tool while requiring reliable identification and denying protection to independent extraction disguised as a personal task.
Even a successful access-law defense may leave the platform with a contractual claim. A company may argue that the customer promised not to use automation or that the developer intentionally disrupted that promise. Congress must decide whether a protected delegation can be eliminated through a standard contract. Otherwise a new right may disappear through the terms imposed by the party it was intended to constrain.
The Reddit disputes show why the protected task must remain specific. In Reddit, Inc. v. Anthropic, PBC[30], Reddit alleges unauthorized commercial collection for Claude and violations of contractual and related duties. Its complaint does not plead direct copyright infringement. The federal court remanded the case[31] after addressing duties beyond copyright’s exclusive rights for purposes of removability. Reporting on a later state-court order[32] indicates that several claims survived. This is continuing litigation over collection and use. Describing it as a ban on Claude would obscure the conduct being challenged.
A person asking an assistant to read a selected Reddit discussion does not necessarily authorize its provider to incorporate thousands of discussions into a model. Reddit’s own authority also deserves scrutiny. A platform’s permission to distribute user posts does not automatically make it the owner of every expressive interest in them. Frank Fagan’s work on training-data governance[33] examines how contracts and platform rules allocate control over data use. That allocation is already taking place. A user-choice statute would decide which parts the platform may control and which interests remain with the people creating or lawfully using the material.
Reddit’s separate action against SerpApi, Perplexity, and other defendants[34] reaches retrieval used to produce answers. The Southern District of New York allowed significant claims to proceed in July. SerpApi’s antitrust counterclaims[35] challenge the competitive consequences of Reddit’s access restrictions. Reddit disputes the market, injury, and duty-to-deal theories. The court subsequently stayed discovery unique to those counterclaims[36] while leaving them pending. SerpApi chief executive Julien Khaleghy presents the litigation as a threat to open access[37]. That characterization does not settle the parties’ competing rights.
Google’s suit against SerpApi[38] adds the Digital Millennium Copyright Act’s anticircumvention provisions. The Northern District of California dismissed Google’s pleading with leave to amend concerning authorization from copyright owners. Google amended its complaint. The renewed dismissal motion remains pending on the operative schedule[39]. The separate license-discovery order[40] did not resolve its merits. A right to appoint an assistant cannot simply assume away copyright owners’ interests in the information the assistant encounters.
The Fashion Law’s analysis of platform terms[41] identifies the useful dividing line between collection for a developer’s business and performance of a consumer’s task. Google’s Workspace policy[42] makes a related distinction by allowing qualified user-benefiting functions while limiting broader model development with Workspace data. Google-Extended[43]provides controls over specified Gemini training and grounding uses without affecting ordinary Search inclusion or ranking. Microsoft’s historical Bing licensing terms[44] likewise separated permitted grounding from restricted training. Those particular APIs retired in August 2025[45]. The example concerns a licensing distinction rather than a current general prohibition on other assistants.
Legislation should make the distinction enforceable. Temporary processing necessary to complete an authorized task can receive different treatment from retention, redistribution, and model training. A provider should have to identify which activity it proposes. A platform should have to identify the right or harm supporting its objection. Neither “user-directed” nor “scraping” should decide the matter without that evidence.
An agent must remain accountable to the person it represents
Giving an assistant access changes the location of power. It does not ensure that the person who appointed it controls how that power is used. An agent can make recommendations shaped by its provider’s interests, expose communications belonging to other people, or treat an instruction found on a webpage as authority to act. A user-choice policy must address those risks as part of the right itself.
Meta’s security account of Muse[46] illustrates how much a permission decision can involve. Tarek Sheasha describes a dedicated cloud virtual machine and a separate permission authority called Sentinel. Credential surrogation keeps actual credentials outside the model’s context. It does not mean Meta itself cannot access service data. The paper distinguishes the current Secure VM from a planned Confidential VM and describes default model improvement using sanitized inference trajectories, with an opt-out. These representations tell a prospective user what Meta says it has built. They do not constitute an independent audit.
The relevant authority has several dimensions. The user should know where a task runs, what information it can reach, and whether the provider will reuse the resulting information. Authorization to find a document should not silently become permission to exploit its contents for another commercial purpose. The same rule should govern assistants supplied by Apple, Google, Microsoft, and OpenAI.
Patrick Wardle’s Muse demonstration[47] shows how broad authority can increase the damage from an existing security failure. His example required malicious code already running as the logged-in user and used a dictation endpoint to redirect traffic. It was not a remote, zero-click compromise. 9to5Mac reported his acknowledgment of a hotfix[48]. The demonstration still supplies a reason to limit what an assistant can do after another component has been compromised.
That problem is broader than Muse. In early 2026, University of Washington researchers Franziska Roesner and David Kohlbrenner[49] demonstrated a controlled transfer of information across website boundaries in Atlas Agent Mode and identified relevant preconditions in other products. Their demonstration included an instruction to follow a page’s directions. Its significance concerns the authority a browser agent could exercise under those conditions. It does not estimate the probability of compromising an ordinary user. Their broader warning is direct: “models will remain non-deterministic and cannot provide guarantees that architectural or system-level defenses can.”
Detection tools can help without removing the need for those defenses. Kaiyuan Zhang and colleagues[50], including researchers affiliated with Perplexity, report promising prompt-injection detection in BrowseSafe. Performance weakened in a separate test with different injection placements. The benchmark gives developers information about a defense under specified conditions. A favorable score cannot establish safety across the transactions people will actually delegate.
Permission design also has limits. In Ting Yan’s 113-person simulation[51], participants who wrote coarse permission policies blocked less task overreach than those approving individual actions. Most overreach under the policy condition followed human approval. The preprint used fixed routes and simulated stakes. Its definition of overreach concerned the original task rather than a legal determination of consent. The practical implication is nevertheless useful. Developers should test what users understand their standing permissions to allow.
Authority can be limited independently of a model’s judgment. Preparing a purchase can be separated from completing it. Reading can be separated from transmitting. Continuing access can be revoked. Each safeguard has costs and technical limits. Those concrete alternatives should inform whether a complete exclusion is necessary. The FTC’s staff discussion of interoperability, privacy, and security[52] explains why access and protection need not be inherently incompatible.
Privacy duties also extend beyond the person operating the account. A correspondence archive contains information about people who did not appoint the assistant. The GDPR[53] requires a lawful processing basis and additional conditions for sensitive information. Its portability provisions preserve other people’s rights. These requirements do not make every task dependent on every correspondent’s consent. They require a provider to justify and safeguard the processing it actually performs. An interoperability obligation does not erase them.
Loyalty presents a different problem from technical security. Jack FitzGerald’s Open Markets analysis[54] warns that an independent agent can become a surveillance-driven gatekeeper of its own. Controlled shopping experiments by Anushka Kumar and colleagues at Wharton[55] found that recommendations changed with source ordering, supplied user memory, and the packaging of tool calls. Those experiments do not establish actual consumer losses or unlawful preferences. They identify decisions inside the assistant that can shape the alternatives a person sees.
France’s competition authority examines both sides of this dependence[56]. Its July sector assessment considers barriers preventing independent agents from reaching users alongside the power agents may acquire over merchants’ visibility. Opening a platform can therefore improve competition while creating a new relationship requiring oversight. A person who can switch assistants still needs information about paid steering and meaningful control over secondary use of data.
Noam Kolt’s governance proposal[57] directs responsibility toward actors with the capacity to prevent harm and the resources to remedy it. That is a proposed allocation of responsibility rather than a conclusion that ordinary agency law already resolves AI liability. It focuses attention on firms capable of inspecting and repairing a system. The user who selected the assistant may have neither capacity.
A protected agent should accordingly owe enforceable duties of fidelity to the authorized task. It should honor revocation, disclose material commercial incentives, and obtain separate authority for materially different uses. The right to choose an assistant becomes more valuable when the choice gives the person a claim against the assistant as well as against the platform refusing access.
A usable choice depends on the conditions of access
Permission to exist in a market is a limited freedom when customers cannot reach the product or use its essential functions. Defaults, interfaces, and operating-system capabilities affect which assistants people encounter and what those assistants can accomplish. These conditions deserve examination even when no platform has announced a formal ban.
The final judgment in United States v. Google LLC[58] addresses that relationship through a remedy for adjudicated conduct. It restricts specified distribution arrangements and provides bounded access to data and syndication for qualified competitors. Defined generative AI products fall within parts of the judgment. The government’s appeal seeks stronger restrictions on default-placement payments[59]. Google’s Lee-Anne Mulholland[60] argues that users select its products for their quality and that compelled sharing can undermine privacy and investment. Those competing positions concern how far the remedy should go. They are not a general determination of every assistant’s entitlement to Google’s systems.
The debate is more useful when it identifies a mechanism. Writing about the September 2025 remedy decision, Erik Hovenkamp and A. Douglas Melamed approve much of the remedy[61] while criticizing its treatment of the aggregate reach of paid defaults. Steven Salop proposes separating distributor compensation from default conditions[62]. Joseph V. Coniglio’s ITIF analysis of that same decision[63] demands a stronger causal connection between unlawful conduct and compelled sharing. A new access statute should answer the same questions. It should identify the power being constrained, the access needed to make choice effective, and the costs justified by the expected benefit.
The European Commission’s July Android measures[64] take a more specific approach under the Digital Markets Act. They concern access by eligible AI services to defined Android capabilities. The implementation timetable[65] places most obligations in August 2027 and concurrent hotword detection in August 2028. Certification and security protections accompany those requirements. The separate Google Search data proceeding concerns a different resource. Binding measures have been adopted without making all of the promised functionality immediately available.
Google security executives Dave Kleidermacher and Eugene Liderman[66] object to aspects of the design, including sensitive capabilities and certification. Their objections should be tested on the merits. Expertise can identify a real vulnerability. The employer’s commercial interest can also affect which response it prefers. Independent review allows the law to take the risk seriously without making the company’s preferred solution conclusive.
The Free Software Foundation Europe’s Lucas Lasota[67] emphasizes user control and developer independence. The foundation also sought the ability to remove preinstalled AI. A right of choice should include that freedom. A policy that offers only a menu of assistants still leaves out the person who wants none of them.
The DMA does not create one undifferentiated access duty. Its Articles 6 and 7[68] distinguish operating-system interoperability, user-data portability, business-user access, and messaging interoperability. Apple’s designated services include iOS[69] and iPadOS[70]. macOS itself is not designated. Related Safari and App Store designations require attention to the particular service before drawing conclusions about a Mac-related claim. The boundaries illustrate why a statute must identify what the user can demand and from whom.
Britain’s measures make that drafting choice visible. The Competition and Markets Authority’s mobile-platform programme[71] records strategic-market-status designations for Apple and Google. Apple’s commitments effective in April[72] provide a process for requesting interoperable access while preserving discretion over development and charging. The CMA’s Google data-portability requirement[73], effective September 17, goes further for a specified resource. It requires free tools enabling authorized third parties to obtain defined data from UK users’ signed-in search activity. That entitlement does not extend to the whole search index.
A separate publisher requirement[74] provides controls over training and grounding with protection against retaliation in ordinary search. Its principal obligations begin in December. Page-level grounding controls follow in March 2027. The user-choice consultation[75] remains a proposal. These different instruments allocate different rights. A channel for requesting cooperation, a mandatory portability tool, and a publisher’s right to refuse reuse should not be described as interchangeable forms of openness.
WhatsApp shows why implementation belongs within the legal duty. Jérémie Jourdan of Geradin Partners defends the Commission’s intervention[76] as protection for an important route to users. His firm represents Interaction, the operator of Poke.com. Tanya Nagrath’s ITIF response[77] stresses operational burdens, investment incentives, and other distribution channels. The adequacy of those channels depends on whether they let a rival reach the relevant users in practice.
The related proceedings also show different institutions performing different tasks. Italy’s competition authority closed its case in May[78] after the Commission extended its investigation to Italy and displaced national competence. The closure reflected that allocation of responsibility. In Brazil, reporting Commissioner Carlos Jacques Vieira Gomes’s interim opinion[79]examined infrastructure and alternative-distribution arguments while requiring actual restoration of access. A later compliance announcement[80] addressed replacement charges and daily fines. Those interim proceedings did not settle final liability or establish an eventual accumulated fine.
Their practical lesson is straightforward. A platform can reopen an interface while imposing a price or operating condition that prevents meaningful use. Increased demand can also impose legitimate costs. An effective right needs a standard for distinguishing the two. The relevant inquiry concerns the service delivered under the new terms and the evidence supporting those terms.
Access obligations must account for the value they can destroy
Integration can make an assistant more useful. Requiring every function to be supplied in the same way to every rival could sacrifice some of that value. An access right should therefore define the user interest being protected before specifying the duty imposed on the platform.
Giuseppe Colangelo’s analysis of AI integration[81] argues that integration can reduce transaction costs, improve coordination, and strengthen competition against leading AI providers. His February paper does not evaluate Apple’s October announcement. It raises a broader objection that deserves an answer. An established company’s distribution system may help an emerging assistant challenge a stronger AI incumbent. The competitive effect cannot be inferred from the size of one participant alone.
Access obligations can also affect investment. In a theoretical model by Hanming Fang and Soo Jin Kim[82], equal access to refined data can intensify downstream competition while weakening incentives to produce the data. Welfare depends on the model’s conditions. The analysis gives policymakers a reason to examine development costs and compensation. It does not measure Muse or establish that helping a customer use an existing account has the same effects as supplying a commercially refined dataset.
Publishers face a related concern. Athena Chapekis and Anna Lieb’s Pew study[83] observed lower rates of clicking traditional search links when an AI summary appeared. Differences in query composition limit causal conclusions from the browsing data and reconstructed results. The study nonetheless identifies a cost an access policy must consider. A convenient answer can change whether the businesses producing its underlying information receive a visit.
These objections favor a defined duty tied to a defined activity. They also favor allowing justified charges for genuinely additional services where the statutory design warrants them. The proposed right should protect lawful delegation without transferring every cost of an AI company’s business to the service or publisher it uses. That limit makes the right more defensible and helps keep the user’s interest distinct from the agent provider’s demand for cheaper inputs.
A right should not depend entirely on an agency choosing to act
A person can have a serious access problem without presenting the kind of case an agency selects for investigation. The harm may be concrete and urgent for that person. It may still be too small, too fact-specific, or too costly to become a public enforcement priority. A statutory right can remain unavailable in practice during that interval.
This is an institutional problem even for a well-funded and conscientious regulator. Agencies must choose among legitimate demands. Their decisions properly account for effects beyond a particular complainant. A person seeking to enforce a defined duty has a different claim on the legal system. That person should not always need to show that the dispute merits a share of the government’s enforcement budget.
The FTC already has authority relevant to both sides of the relationship. Section 5[84] addresses unfair methods of competition and unfair or deceptive acts or practices. An agent’s misleading account of its permissions raises a different question from a platform’s exclusion of a rival. The agency can examine both within the governing statutory requirements.
The Commission’s AI partnership study[85] documents relationships involving Microsoft and OpenAI, Amazon and Anthropic, and Google and Anthropic. It is a factual research product rather than an adjudication of competitive effects. Andrew Ferguson, joined by Melissa Holyoak, supported publication of that work[86] while criticizing speculative analysis and recognizing possible incumbent efforts to constrain emerging competition. Mark Meador’s March 2026 remarks[87]likewise address restrictions on inputs and distribution. He argues that “Urgency in markets should translate into urgency in enforcement, particularly during periods of technological transition.”
Urgency also concerns the person waiting for a decision. Repeated delay can prevent a new service from reaching users while entry is still possible. It can leave a customer unable to complete a lawful task through the chosen intermediary. A remedy arriving after that opportunity has passed may do little to restore it.
Resources matter without explaining every enforcement choice. The FTC’s inspector general reported[88] 1,014 employees as of March 31 against 1,114 authorized positions and a fiscal 2026 budget of $383.6 million. The agency’s fiscal 2027 request[89] sought $426.71 million and 1,183 full-time-equivalent positions. Those figures are a dated staffing snapshot and a budget request. They cannot show that a particular access complaint went unaddressed for lack of personnel. They do reinforce the need to fund new duties honestly rather than assume that assigning a responsibility supplies the capacity to carry it out.
Public enforcement can produce meaningful access. The Commission’s WhatsApp intervention was followed by OpenAI’s reported return in the EEA. Expertise, investigative powers, and remedies reaching an entire market remain valuable. Private enforcement should complement those capacities by allowing affected people to assert duties the legislature has expressly made enforceable.
That proposal has costs of its own. A large AI company could use litigation to pressure a small service. Emergency motions could complicate incident response. Discovery could expose vulnerabilities or confidential information. A carefully defined cause of action should address those risks through coverage limits, proportionate discovery, and protections against abuse. Leaving every affected person dependent on public selection is itself a policy choice with consequences.
Existing remedies do not fully protect the decision to delegate
American antitrust law already permits private enforcement. Clayton Act section 4[90] provides treble damages and attorney’s fees for qualifying injury to business or property. Section 16[91] permits injunctions against threatened antitrust injury. A claimant need not wait for a government case. The FTC Act[92], by contrast, supplies no private cause of action under the statute itself.
The principal gap is often the duty rather than the absence of a courthouse. In Verizon Communications Inc. v. Law Offices of Curtis V. Trinko, LLP[93], the Supreme Court rejected a monopolization claim based on allegedly inadequate performance of a telecommunications sharing obligation. The regulatory law preserved existing antitrust claims without enlarging them. The Court emphasized investment incentives, the difficulty of supervising access, and the existing regulatory response. Its approach to refusal-to-deal liability creates a substantial obstacle to deriving a general right of delegation from monopolization law.
The claimant must also establish the kind of injury antitrust law protects. Brunswick Corp. v. Pueblo Bowl-O-Mat, Inc.[94]requires that connection. Associated General Contractors of California, Inc. v. California State Council of Carpenters[95]directs attention to directness, speculative causation, and duplicative recovery. An excluded developer’s loss of revenue alone does not establish injury to competition. A user’s inability to employ a preferred intermediary does not automatically establish a monopolization claim either.
The form of relief adds further distinctions. Cargill, Inc. v. Monfort of Colorado, Inc.[96] requires threatened antitrust injury for an injunction while distinguishing that inquiry from damages limitations. A court may need to consider continued exclusion even when lost profits are difficult to quantify. TransUnion LLC v. Ramirez[97] separately requires concrete Article III injury in federal court. Congress cannot eliminate that constitutional requirement simply by attaching statutory damages to a violation.
A legislature can protect a defined choice more directly. It can identify a covered platform’s duty to permit a lawful delegation without requiring every user to prove all the elements of monopolization. It must also identify who can enforce that duty and what relief the person can obtain. An antitrust savings clause preserves useful law. It does not perform that additional legislative work.
Europe provides examples of both substantive access duties and private remedies. The Court of Justice’s Android Autojudgment[98] declined to apply the strict indispensability condition associated with Bronner in the circumstances of a platform developed for third-party use. Exclusionary effects still required evidence. Security, integrity, and technical impossibility could justify refusal. A missing template alone did not necessarily suffice. Reasonable development time and an appropriate financial contribution could be allowed. The decision arose from public enforcement and awarded no private damages. It nevertheless provides a more specific account of when a platform’s design obligations can matter.
The DMA’s Articles 39 and 42[99] address national-court proceedings and representative actions. Germany’s GWB section 33[100] expressly provides qualifying remedies concerning breaches of DMA Articles 5, 6, and 7. Section 33a[101] provides compensation for qualifying intentional or negligent violations. The Commission’s April review[102] reported awareness of close to ten national DMA proceedings, including an injunction in Mainz concerning Gmail during Android setup. Private enforcement is already part of this system. That dated account does not establish the eventual appellate outcome or the adequacy of every national route.
Availability still differs from practical access to relief. Lena Hornkohl and Alba Ribera Martínez[103] examine procedural differences and litigation funding in collective DMA enforcement. The Representative Actions Directive[104] provides a qualified-entity framework rather than an unrestricted collective action for every excluded business. The Antitrust Damages Directive[105] has a separate scope that should not automatically be extended to a DMA-only claim. These distinctions matter because a formally protected interest may still be expensive or difficult to enforce.
The Google judgment illustrates the same issue in a different form. Its access remedies serve the adjudicated public case. The judgment disclaims additional third-party rights apart from specified complaint channels. A new delegation statute should make an affirmative decision about the affected person’s remedy instead of assuming that public access obligations carry one with them.
Congress should make the remedy part of the right
Warner’s AI AGENT Act, S. 5051[106], would give users of qualifying large platforms a mechanism for designating custodial agents. It combines access obligations with duties governing the agents. The official record[107] identifies introduction and committee referral on July 21. It remains proposed legislation.
The introduced bill already provides meaningful administrative recourse. Its privacy and security mechanism requires a reasoned denial notice and 14 calendar days to meet specified standards. Access may remain denied during that period. An agent provider could appeal to the FTC. The Commission could grant access if the denial were arbitrary, capricious, or unsupported by the platform’s submitted information. A separate provision calls for a complaint process for users, platforms, and agents. The text contains no express private civil action or decision deadline for the denial appeal.
That procedure addresses a real problem. It creates an institution outside the platform that can examine the reasons for refusal. Congress should also provide a direct judicial route for a person with a concrete injury from breach of the new duty. The claimant’s access to that route should not depend entirely on the agency’s enforcement priorities or the time required to obtain an administrative decision.
Ellen P. Goodman’s analysis of the earlier discussion draft[108] connects user empowerment to faithful agents and credible auditing. Her questions about identifying a user’s interests and verifying an agent’s behavior belong in the final design. The right must govern what happens through the interface as well as whether an interface is available.
The cause of action should be express. Alexander v. Sandoval[109] requires congressional intent to create a private remedy as well as a substantive right. A delegation statute should not leave users litigating whether Congress meant to let them enforce the obligation it just created.
Judicial review of agency action is a separate route. The Administrative Procedure Act addresses reviewability[110], qualifying final agency action[111], and unlawfully withheld or unreasonably delayed action[112], subject to statutory limits. Review of a future FTC decision would depend on the enacted law and the record. A direct claim against a platform would ask whether that platform violated its duty to the plaintiff. Congress should design the relationship between those routes deliberately.
The protected transaction should be specific. A user would designate an identified intermediary to perform a defined activity within the user’s lawful authority. The law would identify the covered platforms and the capabilities they must make available. Processing necessary to complete the task would be distinguished from retention and reuse. The agent would remain responsible for exceeding the delegation.
Coverage should focus on platforms whose control can materially defeat that choice. A statutory threshold could supply predictable notice. A designation process could identify particular sources of power. Either approach should explain why the duty belongs on the covered service. A dominant account platform’s obligation to accommodate a chosen intermediary presents a different question from a small publisher’s obligation to build a sophisticated interface.
A refusal should come with reasons a claimant can contest. The platform should identify the capability at issue and the condition needed to address the risk. Emergency suspension should remain available when warranted. Continued exclusion should be reviewable after the immediate threat has passed. Courts can protect confidential vulnerability information without allowing a general invocation of security to end the inquiry.
The plaintiff should establish the requested delegation, the applicable duty, and a concrete denial or impairment. A platform relying on a security justification should produce supporting evidence within its control. The court should then consider whether a narrower condition would address the proved risk. This proposed allocation places the initial claim with the user while requiring the platform to substantiate the reason only it may be able to document.
The platform’s own assistant would be a relevant comparator when it seeks materially similar capabilities. Different architectures could justify different controls. The inquiry should concern actual authority and safeguards. Affiliation should not establish safety by itself. A rival should have a practical opportunity to satisfy justified requirements rather than an entitlement to identical treatment regardless of design.
Relief should correspond to the violation. A court could order a decision on a stalled request, require a usable form of access, or prohibit a discriminatory condition when the statutory elements are met. Temporary relief would remain subject to appropriate equitable requirements. Proven economic loss could support compensation. A carefully drafted fee provision could make a modest meritorious claim viable without rewarding abusive litigation.
The remedy also needs protection against contractual displacement. In American Express Co. v. Italian Colors Restaurant[113], the Supreme Court enforced individual arbitration despite the expense of proving an antitrust claim. Congress should address arbitration and collective proceedings expressly in the new statute. A substantive entitlement alone does not answer whether the person holding it can afford to enforce it.
Agency expertise can make judicial relief more workable. Standards can define acceptable identification, audit, and revocation practices. Courts can seek agency views or appoint appropriate experts. An order should specify the access required and the conditions permitting suspension. That discipline would reduce the continuing supervisory problems emphasized in Trinkowhile preserving the court’s ability to resolve an urgent dispute.
The agent should face a corresponding private claim when it violates its duties. Disregarding revocation, concealing paid steering, or using delegated access for an undisclosed purpose can frustrate a user’s choice as effectively as blocking entry. Compensation, cessation of the practice, and meaningful correction should follow the injury and the provider’s role. The legislation should leave neither company with unreviewable authority over the person it claims to serve.
The person making the choice needs a place in enforcement
An AI agent can give people greater control over services they already use. It can also give another company greater control over them. Law should distinguish those outcomes through the authority granted, the conduct performed, and the remedies available when either a platform or an agent exceeds its proper role.
The proposed right would require platforms to justify exclusions and agents to honor the purposes for which they receive access. Its private remedy would give an affected person a way to act before a denied choice loses its value. Public agencies would retain their expertise and authority to address broader patterns of harm.
That arrangement would protect a Muse user against an unjustified restriction by Apple or Amazon. It would protect another user against an unjustified restriction by Meta. The right would remain with the person making the choice after the companies have changed sides.
Endnotes
[1] Apple, Updates to Full Disk Access in macOS (Oct. 2, 2026), https://developer.apple.com/news/?id=p6zjojqw (announcing prospective controls requiring explicit user authorization for broad access).
[2] Apple, Siri AI, a profoundly more capable and personal assistant powered by the next generation of Apple Intelligence, is here (Sept. 14, 2026), https://www.apple.com/newsroom/2026/09/siri-ai-a-profoundly-more-capable-and-personal-assistant-is-here/ (describing personal-context functions and qualified product availability).
[3] Apple, Siri (June 8, 2026), https://developer.apple.com/design/human-interface-guidelines/siri (describing developer integration of app content and actions with Siri).
[4] John Gruber, Apple Is Going to Further Tighten the Screws on Full Disk Access on MacOS, in Response to Agentic AI Apps Running Amok, Daring Fireball (Oct. 2, 2026), https://daringfireball.net/2026/10/apple_full_disk_access (defending stronger protection while preserving deliberate grants of access).
[5] Todd Bishop, Amazon blocks Meta’s Muse AI assistant in new standoff over agentic shopping, GeekWire (Sept. 20, 2026), https://www.geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping/ (reporting Amazon’s Muse block and its stated reasons).
[6] Amazon Staff, Amazon’s new 'Buy for Me' feature helps customers find and buy products from other brands’ sites (last visited Oct. 3, 2026), https://www.aboutamazon.com/news/retail/amazon-shopping-app-buy-for-me-brands (describing customer-directed purchases from external merchants).
[7] Amazon Staff, Amazon introduces feeds to make it easier for merchants to reach more customers through AI-powered Shop Direct(Mar. 11, 2026), https://www.aboutamazon.com/news/retail/amazon-shop-direct-external-stores (describing merchant participation, removal, and order confirmation).
[8] Allison Smith, Brands are upset that ‘Buy For Me’ is featuring their products on Amazon without permission, Modern Retail (Jan. 6, 2026), https://www.modernretail.co/technology/brands-are-upset-that-buy-for-me-is-featuring-their-products-on-amazon-without-permission/ (reporting five merchants’ objections and Amazon’s response).
[9] Bobo Design Studio, SHIPPING + RETURNS POLICY (last visited Oct. 3, 2026), https://bobodesignstudio.com/pages/faq (stating nonparticipation and a policy concerning Amazon-associated orders).
[10] European Commission Representation in Portugal, Comissão Europeia impõe medidas provisórias à Meta para preservar livre acesso de assistentes de IA rivais ao WhatsApp (June 9, 2026), https://portugal.representation.ec.europa.eu/atualidade-e-eventos/atualidade/comissao-europeia-impoe-medidas-provisorias-meta-para-preservar-livre-acesso-de-assistentes-de-ia-2026-06-09_pt(announcing interim restoration of rival AI access while merits investigation continues).
[11] OpenAI, ChatGPT Release Notes (July 13, 2026), https://help.openai.com/en/articles/6825453-chatgpt-release-notes (reporting ChatGPT’s qualified return to WhatsApp in the EEA).
[12] The Copilot Team, Copilot is leaving WhatsApp: What’s next (Nov. 24, 2025), https://www.microsoft.com/en-us/microsoft-copilot/blog/2025/11/24/copilot-is-leaving-whatsapp-whats-next/?msockid=16c67bddb32f615c18d76d6fb2e360d4 (announcing Copilot’s January 2026 departure from WhatsApp).
[13] X, Developer Agreement (Apr. 27, 2026), https://docs.x.com/developer-terms/agreement (restricting specified developer uses of X data for model training).
[14] X, About Grok (last visited Oct. 3, 2026), https://help.x.com/en/using-x/about-grok (describing Grok integration and related data practices).
[15] Order, X Corp. v. Bright Data Ltd., No. 3:23-cv-03698-WHA (N.D. Cal. Apr. 18, 2025), ECF No. 263, https://storage.courtlistener.com/recap/gov.uscourts.cand.415869/gov.uscourts.cand.415869.263.0.pdf (allowing antitrust counterclaims to proceed at the pleading stage).
[16] Complaint, X Corp. and X.AI LLC v. Apple Inc., No. 4:25-cv-00914-P (N.D. Tex. Aug. 25, 2025), ECF No. 1, https://cdn.arstechnica.net/wp-content/uploads/2025/08/X-Corp-v-Apple-8-25-25-Complaint.pdf (alleging exclusionary AI distribution arrangements).
[17] Motion to Dismiss Apple Inc., X Corp. and SpaceXAI LLC v. Apple Inc., No. 4:25-cv-00914-P (N.D. Tex. Sept. 14, 2026), ECF No. 385, https://storage.courtlistener.com/recap/gov.uscourts.txnd.408471/gov.uscourts.txnd.408471.385.0.pdf (requesting Apple’s dismissal following resolution of the dispute). Later filings identify the AI plaintiff as SpaceXAI LLC. The September 14 motion requested Apple’s dismissal following resolution of the dispute.
[18] Order, X Corp. and SpaceXAI LLC v. Apple Inc., No. 4:25-cv-00914-P (N.D. Tex. Sept. 17, 2026), ECF No. 398, https://storage.courtlistener.com/recap/gov.uscourts.txnd.408471/gov.uscourts.txnd.408471.398.0.pdf (addressing production of the confidential settlement agreement).
[19] Motion for Summary Judgment, X Corp. and SpaceXAI LLC v. Apple Inc., No. 4:25-cv-00914-P (N.D. Tex. Sept. 22, 2026), ECF No. 402, https://storage.courtlistener.com/recap/gov.uscourts.txnd.408471/gov.uscourts.txnd.408471.402.0.pdf (requesting judgment on the remaining claims and disputing required elements).
[20] Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, slip op. at 6–7, 12–21, & nn.4–5 (9th Cir. Aug. 4, 2026), https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf (vacating preliminary relief on the presented access and injury record).
[21] First Amended Complaint ¶¶ 27–31, 34–45, 63–68, 79–86, 90–104, and 109–20, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 3:25-cv-09514-MMC (N.D. Cal. Sept. 21, 2026), ECF No. 122, https://storage.courtlistener.com/recap/gov.uscourts.cand.459191/gov.uscourts.cand.459191.122.0.pdf (alleging changed architectural facts and interference with customer contracts). A September 30 order sets October 13 as the response deadline and November 3 for Amazon’s opposition if Perplexity files a new dismissal motion. Stipulation and Order Extending Response Deadline at 5, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 3:25-cv-09514-MMC (N.D. Cal. Sept. 30, 2026), ECF No. 125, https://storage.courtlistener.com/recap/gov.uscourts.cand.459191/gov.uscourts.cand.459191.125.0.pdf (setting the response deadline and a conditional opposition deadline).
[22] Van Buren v. United States, 593 U.S. 374, 389–90 & n.8, 396 (2021), https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf(distinguishing prohibited access from improper purposes while reserving the contractual-boundary question).
[23] Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1066–69 (9th Cir. 2016), https://cdn.ca9.uscourts.gov/datastore/opinions/2016/12/09/13-17102.pdf (addressing revoked authorization and circumvention despite customer permission).
[24] hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1197–1202 (9th Cir. 2022), https://cdn.ca9.uscourts.gov/datastore/opinions/2022/04/18/17-16783.pdf (distinguishing public information while preserving other possible causes of action).
[25] Cal. Penal Code § 502(c)(2), (c)(7), and (e), https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=502. (separating prohibited access from specified unauthorized taking and use).
[26] Orin S. Kerr, AI Agents and the CFAA: Amazon.Com Services v. Perplexity AI, The Volokh Conspiracy (June 19, 2026), https://reason.com/volokh/2026/06/19/ai-agents-and-the-cfaa-amazon-com-services-v-perplexity-ai/ (proposing an agency-based analysis of shared-credential access).
[27] Andrew Crocker, Appeals Court Agrees with EFF that Building a Web Browser Doesn’t Violate the CFAA, Electronic Frontier Foundation (Aug. 4, 2026), https://www.eff.org/deeplinks/2026/08/appeals-court-agrees-eff-building-web-browser-doesnt-violate-cfaa(defending user-selected browsers and tools following the appellate ruling).
[28] Brief of the Knight First Amendment Institute, the ACLU, and the ACLU of Northern California as Amici Curiae at 12–19, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Apr. 8, 2026), https://kfai-documents.s3.amazonaws.com/documents/998847a555/Perplexity-CA9-Amicus.pdf (arguing that broad access liability would burden user-directed sharing and research).
[29] Brief of the Software & Information Industry Association as Amicus Curiae Supporting Rehearing at 6–14, 20–22, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 28, 2026), https://www.siia.net/wp-content/uploads/2026/08/2026.08.28-SIIA-Rehearing-en-banc-Amicus-Brief.pdf (challenging access attribution and the treatment of permission standards).
[30] Complaint ¶¶ 9, 55–70, Reddit, Inc. v. Anthropic, PBC, No. CGC-25-625892 (Cal. Super. Ct. June 4, 2025), https://redditinc.com/hubfs/Reddit%20Inc/Content/PDFs/Docket%20Stamped%20Complaint.pdf (alleging unauthorized collection and state-law violations rather than direct copyright infringement).
[31] Order Granting Motion to Remand at 4–12, Reddit, Inc. v. Anthropic, PBC, No. 3:25-cv-05643-TLT (N.D. Cal. signed Mar. 28, 2026, filed Mar. 30, 2026), ECF No. 60, https://www.courthousenews.com/wp-content/uploads/2026/03/reddit-v-anthropic-remand-order.pdf(addressing removability and asserted duties beyond copyright).
[32] Judge Allows Most of Reddit’s Lawsuit Against Anthropic to Proceed, AOB News (Sept. 19, 2026), https://www.aob-news.com/2026/09/19/judge-allows-most-of-reddits-lawsuit-against-anthropic-to-proceed/ (reporting through a secondary account the survival of several claims in a September state-court order).
[33] Frank Fagan, Training Data Governance, 15 N.Y.U. J. Intell. Prop. & Ent. L. 227, 234, 238–39 (2026), https://jipel.law.nyu.edu/wp-content/uploads/2026/04/JIPEL_Vol__15_2_Fagan_INDIVIDUAL.pdf (examining platform control and the conditions for training-data licensing).
[34] Opinion and Order at 62–63, Reddit, Inc. v. SerpApi LLC, No. 1:25-cv-08736-PAE (S.D.N.Y. July 31, 2026), ECF No. 104, https://transcripts.nysd.uscourts.gov/sites/default/files/2026-07/25cv8763%2C%20Reddit%20Inc.%20v.%20SerpApi%20LLC%20et%20al.%20-%20Opinion%20%26%20Order-1.pdf (resolving dismissal arguments concerning the pleaded access and circumvention claims).
[35] Answer and Counterclaims, Reddit, Inc. v. SerpApi LLC, No. 1:25-cv-08736-PAE (S.D.N.Y. Aug. 28, 2026), ECF No. 119, https://serpapi.com/blog/content/files/2026/08/-2026-08-28---dckt-119_0---ANSWER-to--55--Amended-Complaint--.pdf (alleging anticompetitive restrictions in counterclaims).
[36] Order, Reddit, Inc. v. SerpApi LLC, No. 1:25-cv-08736-PAE (S.D.N.Y. Oct. 1, 2026), ECF No. 161, https://storage.courtlistener.com/recap/gov.uscourts.nysd.651592/gov.uscourts.nysd.651592.161.0.pdf (staying discovery unique to antitrust counterclaims without dismissing them). Reddit filed its dismissal motion on September 25. The October 1 order stays discovery unique to the antitrust counterclaims without dismissing them or staying all discovery. A separate extension order sets October 23 for the opposition. Order, Reddit, Inc. v. SerpApi LLC, No. 1:25-cv-08736-PAE (S.D.N.Y. signed Sept. 30, 2026, filed Oct. 1, 2026), ECF No. 156, https://storage.courtlistener.com/recap/gov.uscourts.nysd.651592/gov.uscourts.nysd.651592.156.0.pdf (extending the counterclaim opposition deadline through October 23).
[37] Julien Khaleghy, Reddit’s Lawsuit Is a Dangerous Attempt to Expand Platform Power, SerpApi (Mar. 13, 2026), https://serpapi.com/blog/reddits-lawsuit-is-a-dangerous-attempt-to-expand-platform-power/ (presenting SerpApi’s open-access criticism of Reddit’s litigation).
[38] Order Granting Motion to Dismiss at 7–8, 12–17, and 20–21, Google LLC v. SerpApi, LLC, No. 4:25-cv-10826-YGR (N.D. Cal. July 20, 2026), ECF No. 42, https://chatgptiseatingtheworld.com/wp-content/uploads/2026/07/Google-v-SerpApi-order-granting-motion-to-dismiss-July-20-2026.pdf (distinguishing search results without copyrighted content from amendable authorization allegations).
[39] Order, Google LLC v. SerpApi, LLC, No. 4:25-cv-10826-YGR (N.D. Cal. Sept. 4, 2026), ECF No. 55, https://storage.courtlistener.com/recap/gov.uscourts.cand.461513/gov.uscourts.cand.461513.55.0.pdf (continuing the dismissal hearing to October 13). The operative scheduling order places the hearing on the renewed dismissal motion on October 13, 2026.
[40] Order, Google LLC v. SerpApi, LLC, No. 4:25-cv-10826-YGR (N.D. Cal. Sept. 15, 2026), ECF No. 57, https://storage.courtlistener.com/recap/gov.uscourts.cand.461513/gov.uscourts.cand.461513.57.0.pdf (denying early license production without adjudicating the renewed motion).
[41] Retailers’ Terms Were Written for Humans. AI Is Changing That., The Fashion Law, https://www.thefashionlaw.com/retailers-terms-were-written-for-humans-ai-is-changing-that/ (distinguishing commercial collection from consumer-directed agent activity).
[42] Google, Google Workspace user data and developer policy (Sept. 3, 2026), https://developers.google.com/workspace/workspace-api-user-data-developer-policy (permitting qualified user-benefiting functions while limiting broader data reuse).
[43] Google, List of Google's common crawlers, Google-Extended section (updated July 14, 2026), https://developers.google.com/crawling/docs/crawlers-fetchers/google-common-crawlers (explaining Google-Extended controls and their distinction from ordinary Search treatment).
[44] Microsoft, Bing Search APIs Terms of Use for LLMs (last visited Oct. 3, 2026), https://www.microsoft.com/en-us/bing/apis/llm-legal(authorizing specified grounding subject to historical licensing conditions).
[45] Microsoft, Bing Search API retirement (May 16, 2025), https://learn.microsoft.com/en-us/lifecycle/announcements/bing-search-api-retirement (announcing retirement of the underlying Bing Search APIs).
[46] Tarek Sheasha, How We Built Safety Into Muse, Meta (Sept. 8, 2026), https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse (describing Muse architecture, provider access, and model-improvement settings).
[47] Patrick Wardle, not-a-mused (last visited Oct. 3, 2026), https://github.com/pwardle/not-a-mused (documenting a dictation-endpoint attack requiring existing local code execution).
[48] Arin Waichulis, Security Bite: The last 24 hours at Meta were “not-a-musing”, 9to5Mac (Sept. 22, 2026), https://9to5mac.com/2026/09/22/security-bite-the-last-24-hours-at-meta-were-not-a-musing/ (reporting the researcher’s acknowledgment of a hotfix).
[49] Franziska Roesner & David Kohlbrenner, Agentic Browsers and the Same-Origin Policy, at 4–10, 16 (ICLR Agents in the Wild Workshop 2026), https://homes.cs.washington.edu/~franzi/pdf/roesner_kohlbrenner_2026_agentic_sop.pdf (demonstrating controlled cross-origin behavior and distinguishing architectural safeguards).
[50] Kaiyuan Zhang et al., BrowseSafe: Understanding and Detecting Prompt Injection Within AI Browser Agents, at 1–11, 19–23 (Aug. 12, 2026 version), https://arxiv.org/pdf/2511.20597v2 (evaluating prompt-injection detection with benchmark-specific limits).
[51] Ting Yan, Do User-Authored Permission Policies Improve Protection Against AI Agent Overreach?, §§ 7–9, at 5–11 (Aug. 27, 2026 preprint), https://arxiv.org/pdf/2608.27443 (comparing permission approaches in a simulated task setting).
[52] Federal Trade Commission Staff, Interoperability, Privacy, & Security (Dec. 21, 2023), https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/12/interoperability-privacy-security (examining compatibility between interoperability and privacy safeguards).
[53] Regulation (EU) 2016/679, arts. 6, 9, 20, 25, and 32 (General Data Protection Regulation), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 (requiring lawful processing and protecting other people’s rights in portability).
[54] Jack FitzGerald, Amazon Seeks to Assert Control over Which AI Agents Can Shop Online, and How, Open Markets Institute (Jan. 27, 2026), https://openmarkets.substack.com/p/the-corner-newsletter-january-27th (supporting competitive access while warning of intermediary surveillance).
[55] Anushka Kumar, Lennart Meincke, Dan Shapiro, Lilach Mollick, Stefano Puntoni, & Ethan Mollick, Agentic Shopping is Complicated and Contingent, Wharton Generative AI Labs (Aug. 27, 2026), https://gail.wharton.upenn.edu/research-and-insights/technical-report-agentic-shopping/ (reporting controlled shopping experiments rather than realized consumer losses).
[56] Autorité de la concurrence, AI agents: the Autorité de la concurrence issues its opinion on the competitive functioning of the AI agents sector (July 17, 2026), https://www.autoritedelaconcurrence.fr/en/press-release/ai-agents-autorite-de-la-concurrence-issues-its-opinion-competitive-functioning-ai (examining access barriers and agents’ own power over visibility).
[57] Noam Kolt, Governing AI Agents, 101 Notre Dame L. Rev. 335, 381–85, especially 384 & n.230 (2026), https://ndlawreview.org/wp-content/uploads/2026/08/Kolt_101.335.pdf (proposing responsibility based partly on capacity to prevent and remedy harm).
[58] Final Judgment §§ III–VI, VIII–X, United States v. Google LLC, Nos. 1:20-cv-03010-APM & 1:20-cv-03715-APM (D.D.C. Dec. 5, 2025), ECF No. 1462, https://www.justice.gov/atr/media/1421546/dl?inline= (imposing bounded distribution and access remedies while limiting third-party enforcement rights).
[59] Brief for the United States and Plaintiff States as Appellees-Cross-Appellants, cover and questions presented, United States v. Google LLC, Nos. 26-5023, 26-5047, and 26-5049 (D.C. Cir. July 28, 2026), https://www.justice.gov/atr/media/1454586/dl?inline= (presenting the government’s defense of the judgment and requested stronger relief).
[60] Lee-Anne Mulholland, Why we’re appealing the DOJ Search distribution case, Google (Jan. 16, 2026), https://blog.google/company-news/outreach-and-initiatives/public-policy/why-were-appealing-the-doj-search-distribution-case/ (stating Google’s quality, privacy, and investment objections).
[61] Erik Hovenkamp & A. Douglas Melamed, Appraising the Google Search Antitrust Remedies, ProMarket (Sept. 23, 2025), https://www.promarket.org/2025/09/23/appraising-the-google-search-antitrust-remedies/ (evaluating the remedy’s treatment of defaults and competitive inputs).
[62] Steven C. Salop, A Simple and Effective Repair for the Google Search Remedy, ProMarket (June 3, 2026), https://www.promarket.org/2026/06/03/a-simple-and-effective-repair-for-the-google-search-remedy/ (proposing compensation separated from default-placement conditions).
[63] Joseph V. Coniglio, Breakdown, Not Breakup: Taking Stock of the Google Remedies Decision, Information Technology and Innovation Foundation (Sept. 18, 2025), https://itif.org/publications/2025/09/18/breakdown-not-breakup-taking-stock-google-remedies-decision/(questioning the causal basis for compelled sharing).
[64] European Commission, DMA.100220, Final Measures, paras. 112–48 (July 16, 2026), https://ec.europa.eu/competition/digital_markets_act/cases/202629/DMA_100220_2683.pdf (specifying interoperability measures for eligible AI services under the DMA). The Android interoperability proceeding is DMA.100220. The separate Google Search data proceeding is DMA.100209.
[65] European Commission, Alphabet specification proceedings on interoperability for AI services (last visited Oct. 3, 2026), https://digital-markets-act.ec.europa.eu/businesses-portal/interoperability/alphabet-specification-proceedings-interoperability-ai-services_en (explaining implementation dates and safeguards for Android interoperability).
[66] Dave Kleidermacher & Eugene Liderman, Balancing Interoperability and Security in the Age of AI, Google (Aug. 5, 2026), https://blog.google/security/android-ai-security-eu-dma/ (presenting Google security executives’ objections to particular access safeguards).
[67] Free Software Foundation Europe, DMA: Protecting Device Neutrality in Android Devices (June 15, 2026), https://fsfe.org/news/2026/news-20260615-01.en.html (advocating user control, removal rights, and independent interoperability).
[68] Regulation (EU) 2022/1925, arts. 6–8 (Digital Markets Act), https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng (distinguishing designated-service interoperability and data-access duties).
[69] European Commission, Summary of the Apple Designation Decision, paras. 12–13, Cases DMA.100013, DMA.100025, and DMA.100027 (Sept. 5, 2023), https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52023DMA100013 (identifying the designated Apple services and their scope).
[70] European Commission, Commission designates Apple's iPadOS under the Digital Markets Act (Apr. 29, 2024), https://digital-strategy.ec.europa.eu/en/news/commission-designates-apples-ipados-under-digital-markets-act (announcing the separate designation of iPadOS).
[71] Competition and Markets Authority, The CMA’s Programme of Work Across Mobile Platforms (Aug. 14, 2026), https://www.gov.uk/guidance/the-cmas-programme-of-work-across-mobile-platforms (describing mobile-platform designations and the programme of intervention).
[72] Apple, Commitments, introductory para. 2 and interoperability paras. 1–2, at 13–15 (Mar. 30, 2026), https://assets.publishing.service.gov.uk/media/69ce3e5ec7c26374dba7f000/_Apple_commitments_.pdf (establishing a request process while preserving specified development and charging discretion).
[73] Competition and Markets Authority, Data Portability Conduct Requirement Notice, operative paras. 1–3 and implementation para. 6 (June 17, 2026), https://assets.publishing.service.gov.uk/media/6a314e0fcd3a3f24b55a5c2a/Data_portability_CR_notice.pdf (requiring tools for authorized access to specified search-activity data).
[74] Competition and Markets Authority, Publisher Conduct Requirement Notice, operative paras. 3–5, operative para. 9, and implementation para. 6 (June 3, 2026), https://assets.publishing.service.gov.uk/media/6a1ec73a59fb7a60f827f64e/Publisher_CR_Notice.pdf (providing staged publisher controls and protection against search retaliation). The principal obligations take effect December 3, 2026. Page-level grounding controls follow in March 2027.
[75] Competition and Markets Authority, Google Search User Choice Consultation (Sept. 23, 2026), https://connect.cma.gov.uk/consultations/google-search-user-choice/ (consulting on proposed user-choice requirements through October 9). The consultation closes October 9, 2026.
[76] Geradin Partners, Geradin Partners secures landmark interim measures for Interaction in Meta AI / WhatsApp case (June 10, 2026), https://www.geradinpartners.com/geradin-partners-secures-landmark-interim-measures-for-interaction-in-meta-ai-whatsapp-case/(defending interim access relief on behalf of a participating client).
[77] Tanya Nagrath, Why the EU’s Push to Open WhatsApp to Third-Party AI Assistants Threatens American Technological Leadership, Information Technology and Innovation Foundation (Mar. 2, 2026), https://itif.org/publications/2026/03/02/why-eu-whatsapp-third-party-ai-assistants-threatens-american-tech-leadership/ (arguing that compelled access can burden operations and investment).
[78] Autorità Garante della Concorrenza e del Mercato, Decision No. 31971, A576, Meta AI, Bulletin 23, at 5–7 (May 19, 2026), https://www.agcm.it/dotcmsdoc/bollettini/2026/23-26.pdf (closing national proceedings following the Commission’s assumption of competence).
[79] Carlos Jacques Vieira Gomes, Opinion in Voluntary Appeal No. 08700.000534/2026-06, paras. 111–14, 139–44 (CADE Mar. 4, 2026), https://cdn.cade.gov.br/portal-ingles/noticias/20260309_RV%20Whatsapp_Opinion%20%281%29.pdf (evaluating interim access, infrastructure defenses, and actual restoration in an official informational English translation). The Brazilian proceedings are Administrative Inquiry No. 08700.012397/2025-63 and Voluntary Appeal No. 08700.000534/2026-06.
[80] CADE mantiene multa diaria contra Meta y WhatsApp (May 22, 2026), https://www.gov.br/cade/en/matters/noticias/cade-mantiene-multa-diaria-contra-meta-y-whatsapp (reporting a dispute over replacement charges and interim compliance).
[81] Giuseppe Colangelo, Integrating AI Assistants and Agents: Competition Policy in Dynamic Markets, at 14–16, International Center for Law & Economics (Feb. 11, 2026), https://laweconcenter.org/wp-content/uploads/2026/02/Giuseppe-Colangelo-Integrating-AI-Assistants-and-Agents-Competition-Policy-in-Dynamic-Markets.pdf (arguing for evidence-based evaluation of integration benefits and restrictions).
[82] Hanming Fang & Soo Jin Kim, Data Neutrality, Data Supply, and Market Competition, abstract & §§ 2, 6 (Apr. 27, 2026 working paper), https://bpb-us-w2.wpmucdn.com/web.sas.upenn.edu/dist/3/517/files/2026/04/2026-4-27-Fang_Kim_Data_Neutrality_v12.pdf(modeling conditional effects of access duties on competition and investment).
[83] Athena Chapekis and Anna Lieb, Google users are less likely to click on links when an AI summary appears in the results (July 22, 2025), https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/ (observing search-click behavior without establishing a general causal effect).
[84] 15 U.S.C. § 45(a), (n), https://uscode.house.gov/view.xhtml?edition=prelim&hl=false&req=granuleid%3AUSC-prelim-title15-section45 (prohibiting unfair methods of competition and unfair or deceptive acts or practices subject to statutory requirements).
[85] Federal Trade Commission Staff, Partnerships Between Cloud Service Providers and AI Developers, at 1, 29, Matter P246201 (Jan. 17, 2025), https://www.ftc.gov/system/files/ftc_gov/pdf/p246201_aipartnerships6breport_redacted_0.pdf (describing commercial partnerships without adjudicating competitive effects).
[86] Andrew N. Ferguson, joined by Melissa Holyoak, Concurring and Dissenting Statement Regarding the FTC Staff Report on AI Partnerships & Investments 6(b) Study, at 1–2, Federal Trade Commission (Jan. 17, 2025), https://www.ftc.gov/system/files/ftc_gov/pdf/ferguson-ai-6b-statement.pdf (supporting factual publication while criticizing speculation and identifying incumbent risks).
[87] Mark R. Meador, Antitrust for Digital Markets, at 3–4, Federal Trade Commission (Mar. 23, 2026), https://www.ftc.gov/system/files/ftc_gov/pdf/Antitrust-for-Digital-Markets-Forum-Meador.pdf (calling for timely enforcement under established antitrust principles).
[88] FTC Office of Inspector General, Semiannual Report to Congress October 1, 2025–March 31, 2026, PDF pp. 5, 8 (June 2026), https://oig.ftc.gov/sites/default/files/reports/2026-06/2026-06-01_SAR%2075%20final.pdf (reporting agency-wide budget and staffing as of March 31, 2026).
[89] Federal Trade Commission, Congressional Budget Justification for Fiscal Year 2027, PDF p. 9 & n.1 (Apr. 3, 2026), https://www.ftc.gov/system/files/ftc_gov/pdf/ftc-fy-2027-congressional-budget-justification.pdf (requesting fiscal 2027 funding and positions rather than reporting enacted appropriations).
[90] Clayton Act § 4, 15 U.S.C. § 15(a) (2024), https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap1-sec15.htm (authorizing qualifying private damages and attorney’s fees).
[91] Clayton Act § 16, 15 U.S.C. § 26 (2024), https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap1-sec26.htm (authorizing relief against threatened antitrust injury).
[92] Federal Trade Commission, The Enforcers, under Private Parties (last visited Oct. 3, 2026), https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/enforcers (distinguishing FTC enforcement from private antitrust actions).
[93] Verizon Communications Inc. v. Law Offices of Curtis V. Trinko, LLP, 540 U.S. 398, 405–16 (2004), https://www.govinfo.gov/content/pkg/USREPORTS-540/pdf/USREPORTS-540-398.pdf (rejecting the asserted sharing duty under established monopolization principles).
[94] Brunswick Corp. v. Pueblo Bowl-O-Mat, Inc., 429 U.S. 477, 487–89 (1977), https://www.govinfo.gov/content/pkg/USREPORTS-429/pdf/USREPORTS-429-477.pdf (requiring injury of the kind protected by antitrust law).
[95] Associated General Contractors of California, Inc. v. California State Council of Carpenters, 459 U.S. 519, 538–45 (1983), https://www.govinfo.gov/content/pkg/USREPORTS-459/pdf/USREPORTS-459-519.pdf (addressing directness, speculative causation, and duplicative recovery).
[96] Cargill, Inc. v. Monfort of Colorado, Inc., 479 U.S. 104, 109–13 & n.6 (1986), https://www.govinfo.gov/content/pkg/USREPORTS-479/pdf/USREPORTS-479-104.pdf (distinguishing requirements for injunctions from damages limitations).
[97] TransUnion LLC v. Ramirez, 594 U.S. 413, 423–31, 435–36 (2021), https://www.supremecourt.gov/opinions/20pdf/594us2r59_197d.pdf (requiring concrete injury for federal judicial standing).
[98] Alphabet Inc. and Others v. Autorità Garante della Concorrenza e del Mercato, Case C-233/23, ECLI:EU:C:2025:110, paras. 39–61, 73–86 (Grand Chamber Feb. 25, 2025), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0233 (addressing interoperability and permissible justifications in a public enforcement reference).
[99] Regulation (EU) 2022/1925, arts. 39, 42 (Digital Markets Act), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R1925 (providing for national-court proceedings and representative actions).
[100] Gesetz gegen Wettbewerbsbeschränkungen [GWB] § 33 (Germany), https://www.gesetze-im-internet.de/gwb/__33.html (providing qualifying remedies for specified DMA breaches).
[101] Gesetz gegen Wettbewerbsbeschränkungen [GWB] § 33a (Germany), https://www.gesetze-im-internet.de/gwb/__33a.html(providing compensation for qualifying intentional or negligent violations).
[102] European Commission, SWD(2026) 123 final, § 5.6 & nn.115–18 (Apr. 28, 2026), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026SC0123 (reporting national DMA litigation as of the review date).
[103] Lena Hornkohl & Alba Ribera Martínez, Collective Actions and the Digital Markets Act: A Bird Without Wings, 70 Antitrust Bull. 3, pt. II.B (2025), https://journals.sagepub.com/doi/10.1177/0003603X241296560 (examining procedural and practical limits on collective DMA enforcement).
[104] Directive (EU) 2020/1828, arts. 4, 7–10, 12, 17–18, and 20, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020L1828 (providing a qualified-entity framework for consumer representative actions).
[105] Directive 2014/104/EU, arts. 1–5, 9–10, and 12–17, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0104(governing specified competition damages claims rather than every DMA-only claim).
[106] Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026, S. 5051, 119th Cong. §§ 3(a)–(b), 3(g), 3(h)(2)(E)(ii), 4(e)–(f), and 5(b) (as introduced July 21, 2026), https://www.govinfo.gov/content/pkg/BILLS-119s5051is/pdf/BILLS-119s5051is.pdf (proposing delegated access, agent duties, and administrative redress without an express private civil action).
[107] GovInfo, S. 5051, AI AGENT Act of 2026, introduced bill record (July 21, 2026), https://www.govinfo.gov/app/details/BILLS-119s5051is (identifying the introduced bill and listed committee referral).
[108] Ellen P. Goodman, Senator Warner Makes a First Foray into Agentic AI Regulation, Tech Policy Press (July 13, 2026), https://www.techpolicy.press/senator-warner-makes-a-first-foray-into-agentic-ai-regulation/ (examining fidelity, auditing, and implementation of the earlier discussion draft).
[109] Alexander v. Sandoval, 532 U.S. 275, 286–91 (2001), https://www.govinfo.gov/content/pkg/USREPORTS-532/pdf/USREPORTS-532-275.pdf (requiring legislative intent to create a private remedy).
[110] Administrative Procedure Act, 5 U.S.C. § 701 (2024), https://www.govinfo.gov/content/pkg/USCODE-2024-title5/html/USCODE-2024-title5-partI-chap7-sec701.htm (preserving statutory limits and exceptions to administrative judicial review).
[111] Administrative Procedure Act, 5 U.S.C. § 704 (2024), https://www.govinfo.gov/content/pkg/USCODE-2024-title5/html/USCODE-2024-title5-partI-chap7-sec704.htm (addressing review of qualifying final agency action).
[112] Administrative Procedure Act, 5 U.S.C. § 706 (2024), https://www.govinfo.gov/content/pkg/USCODE-2024-title5/html/USCODE-2024-title5-partI-chap7-sec706.htm (providing judicial review powers subject to applicable limitations).
[113] American Express Co. v. Italian Colors Restaurant, 570 U.S. 228, 231–39 (2013), https://www.govinfo.gov/content/pkg/USREPORTS-570/pdf/USREPORTS-570-228.pdf (enforcing individual arbitration despite the cost of proving the antitrust claim).