As AI agents increasingly handle interactive tasks for users inside third-party apps and websites, a legal question is taking shape around what kind of permission those systems need in order to operate. A legal analysis published by the WeChat account Internet Law Review, written by Yin Fenglin and republished by MarsBit, examines whether an AI agent acting on a user’s behalf needs only the user’s express authorization or also permission from the owner of the app or webpage being operated — the issue described as “dual consent.”
The article says AI agents can already be used, once clearly authorized by the user, to log into accounts, browse products, fill in forms, check orders, and complete other online interactive tasks. That can improve efficiency in daily life and work. At the same time, some observers argue that agent-based operation may create risks tied to data security and privacy protection for users or for third-party apps and websites.
Two technical routes: API and GUI
The analysis divides current AI-agent operation into two main technical routes: an API model and a GUI model.
API model: platform cooperation is built in
In the API model, the operator of a third-party app or website opens standardized application programming interfaces and sets the rules for permissions, data scope, call frequency, and identity verification. The AI-agent service provider then obtains access credentials through developer qualification checks, cooperation agreements, and similar procedures. Based on the user’s natural-language instructions, the provider can send API requests directly to the third-party platform’s servers, retrieve user data, issue operation commands, and complete tasks on the user’s behalf.
The article notes that this route does not depend on GUI simulation through the user’s local browser. It outlines a four-step workflow:
- The third-party platform opens official APIs for e-commerce ordering, order inquiry, product search, and related functions, while publishing developer access rules and data-use restrictions.
- The AI-agent provider submits corporate qualifications and a description of the intended business scenario, signs an API cooperation agreement with the platform, and obtains a dedicated API key and authorization channels such as OAuth.
- The user authorizes the AI agent and is redirected to the platform’s official OAuth page, where the user can choose the scope of permissions to grant, such as viewing orders only, placing orders, or reading a shipping address.
- The AI-agent provider’s server uses the key and the user’s authorization credential to establish two-way data communication directly with the third-party platform’s servers and carry out queries, orders, payments, and similar actions through API instructions.
The piece highlights several traits of this model. First, the AI agent’s cloud server and the third-party platform’s servers can maintain a long-term two-way direct connection, fully independent of the user’s local device. Second, the service can directly retrieve structured underlying database data from the platform and may be able to obtain user privacy information and transaction data in bulk. Third, the service interacts with the platform through dedicated developer keys, OAuth authentication, and similar mechanisms, which allows the platform to identify the AI-agent provider precisely and exercise direct control over the service.
On that basis, the article argues that the API model requires technical cooperation from the third-party app or website before the AI agent can function in practice. Even without considering separate legal or contractual restrictions, an AI agent operating through APIs needs not only the customer’s permission but also the platform’s API authorization. In the author’s view, the API structure itself creates “dual consent” as an objective condition.
The article adds that large internet groups that already control influential platforms or apps and also want to build AI-assisted operational services would have stronger incentives to adopt the API route. That path can help form a closed ecosystem linking AI services with internet-platform services, making it one of the approaches large companies are using in AI planning.
GUI model: local-device simulation without direct server access
The GUI model is organized differently. In this route, the AI agent is deployed and run on the user’s local device, such as a phone or computer. It reads the information displayed on the screen of a third-party app or webpage through screenshots, image recognition, OCR text parsing, and interface-element positioning, then simulates human actions such as clicking, typing, swiping, and placing an order.
The article stresses one feature here: neither the AI agent nor its server establishes a direct communication link with the third-party app or website server.
To illustrate the model, the piece points to the case of Amazon.com Services, LLC v. Perplexity AI, Inc., describing the defendant’s agent service as a typical GUI-based route. It lays out a five-step operating process:
- The user logs into an Amazon account through the Comet browser provided by the defendant on a phone or computer. The account password and session cookie are stored entirely on the user’s local device, while Amazon’s servers send HTML pages, images, and text data to the user terminal.
- The user gives the AI agent a natural-language command, such as “Help me choose sports shoes under $300 and check out.”
- The AI agent captures a screenshot of the current browser screen and uploads the image data to the defendant’s cloud server. The cloud server parses page elements and generates the next operation instruction, but never sends any network request directly to Amazon’s servers during the process.
- The cloud server sends the operation sequence back to the user’s local browser, and the local browser program then sends standard user requests such as click, jump, and order placement to Amazon’s servers.
- Amazon’s servers return the result to the user terminal, the page is rendered in real time, and the agent continues the screenshot loop until the user’s instructions are completed.
According to the article, the GUI model does not require negotiation with major apps or online platforms over interface access. That gives it a lower development threshold and broad platform compatibility, which is why it has become one of the technical paths adopted by newer AI service providers. The broader market, the author says, is now seeing API-based and GUI-based routes develop in parallel.
How the GUI model is characterized in law
The article then turns to the legal nature of GUI-based AI-agent operation.
It says that because the GUI model does not require technical cooperation from the third-party app or webpage, an AI agent can automatically and normally operate those services once the user has authorized it. Even so, third-party platforms may still argue from a competitive-interest perspective that the agent should not be allowed to operate unless the platform has granted permission.
Whether that argument is persuasive depends, in the author’s view, on how GUI-based agent activity is classified in legal terms.
For the third-party platform, the article argues, an AI agent acting through a GUI model should be treated as an extension of the customer’s own conduct rather than conduct by the AI-service provider. It compares this with a classic civil entrustment relationship. The similarity is that both involve a principal using outside resources to handle civil matters. The difference is that in a conventional civil entrustment the principal relies on a third-party civil subject, while in GUI-based agent operation the customer relies on a tool supplied by a third party.
The article says some views have tried to treat GUI-based operation as conduct attributable to the AI-provider rather than to the customer, but that position has been rejected in judicial practice. It cites the Amazon v. Perplexity AI case and says the U.S. Court of Appeals for the Ninth Circuit clearly rejected an argument built on civil entrustment or agency.
In that dispute, according to the article, Amazon argued that when users employed the defendant’s AI agent to access Amazon webpages in GUI form, interact with the platform in real time, and make automated purchases, those acts should be attributed to the defendant itself rather than to the users. The Ninth Circuit disagreed, saying the users’ contact with Amazon’s webpages through the defendant’s AI tool did not amount to “access” by the defendant to Amazon’s platform system in the legal sense.
The article explains that, in law and in computing, “access” refers to entering the computer system itself or a specific part of that system, such as a file, folder, or database. In the case described here, the defendant only supplied the AI tool. It was the user who used that tool to access the plaintiff’s platform system. Even if the defendant’s server received forwarded screenshots or transmitted instructions through the agent, those acts were not enough to classify the defendant as accessing the plaintiff’s system.
That reasoning leads the author to conclude that U.S. courts have treated GUI-based AI-agent services as tools, with the resulting online actions remaining the user’s own acts rather than those of the AI-provider. The article says that view is consistent with the technical reality of the GUI model and offers a useful reference point for China.
The piece also says GUI-based operation is fundamentally different from a conventional agency or entrustment relationship. In an entrustment relationship, the entrusted party is a subject with independent judgment and civil liability capacity. An AI agent might, to a degree, appear to have “independent judgment,” but it plainly does not have civil liability capacity.
The article adds that while the AI-provider can enable execution and judgment in handling tasks assigned by the user, that “independent execution and judgment” is triggered by the user’s instruction and carried out by the agent itself. The provider does not intervene in that instruction. For that reason, under the GUI model, neither the AI agent nor the AI-provider should be regarded as the customer’s entrusted agent. The more suitable view, the author writes, is to treat the AI agent as the customer’s tool.
From there, the article reaches a practical legal conclusion: because the agent is acting as a tool for the customer in activities such as automated shopping, and is acting for the customer rather than for the provider, the user’s existing authorization to use the third-party app or webpage should ordinarily extend to the use of the AI service itself. In other words, a customer using a GUI-based operational service should not need “additional permission” from the third-party app or webpage platform. For the same reason, because the AI-provider is not a party to the underlying transaction, the provider also would not ordinarily need separate permission from that platform when the customer uses GUI-based agent services.
Whether platform restrictions are enforceable
The final part of the article examines the legal force of platform clauses that restrict AI-agent operation.
It says automated operation by users can improve convenience, but it may also disrupt business models built around human interaction, ad monetization, and traffic operations. As a result, many large internet platforms use user agreements, platform rules, and privacy policies to include clauses that restrict or prohibit the use of AI agents and similar tools for automated operation. Courts and legal practice have not treated these clauses uniformly.
The article presents the two sides. Supporters say platforms, as network-service operators, are entitled to manage their own systems, operating order, and commercial resources, and that regulating user behavior through contracts falls within lawful business autonomy. Opponents argue that these clauses are usually unilaterally drafted standard terms that excessively limit users’ digital usage rights and freedom of choice, effectively lock down platform traffic entrances, and deprive users of a legitimate opportunity to improve efficiency through new technology. On that view, the restrictions should be regarded as unreasonable and invalid.
In legal character, the article describes these provisions as standard-form restrictive clauses within network-service contracts between platforms and users. They are unilateral, standardized, and broadly applied. The platform drafts them in advance, and the user can only accept or reject them as a whole, with no room to negotiate changes. The piece says that places them within the definition of standard terms under Article 496 of China’s Civil Code, meaning their validity should be judged under the rules governing that category.
The author does not treat the answer as absolute. Under the Civil Code and related judicial logic, the enforceability of a clause restricting AI-agent operation is neither automatically valid nor automatically invalid. It must be assessed in light of the content of the clause, the scenario in which it is applied, the degree of restriction, and the basis claimed for its legitimacy.
The article identifies two conditions for a standard clause to take effect under the Civil Code. First, the party providing the standard clause must meet its duty of notice and explanation by using a reasonable method to alert the other party to clauses that materially affect that party’s interests, including clauses that exempt or reduce the provider’s liability, and by explaining the clause if asked. Second, the substance of the clause must not fall into a category of statutory invalidity: it may not exclude the other party’s main rights, increase the other party’s liability, or exempt the drafting party from legal responsibility.
In practice, the article says, some restrictive clauses suffer from procedural defects. Some platforms bury restrictions on AI-agent use inside lengthy user agreements, using the same font and layout as ordinary clauses and failing to highlight them through bold text, pop-up notices, or separate confirmation. Ordinary users may not notice the restriction at all. In the author’s view, a clause that prohibits or restricts AI services affects users’ significant interests in the AI era. If the platform has failed to satisfy the legally required notice and explanation obligations, that clause should not bind the user.
The article says the reasonableness of the clause’s substance is the central issue.
If a clause reasonably targets malicious or non-compliant AI-agent activity — such as malicious fake orders or large-scale intrusion that harms platform order — then the restriction falls within legitimate platform governance. Because such a clause does not eliminate the user’s core rights, it can be treated as lawful and effective.
But if a clause imposes a blanket ban on all AI-agent operation, including user-authorized, small-scale, non-profit, non-malicious everyday convenience uses, or reasonable GUI-based operation by users, then the article says the clause overreaches. In that scenario it excessively restricts user rights and excludes the user’s primary usage rights, which would fit the invalid standard-term scenarios described in Article 497 of the Civil Code.
The original article was published by the WeChat account Internet Law Review and credited to Yin Fenglin. MarsBit carried the piece on Sept. 4.