Overall risk · medium
jurisdictionhigh
Perplexity AI, Inc. is a US-incorporated company fully subject to CLOUD Act and (likely) FISA Section 702, with no confirmed EU legal entity or EU-resident data centre — US authorities can compel data production without EU judicial oversight.
compliancehigh
Active, escalating stack of copyright litigation from major publishers (Dow Jones/News Corp, New York Times, Chicago Tribune, CNN, Reddit) alleging unauthorised scraping and redistribution of content — unresolved financial and reputational exposure.
governancemedium
Cloudflare publicly alleged (August 2025) that Perplexity used undeclared stealth crawlers mimicking browsers and rotating IPs to bypass robots.txt and firewall blocks; Cloudflare de-listed Perplexity as a verified bot. Perplexity has denied wrongdoing.
securitymedium
Comet AI browser has had multiple disclosed vulnerabilities in 2025-2026, including a critical indirect prompt-injection flaw ('HashJack') initially dismissed before being fixed, and a disputed hidden MCP API issue reported by security researchers.
privacymedium
A pending (as of April 2026) lawsuit alleges Meta and Google tracking technologies operated within Perplexity's product even in incognito mode; Perplexity disputes the allegations, and the outcome is unresolved.
compliancemedium
No public EU AI Act compliance statement, GPAI transparency documentation, or confirmed Code of Practice participation has been identified, despite GPAI obligations applying since August 2025.
securitylow
An independent researcher reported (December 2024) that user-uploaded files (images via Cloudinary, documents via AWS S3) were accessible without authentication via direct URL, raising concerns about incidental PII exposure.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.