Overview
Perplexity is an “answer engine”: you type a question, it reads the web and writes you a paragraph with numbered citations underneath. As of mid-2026 it reports roughly 45 million monthly active users and more than a billion queries a month, and it closed a funding round in June 2026 at a valuation around $20 billion. Comet, its Chromium-based AI browser, launched in July 2025 for Max subscribers, went free worldwide in October 2025, and arrived free on iOS in March 2026.
The product is built as the anti-Google, and on one axis it genuinely is. Perplexity stopped taking new advertisers in October 2025 and confirmed a full exit from advertising in February 2026, with executives arguing that sponsored answers would make users “suspicious of everything.” Ads had been under 0.1% of revenue, so the sacrifice was small — but the resulting business model is subscriptions and enterprise contracts rather than behavioural targeting. That is a real structural difference from most of the products in this Index, and it is why this entry does not end in a D.
The trouble is on the other side of the ledger: where the answers come from, and what the browser sees while it fetches them.
What It Knows About You
The web product knows your queries, your account, and your search history. Comet knows considerably more, because an AI browser reads the page you are looking at and can act inside sessions you are already logged into.
AI training on consumer plans (Free, Pro, Max) is on by default; opting out means finding the “AI data retention” toggle in account settings, and it applies only going forward. On July 2, 2026, Perplexity replaced its privacy policy with a restructured privacy notice. Three things that had been written into the old document are no longer in it: the AI-training opt-out, the 30-day account-deletion timeline, and the promise to notify users of material changes — new versions are now simply posted to the site. The corresponding controls still exist in the product. But a commitment written into a policy and a switch in a settings panel are different kinds of promise, and only one of them is hard to withdraw.
The same update expanded what the notice says the company may collect: Comet browsing data, voice, and — if you enrol in Perplexity Health — health, genetic, biometric and neural data. Perplexity states that it does not sell or share sensitive personal data for cross-context behavioural advertising, and transfers it to third parties only when you instruct it to.
Retention differs sharply by tier, and the differences are worth knowing before you put work data into it. Consumer uploads are generally deleted after about 30 days. Enterprise Pro/Max is not used for training and holds uploads roughly 7 days, with custom retention available. The Sonar API is zero-retention: prompts and responses are discarded after processing.
The Real Risks
How the content is acquired. On August 4, 2025, Cloudflare published findings that Perplexity was reaching sites that had blocked PerplexityBot by falling back to undeclared crawlers using a generic Chrome-on-macOS user agent and rotating IP addresses. Cloudflare put the volume at 20–25 million daily requests from the declared crawler plus a further 3–6 million from the undeclared one, across tens of thousands of domains, and de-listed Perplexity as a verified bot. Perplexity denied the findings and called the report a publicity stunt. The New York Times made a similar allegation in its December 2025 complaint, saying Perplexity made more than 175,000 attempts to reach nytimes.com in August 2025 alone after a hard block was in place.
The litigation docket. Dow Jones and the New York Post sued in October 2024; Encyclopaedia Britannica and Merriam-Webster in September 2025; Reddit in October 2025; the Chicago Tribune, CNN, Japan’s Yomiuri Shimbun, and The New York Times in December 2025. This is a risk to you as a user, not only to the company: an adverse ruling can change what a search product is permitted to show you.
Agentic browsing is a new attack surface. Brave’s security team documented indirect prompt injection in Comet in August 2025 — instructions hidden in a page (white text on white, HTML comments) that could steer the assistant into reading saved data and exfiltrating it to an attacker’s server. An October 2025 follow-up found the same class of attack hidden inside screenshots. Brave’s own framing is that this is systemic to AI browsers rather than one vendor’s bug.
An agent acting inside your accounts. Amazon sued in November 2025 over Comet’s assistant operating in logged-in Prime sessions; a district judge enjoined it on March 9, 2026; the Ninth Circuit vacated that injunction on August 4, 2026, holding that under the CFAA it is the user, not Perplexity, who “accessed” Amazon’s computers. That is a win for Perplexity and a landmark for agentic commerce — and it also means that when the agent does something in your account, the law currently treats that as you doing it.
Accuracy. Columbia’s Tow Center tested 1,600 queries across eight AI search engines in March 2025 and found them wrong more than 60% of the time. Perplexity was the best performer, at 37% wrong. Best in class still means a bad citation in more than one answer in three, delivered in the same confident register as the correct ones.
Alternatives
- Kagi — paid, ad-free search that returns links rather than conclusions. You do the judging; nothing is trained on you.
- Brave Search or DuckDuckGo — free, less profiling than Google, and Brave runs its own index rather than reselling someone else’s.
- Perplexity Enterprise or the Sonar API — if the tool has to be Perplexity because it is already in your team’s workflow, these tiers do not train on your data and retain far less. This is the single easiest risk reduction available here.
- Comet is optional. Most of the exposure in this entry comes from the agentic browser, not the search box. Using perplexity.ai in an ordinary browser removes the prompt-injection and logged-in-session risks entirely.
- Treat it as an index, not an oracle. The citations are the product’s best feature and they are clickable. Following them costs thirty seconds and catches the 37%.
- The low-tech option: a reference librarian, a subject database, or the primary document itself. Slower, and right substantially more than 63% of the time.
Our Verdict
C — use with caution. As of August 2026, Perplexity is one of the less predatory products in this Index and one of the most legally contested, and both of those things are true for the same reason: it is trying to build a search business without advertising, and the way it has gone about sourcing content has made enemies of most of the publishers it cites.
The scores reflect that split. Privacy lands at 7 — not because Perplexity monetises your data (it does not appear to) but because the July 2026 notice moved key protections out of the document while widening what the company says it may collect, and because Comet sees a great deal. Bias is a 5 for the citation-accuracy problem, which is documented and which harms both readers and the outlets being misattributed. Job threat is a 6: the referral economics of news are genuinely being reshaped, though Perplexity’s Comet Plus programme — a $42.5 million pool paying out 80% of pooled subscription revenue to participating publishers — is a more serious attempt at compensation than any rival has made. Autonomy is a 6, mostly for the agentic browser.
Lock-in is a 3, and that is the honest number. This is a search box and a Chromium browser. There is no proprietary format holding your work, no ecosystem, and a month-to-month subscription. If you decide tomorrow that you are done, you close the tab and open a different one. Very few products rated here can say that, and it should count.
What would move the grade. Down: a ruling that forces the product to strip citations or sources, evidence that health or voice data collected under the new notice is being used beyond the feature that gathered it, or another prompt-injection class in Comet that reaches credentials. Up: restoring the training opt-out and deletion timeline as written commitments rather than settings toggles, a durable licensing settlement with the major plaintiffs, and an independent re-run of the Tow Center methodology showing the error rate meaningfully below 37%.