Is web scraping legal? Collecting publicly visible web data with a script is not, by itself, a federal crime under the main US hacking statute, the Computer Fraud and Abuse Act (CFAA). But “not a CFAA crime” is far from “risk free.” Scrapers still get sued under contract law, copyright, anti-circumvention rules, trespass theories and privacy laws, and the result depends on what was taken, how, and from where. This covers US law as checked on October 10, 2026.

The short version, by legal theory

Scraping is not one legal question. It is a bundle of them, and each has a different answer.

Legal theory Where scraping public pages stands
CFAA (federal anti-hacking law) Hard to use against scraping of pages open to anyone; stronger when a password or login gate is bypassed
Breach of contract (terms of service) Possible, but depends on whether the scraper actually agreed to the terms
Copyright Facts are not copyrightable; creative text, photos and databases can be
DMCA anti-circumvention (section 1201) Tested in 2026; one major attempt against a scraper was dismissed
Trespass to chattels / server harm Viable when scraping measurably burdens servers
Privacy and data protection law Applies to personal data regardless of how it was obtained

The CFAA after Van Buren

The CFAA bars accessing a computer “without authorization” or in a way that “exceeds authorized access.” For decades, people argued over whether violating a website’s rules turned a visit into a crime. In Van Buren v. United States, decided June 3, 2021, the Supreme Court gave a narrower reading. A person exceeds authorized access, it said, when they obtain information from parts of a computer, such as files, folders or databases, that are off-limits to them. The opinion frames this as a “gates-up-or-down” inquiry: either you can get past the access barrier or you cannot. Read the opinion on the Supreme Court’s website.

The case itself involved a police officer who ran a license plate search for money, in violation of department policy. The Court held that policy violations alone were not enough. In a footnote, however, it left open whether the gates inquiry looks only at technical, code-based limits or also at limits set by contracts or policies. So the question that matters most to scrapers was not settled.

hiQ v. LinkedIn: the case everyone cites

hiQ scraped public LinkedIn profiles to build analytics products. LinkedIn sent a cease-and-desist letter and blocked it. In September 2019 the Ninth Circuit upheld a preliminary injunction for hiQ, reasoning that accessing publicly available profiles was not “without authorization” under the CFAA. The Supreme Court then vacated that judgment in June 2021 and sent the case back for reconsideration in light of Van Buren. In April 2022 the Ninth Circuit again affirmed, holding that continuing to scrape after a cease-and-desist letter was not “without authorization” because, in its words, the computer “has erected no gates to lift or lower in the first place.” That timeline comes from a National Law Review article published on April 19, 2022.

Two cautions. This is a Ninth Circuit ruling on a preliminary injunction, not a Supreme Court rule. And the same article notes that contract and trespass-type claims could still be available to companies whose public data is scraped. I did not retrieve sources on how the dispute ended, so I am not stating a final outcome here.

Terms of service: the claim that actually bites

If the CFAA is a weak tool against public scraping, contract law is the stronger one. A site’s terms can prohibit automated collection, and a company can sue for breach. The weak spot is formation: was the scraper bound by the terms at all?

In Meta v. Bright Data (N.D. Cal.), Judge Edward Chen denied Meta’s motion for partial summary judgment on its breach-of-contract claim in January 2024. As TechCrunch reported, Meta had not shown that Bright Data scraped while logged in; the court treated a logged-off visitor differently from a “user” who accepted the terms, and said getting past a CAPTCHA “is different from accessing a password-protected website.” Meta then dropped its claim in late February 2024, which CTech reported, though Bright Data said it was not a settlement.

The lesson is narrow. Scraping while logged in to an account that accepted terms is a different position from scraping public pages as an anonymous visitor. That ruling is a single district court’s view and does not bind others. More on how courts treat website terms generally is in our guide to click-through terms.

Server harm and preemption: X Corp. v. Bright Data

X Corp. sued Bright Data in July 2023. Judge William Alsup held that federal copyright law preempts X’s claims about the sale and misappropriation of publicly posted user data. But in November 2024 he allowed X to refile claims built on server harm, after X alleged that scrapers used server capacity abnormally, caused intermittent failures and forced it to buy extra capacity, per MediaPost. I did not find the later history of that case.

Practically, a scraper that hammers a site can be sued for the damage it causes even if the data itself is public.

The 2026 twist: circumvention claims

Google sued SerpApi under section 1201 of the DMCA, arguing that bypassing its SearchGuard anti-bot system, including CAPTCHA solving, was illegal circumvention. On July 20, 2026, Judge Yvonne Gonzalez Rogers dismissed those claims. According to PPC Land, she reasoned that search results mix copyrighted and non-copyrighted material, so the system did not “effectively control access” to a copyrighted work for ordinary results. The claims about copyrighted Knowledge Panel content were dismissed with leave to amend, and Google had 21 days to refile. A MediaPost report described the ruling similarly. I have not checked whether Google amended.

Public does not mean free to reuse

Much of the confusion comes from treating three separate ideas as one. Whether you may access a page, whether you may copy what is on it, and whether you may use it for a given purpose are different legal questions. The CFAA cases above deal mainly with the first. The X Corp. ruling touched the second by holding that copyright law displaced certain claims about reselling public user posts, but that is a trial-court view, and a site’s own creative content, such as articles, photographs and original compilations, can still be protected by copyright when someone republishes it.

The third question is where purpose matters. Collecting prices to compare them, archiving pages for research, building a competing directory and feeding a commercial product all look similar at the technical level and very different to a judge. Courts have looked at factors such as whether the scraper sold the data or the scraping tools, whether it burdened servers, and whether personal information was involved. Before launching a scraper at scale, it is worth asking not only “can I reach this page” but “what will I do with what I collect, and who might object.”

A practical checklist for anyone scraping

  • Is the data public to any visitor, or behind a login or paywall?
  • Did you create an account and accept terms? If so, a contract claim is stronger.
  • Are you copying facts, or creative material such as articles and photographs?
  • Does the data include personal information about identifiable people?
  • How fast do you crawl? Load that degrades a site invites a server-harm claim.
  • Have you been told to stop in writing? Continuing is not a CFAA violation under hiQ, but it can fuel other claims.
  • Will you resell the data or the scraping tool, as in the Bright Data cases?

What varies by state

The CFAA is federal, but states have their own computer-crime statutes, and many mirror its language. State privacy laws, including California’s, can apply to personal information a scraper collects. Contract and trespass law are state-law doctrines, so results differ by court. Outside the US, the picture is different: the EU’s data protection rules apply to personal data even if it is publicly visible.

Related questions

Does robots.txt make scraping illegal?

Not by itself. It is a technical convention, not a statute. Courts have not treated ignoring it as a CFAA violation on its own, though it can be evidence in a contract or harm dispute. I did not locate a controlling case that says otherwise.

Can I scrape for research or journalism?

Many do, but there is no blanket exemption. The same questions about access, terms and personal data apply, and an institution’s review board or counsel often sets its own rules.

Is scraping to train AI models allowed?

That is a separate and still contested copyright question being litigated. It is not resolved by the CFAA cases above.

This is general information about US law, not legal advice for your situation.

Sources