Is scraping X (Twitter) legal? What the cases say

November 8, 2026

This is not legal advice. It is a summary of public court decisions and X's own terms, with links so you can read them yourself. Laws differ by country, and the cases below are from US courts. Talk to a lawyer about your specific use.

What X's terms say

X's Terms of Service (effective 9 October 2026) say you may not access the services other than through published interfaces, and add: "crawling or scraping the Services in any form, for any purpose without our prior written consent is expressly prohibited." They also set liquidated damages of $15,000 per 1,000,000 posts for requesting, viewing or accessing more than 1,000,000 posts in any 24-hour period in breach of the terms. X terms

Terms are a contract. Whether they bind you depends on facts such as whether you agreed to them, for example by creating an account.

The cases

X Corp v. Bright Data (N.D. Cal., 2024)

X sued Bright Data for scraping and selling public X data. On 9 May 2024 Judge William Alsup dismissed the claims. Morrison Foerster He wrote that giving platforms full control over public web data "risks the possible creation of information monopolies that would disserve the public interest". CNBC The case continued, and in June 2025 the parties told the court they had reached a settlement in principle. MLex A settlement does not create precedent.

X Corp v. Center for Countering Digital Hate (N.D. Cal., 2024)

X sued a nonprofit that studied hate speech on the platform, partly over how it collected data. In March 2024 the court dismissed the case under California's anti-SLAPP law, finding it was about punishing the defendants for their speech. EFF X appealed to the Ninth Circuit. EFF Check the appeal's current status before relying on it.

Meta v. Bright Data (N.D. Cal., 2024)

On 23 January 2024 Judge Edward Chen granted Bright Data summary judgment on Meta's contract claim, finding that Bright Data did not "use" Facebook and Instagram when it scraped public data while logged off. The ruling turned on logged-off access to public data. JD Supra

hiQ Labs v. LinkedIn (9th Cir., 2022)

The Ninth Circuit held that hiQ raised serious questions about whether scraping publicly available profiles is access "without authorization" under the Computer Fraud and Abuse Act. opinion The case did not end there. In November 2022 the district court found that hiQ had breached LinkedIn's User Agreement through its scraping and its use of fake accounts, and in December 2022 the parties filed a consent judgment of $500,000 against hiQ with a permanent injunction. Proskauer Contract claims can still bite when the CFAA does not.

Van Buren v. United States (US Supreme Court, 2021)

The Supreme Court read the CFAA's "exceeds authorized access" clause as a "gates-up-or-down inquiry": either you can access a part of a system or you cannot. opinion The Ninth Circuit applied that reasoning in hiQ: public pages have no gate to pass. The statute itself is 18 U.S.C. 1030.

What the pattern suggests

Public and logged-off is the strongest position in these US cases. Logged-in scraping, or getting around technical blocks, was not blessed by any of them.
Contract claims are the main risk, not federal hacking law, for public data. Creating an account usually means agreeing to the terms.
Privacy law is separate. Collecting personal data can trigger GDPR, CCPA and similar laws regardless of how the data was obtained.
Copyright is separate. Posts belong to their authors. Analysis is different from republishing.

A practical checklist

Do you need to log in to get the data? If yes, the terms you agreed to apply.
Are you collecting personal data about EU or UK residents? Plan a lawful basis and minimize fields.
Will you republish posts in full? Think about copyright and attribution.
Could the official API do the job? It removes the terms question for X.
Write down your purpose, sources and retention period. It helps with every question above.

Where ScrapeIO fits

ScrapeIO reads only public data, cannot post, DM or act as a user, and does not give you anything behind a login. You still decide what you collect and how you use it. Endpoints such as the X profile API and the X post API return public fields only. For write access or a direct contract with X, use the official X API.

Sources

Checked on 8 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key