Is Web Scraping Legal? What the Big Court Cases Actually Say

November 8, 2026

This is not legal advice. It is a plain summary of a few well-known US court decisions and EU rules, with links so you can read them yourself. Talk to a lawyer about your own project.

The short answer most lawyers give: collecting publicly available data is often lawful in the US, but how you collect it, what you collect and what you do with it can each create risk. The cases below show where the lines have been drawn so far.

Van Buren v. United States (2021): the "gates" test

The Computer Fraud and Abuse Act (CFAA) makes it a crime to access a computer "without authorization" or to "exceed authorized access". On June 3, 2021 the Supreme Court held that a person exceeds authorized access when they obtain information from parts of a computer, such as files, folders or databases, that are off-limits to them. Misusing information you are allowed to reach is not enough. The case was about a police database, not scraping, but it narrowed the CFAA in a way later scraping cases rely on.

hiQ Labs v. LinkedIn (2017 to 2022)

hiQ scraped public LinkedIn profiles. LinkedIn sent a cease-and-desist and blocked it; hiQ sued. In April 2022, after the Supreme Court sent the case back in light of Van Buren, the Ninth Circuit again found that hiQ's scraping of public profiles likely did not violate the CFAA, because the "without authorization" concept does not fit a website that anyone can view.

That is only half the story. In November 2022 the district court ruled that hiQ had breached LinkedIn's User Agreement, which hiQ had accepted, including by using fake profiles. In December 2022 the parties settled with a consent judgment: $500,000 against hiQ and a permanent injunction to stop scraping LinkedIn and delete the data. The lesson: the CFAA was not the problem. The contract was.

Meta v. Bright Data (2024)

Meta sued Bright Data for scraping Facebook and Instagram. On January 23, 2024, Judge Edward Chen in the Northern District of California granted summary judgment to Bright Data on Meta's breach-of-contract claim. The court read Meta's terms as governing use of its products by account holders, and found that Bright Data did not "use" Facebook and Instagram when it scraped public data while logged out. A separate tortious interference claim remained at the time of the ruling.

X Corp. v. Bright Data (2024)

In May 2024, Judge William Alsup, also in the Northern District of California, dismissed X's claims against Bright Data. Reporting on the order quotes his concern that giving platforms full control over public web data "risks the possible creation of information monopolies that would disserve the public interest." He treated copying public content as a question for copyright law, not for a platform's terms of use.

What these cases suggest

Logged out is different from logged in. Courts have been more forgiving of collecting public pages than of using an account to get data, because accounts come with a contract you agreed to.
Fake accounts are a bad idea. They featured in the hiQ breach ruling.
Contracts and copyright still apply. Winning on the CFAA does not end the question.
These are US cases. Other countries treat database rights, contracts and privacy differently.

Privacy law: GDPR applies to public data too

In the EU and UK, a public profile is still personal data. If you collect data about people, the GDPR asks you for a lawful basis under Article 6, and Article 14 requires you to tell people what you hold, why and where you got it, within a month or at your first contact with them. Article 21 lets them object to direct marketing. Aggregate analysis of public posts carries far less risk than building files on named individuals.

The EU has also opened an official route for research. Under Article 40 of the Digital Services Act, the Commission adopted a delegated act on researcher data access on 2 July 2025, and it entered into force on 29 October 2025 with a data access portal for vetted researchers.

A lower-risk checklist

Collect only public data, and do not log in to collect it.
Do not get around technical barriers such as logins, CAPTCHAs or blocks.
Collect the fields you need, not everything you can.
Prefer aggregate analysis over profiles of individuals.
Do not republish copyrighted content such as full videos or photos.
Keep a record of what you collect, why, and for how long.
Honor deletion and objection requests quickly.
Get legal advice before you build a product on the data.

Doing it with ScrapeIO

ScrapeIO reads only public data and cannot post, DM or act as a user. You call endpoints such as the Instagram profile API or Reddit post comments API and get public fields back as JSON, without managing accounts. You remain responsible for how you use the data, so the checklist above still applies to you.

Sources

Checked on 8 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key