Disclosure: This article contains no affiliate links, and it is not legal advice. It’s an explainer of public court decisions and regulations, written for founders deciding whether a scraping project is worth the risk. For a decision that carries real liability, hire a lawyer in your jurisdiction — this article’s job is to make that conversation cheaper and smarter.
“Is web scraping legal?” is the wrong question, and the case law proves it. The company that won the most famous scraping ruling in history still lost its business over scraping. The company that beat Meta in court did so on a technicality about login states that most founders have never heard of. Scraping isn’t one activity with one legal answer — it’s a stack of separate questions, and you can pass four of them and fail the fifth.
- The one distinction every ruling turns on: logged out vs. logged in
- hiQ v. LinkedIn: the victory that killed the victor
- Meta v. Bright Data: logged-out scraping survives a contract claim
- X Corp v. Bright Data: a dismissal that ended in a settlement
- The other four questions (where founders actually get hurt)
- 1. Is it personal data? Then GDPR and CCPA enter the room
- 2. Is it copyrighted expression?
- 3. What does robots.txt actually do?
- 4. Are you defeating a technical barrier?
- A practical risk ladder for solo founders
- FAQ
- Methodology
- AWL verdict
- Sources
This article walks the stack: what US courts have actually decided (hiQ v. LinkedIn, Meta v. Bright Data, X Corp v. Bright Data), what privacy law adds on top (GDPR, CCPA), and where the line between “public data” and “personal data” changes everything.
The one distinction every ruling turns on: logged out vs. logged in
Strip away the headlines and nearly every modern scraping decision reduces to a single fact pattern: was the data accessible to anyone on the open web, or did getting it require an account?
- Public, logged-out data — pages any visitor can open without credentials — sits in the safest territory US law currently offers.
- Logged-in data — anything behind authentication — is where contracts, the CFAA, and fake-account liability all come alive.
Keep that split in mind; every case below hangs on it.
hiQ v. LinkedIn: the victory that killed the victor
hiQ Labs scraped public LinkedIn profiles to sell workforce analytics. LinkedIn sent a cease-and-desist and blocked its servers; hiQ sued. In April 2022, the Ninth Circuit held that scraping public profiles likely does not violate the Computer Fraud and Abuse Act (CFAA) — the federal anti-hacking law — because a page with no password gate has no “gate” to circumvent. “Without authorization” doesn’t apply to a website that is, by design, open to the world. That’s the ruling behind a thousand “scraping is legal” blog posts.
Then the part the blog posts skip. The case went back to the district court on LinkedIn’s other claims, and in October/November 2022 the court found hiQ had breached LinkedIn’s User Agreement — a contract hiQ had accepted — which expressly prohibited scraping. Worse, contractors working for hiQ had created fake LinkedIn accounts, breaching the agreement’s ban on false identities and exposing hiQ on the password-protected-access theory too.
The December 2022 ending: a consent judgment with a $500,000 payment, a permanent injunction against scraping LinkedIn, and an order to delete the data and destroy the code. hiQ is defunct.
The lesson for founders: the CFAA was only one weapon. Winning the hacking-law argument did not save hiQ from contract law. If you create an account, you accept terms — and terms that prohibit scraping are enforceable against you, even when the underlying pages are public.
Meta v. Bright Data: logged-out scraping survives a contract claim
Bright Data — one of the largest scraping infrastructure companies — sold datasets that included public Facebook and Instagram data. Meta sued for breach of contract. In January 2024, Judge Chen of the Northern District of California granted summary judgment to Bright Data on the contract claim, reasoning that Meta’s terms govern a person’s “use” of the platforms, and Bright Data — which had terminated its own Meta accounts — was not a “user” when it scraped logged-out, publicly visible pages. There was no evidence Bright Data scraped anything from behind a login.
In February 2024, Meta dismissed its remaining claim and waived its right to appeal. No settlement payment; Bright Data changed nothing.
The lesson, precisely stated: a platform’s terms of service do not automatically bind a stranger who never agreed to them and only reads what any logged-out visitor can read. That is a much narrower — and much more useful — holding than “scraping is legal.”
X Corp v. Bright Data: a dismissal that ended in a settlement
X sued Bright Data in 2023 on contract, tort and access theories. In May 2024, Judge Alsup dismissed the complaint, holding that X’s claims based on copying public data were preempted by the Copyright Act and its access claims weren’t adequately pleaded — but he gave X leave to amend. X amended; Bright Data counterclaimed on antitrust grounds; and in June 2025 the parties settled on confidential terms and the case was dismissed.
The lesson: even a strong early dismissal is a district-court ruling on the pleadings, not a final merits judgment, and platform-versus-scraper fights can simply end in a private deal. Precedent from this corner of the law is thinner and more fragile than vendors’ marketing suggests.
The other four questions (where founders actually get hurt)
1. Is it personal data? Then GDPR and CCPA enter the room
Court rulings about access say nothing about what you collected. A public profile is still personal data if it identifies a person. If any of it belongs to people in the EU/EEA, the GDPR applies to you wherever your company is based — you need a lawful basis to process it, a retention policy, and a way to honor erasure requests. GDPR fines run up to €20 million or 4% of global annual turnover, whichever is higher. California’s CCPA/CPRA gives residents rights over their personal information too, including opt-outs of its “sale” or “sharing” — and scraped lead lists are exactly the kind of dataset regulators look at. This is the live risk in the Clay + n8n lead-enrichment pattern: the enrichment workflow is legal to build; the list it produces is regulated the moment you store it.
2. Is it copyrighted expression?
Facts aren’t copyrightable; expression is. Prices, dates, specs and other raw facts are generally safe to extract. Republishing a site’s articles, photos, reviews or creative copy wholesale is a copyright problem regardless of how public the page was — X’s preemption argument in the Bright Data case cut the other way, but it doesn’t license you to republish content. Extract facts; don’t clone libraries.
3. What does robots.txt actually do?
Robots.txt has no direct legal force — it’s a voluntary convention (the Robots Exclusion Protocol), not a statute. But treating it as meaningless is a mistake: ignoring a site’s stated access preferences has been noted by courts as evidence of bad faith, and it hands opposing counsel a narrative. Respecting robots.txt and rate limits is cheap risk management, and hammering a small site’s servers can create separate liability theories (trespass to chattels was among the claims hiQ stipulated to).
4. Are you defeating a technical barrier?
Circumventing CAPTCHAs, IP blocks and paywalls after being cut off moves you toward the CFAA fact pattern hiQ lost on — access after authorization is revoked, via deception. Fake accounts are the clearest red line: they featured in hiQ’s downfall and in the stipulated CFAA count in its settlement. If your scraping plan requires lying about who you are, the plan is the problem.
A practical risk ladder for solo founders
| Activity | Relative risk (US, 2026) | Why |
|---|---|---|
| Scraping public, logged-out pages for facts (prices, listings) | Lower | hiQ CFAA ruling; Meta v. Bright Data on contract scope |
| Scraping public pages that contain personal data, at scale | Moderate–high | GDPR/CCPA attach to the data regardless of access legality |
| Scraping after creating an account whose ToS ban scraping | High | hiQ lost on exactly this — breach of contract |
| Scraping behind logins, with fake accounts, or past technical blocks | Highest | Fake accounts + password-protected access sank hiQ; CFAA exposure returns |
| Republishing scraped creative content as your own | High | Copyright is independent of the access question |
None of this is hypothetical infrastructure — the scraping stack itself (providers, per-page costs) is priced in our web scraping cost comparison, and the pipelines founders build with it are in the automated research pipeline guide. The legal layer sits on top of both. (For a neighboring legal explainer, see our breakdown of n8n’s fair-code license — different law, same habit of reading the actual terms.)
FAQ
Is scraping public data legal in the US in 2026?
Generally defensible, per the current case law: the Ninth Circuit’s hiQ ruling says accessing public pages doesn’t violate the CFAA, and Meta v. Bright Data (2024) held that logged-out scraping of public data wasn’t even a breach of Meta’s terms. “Defensible” is not “risk-free” — contract claims, privacy law and copyright still apply, and most of this precedent is Ninth Circuit / district-court level.
Does violating a site’s terms of service make scraping illegal?
Not under the CFAA by itself — a ToS violation is a contract issue, not hacking. But if you accepted those terms (you have an account), the contract claim is real: it’s the claim that produced a $500,000 judgment and a permanent injunction against hiQ. If you never agreed to the terms and only read logged-out pages, Meta v. Bright Data says the contract may not reach you at all.
Is robots.txt legally binding?
No — it’s a voluntary standard with no direct legal force. But courts have treated deliberately ignoring it as evidence of bad faith, and it’s one of the cheapest risk-reduction steps available. Treat it as a strong default, not a law.
Can I scrape LinkedIn?
LinkedIn is the single most-litigated scraping target in this space. Its User Agreement prohibits scraping and fake accounts, its enforcement is aggressive, and the hiQ saga ended with the scraper destroyed. Whatever the public-data CFAA argument is worth elsewhere, LinkedIn is where it has been tested hardest — most founders should treat it as out of bounds and use official APIs or licensed data providers instead.
Does the GDPR really apply to a non-EU founder scraping public data?
Yes, if the personal data belongs to people in the EU/EEA — the GDPR follows the data subject, not the scraper’s address. The same logic applies to scraped personal data generally: privacy law regulates what you hold and use, separately from how you got it.
What’s the single riskiest scraping behavior?
Fake accounts and login-based collection. It converts a defensible public-access position into contract breach plus potential CFAA exposure — it’s the fact pattern that turned hiQ’s appellate win into a company-ending settlement.
Methodology
What we did: Summarized the primary scraping cases as reported by court-focused coverage and legal analyses — hiQ Labs v. LinkedIn (Ninth Circuit 2022; N.D. Cal. consent judgment, December 2022), Meta Platforms v. Bright Data (N.D. Cal. summary judgment, January 2024; remaining claim dismissed February 2024), and X Corp v. Bright Data (dismissed in part May 2024; settled June 2025) — and cross-checked the outcomes across multiple independent legal sources, October 2026. GDPR fine ceilings are stated in the regulation itself (€20M or 4% of global turnover).
What we did NOT do: We are not lawyers, we did not read the full dockets, and this is not legal advice. Case summaries are simplifications of complex litigation; jurisdictions outside the US Ninth Circuit (and outside the US entirely) can and do differ. Nothing here substitutes for advice on your specific facts.
Conflict disclosure: This article has no affiliate relationships to disclose.
AWL verdict
The honest 2026 answer: scraping public, logged-out data for facts is the most defensible version of the practice in US law — and it’s still only one layer of a five-layer question. The founders who get hurt aren’t usually caught by the CFAA; they’re caught by a contract they clicked, a list of personal data they stored without a privacy plan, or a fake account they thought was a shortcut. Scrape like a guest, keep personal data on a short leash, and get a lawyer before your scraping is the business.
Sources
- hiQ v. LinkedIn — full arc incl. the breach-of-contract ruling and $500,000 consent judgment: https://legalclarity.org/hiq-vs-linkedin-the-final-ruling-on-public-data-scraping/ (verified October 2026)
- hiQ’s December 2022 settlement, fake-account facts and permanent injunction: https://www.lemlist.com/blog/linkedin-scraping (verified October 2026)
- Meta v. Bright Data — January 2024 summary judgment (logged-off scraping not a “use” under Meta’s terms; Meta dropped its remaining claim and waived appeal, February 2024): https://secjuice.com/scraping-public-websites-for-osint-where-the-legal-risk-starts/ (verified October 2026)
- Case-outcome table incl. X Corp v. Bright Data (May 2024 dismissal; June 2025 settlement) and hiQ’s ending: https://forage.ai/blog/legal-and-ethical-issues-in-web-scraping-what-you-need-to-know/ (verified October 2026)
- Legal guide FAQ — public vs. authenticated access, robots.txt’s legal status, GDPR extraterritorial reach: https://spidra.io/blog/is-web-scraping-legal (verified October 2026)
- Meta v. Bright Data ruling detail (Judge Chen, N.D. Cal.; summary judgment on the contract claim): https://blog.osintph.info/bright-data-a-first-walkthrough-the-scraping-giant-that-beat-meta-in-court/ (verified October 2026)
- GDPR fine ceiling (€20M or 4% of global revenue) as summarized in legal guides: https://rebrowser.net/blog/web-scraping-a-comprehensive-legal-guide-with-expert-analysis-and-practical-framework (verified October 2026)
