Is It Illegal to Scrape Websites? Laws and Risks 2026

Web scraping is not automatically illegal, but it crosses into criminal and civil territory faster than most people realize. Whether it is illegal to scrape websites depends on what data you collect, how you collect it, and whose rules you break in the process.

The legal landscape shifted significantly in 2021 and 2022. Two major court rulings changed how the primary federal anti-hacking law applies to scraping. Most people doing the scraping have not caught up with what those decisions actually mean.

Penalties under the Computer Fraud and Abuse Act include federal prison time and civil damages. That is not a hypothetical risk reserved for sophisticated hackers. It has been applied to scrapers.

Here's something related: Is It Illegal to Fly Another Country’s Flag in America? 2026

This article covers the federal laws, key court cases, privacy regulations, terms of service consequences, and practical steps to understand your actual legal exposure in 2026.

Is It Illegal to Scrape Websites

Scraping websites is not categorically illegal, but it becomes illegal when it violates federal computer access laws, breaches copyright protections, or contravenes enforceable terms of service agreements.

The legal analysis depends entirely on three things: what you are scraping, how you access it, and what you do with the data afterward. All three factors independently create potential legal exposure. A scraper can be compliant on one dimension and illegal on another.

The most common legal basis for scraping claims is the Computer Fraud and Abuse Act (18 USC 1030), which prohibits unauthorized access to protected computer systems. Courts have debated for years what “unauthorized” means in the scraping context, and the answer shifted materially with two major rulings in 2021 and 2022.

Copyright law adds a second layer. If the content you scrape is protected expression, reproducing or republishing it can infringe copyright regardless of whether your access was technically authorized.

Quick Facts:

• Scraping is not illegal by default in the US
• Federal law (CFAA) is the primary criminal risk
• Copyright law creates a separate and independent civil risk
• Terms of service violations can lead to civil breach of contract claims
• What you do with scraped data matters as much as how you got it
• Public data is safer to scrape than logged-in or authenticated content

Is It Legal to Scrape Websites

Scraping websites is legal in many circumstances, particularly when the data is publicly accessible, not protected by copyright, and the scraping does not circumvent technical access controls.

Courts have consistently held that not all scraping is illegal. The critical distinction is access: scraping data that any member of the public can see in a browser, without logging in or bypassing any security measure, is treated very differently from scraping data behind a login wall.

The Ninth Circuit’s 2022 ruling in hiQ Labs v. LinkedIn reinforced this principle. The court held that scraping publicly accessible data does not violate the Computer Fraud and Abuse Act because there is no “authorization” barrier to bypass. The data was public; anyone could see it; scraping it at scale does not convert the act into unauthorized computer access.

That said, legality is not a blanket protection. Even lawful access can produce unlawful conduct if the downstream use infringes copyright, violates privacy law, or breaches a contract.

When Scraping Is Generally Considered Legal:

• The data is publicly accessible without login or authentication
• You are not circumventing any technical access controls
• The scraped content is factual data, not protected creative expression
• You are not collecting personal data subject to CCPA or GDPR
• You are not reproducing the content in a way that competes with the original
• The site’s robots.txt allows crawling of the relevant pages

Is Web Scraping Illegal in the US

Web scraping is not broadly illegal in the US under a single law, but multiple federal and state statutes create overlapping legal risks that apply to different aspects of the scraping process.

Federal law is the primary concern. The Computer Fraud and Abuse Act is the statute most commonly used against scrapers. It covers unauthorized access to computer systems, and federal prosecutors and private litigants have both used it against scrapers who exceeded their authorized access.

The 2021 Supreme Court decision in Van Buren v. United States narrowed the CFAA’s reach significantly. The Court held that accessing a computer system with authorization but for an improper purpose does not violate the CFAA. That ruling provides some protection for scrapers who have general authorization to access a site but scrape it in ways the site owner did not intend.

State law adds complexity. California Penal Code Section 502 is California’s own computer fraud statute, and it mirrors the CFAA in some respects but applies independently within the state. Other states have analogous statutes.

Federal Laws That Apply to Web Scraping:

Is Scraping Public Websites Legal

Scraping publicly accessible websites is generally legal in the US when the data can be viewed by anyone without logging in, and no technical barriers are bypassed to access it.

The public accessibility test is the single most important factor in determining whether scraping crosses into illegal territory under the CFAA. If you need to log in, create an account, or defeat any technical access control to reach the data, the legal analysis changes dramatically.

Data that is visible to any anonymous browser user sits in a legally safer zone. Courts have treated this type of data as analogous to information posted on a public bulletin board. Anyone can read it; automating that reading process at scale does not transform a legal act into an illegal one simply because of the volume or speed involved.

Think of it like a library with open shelves versus a locked reading room. You can read anything on the open shelves without asking permission. Picking the lock on the restricted room is a different story entirely.

Public vs. Authenticated Data: Legal Risk Comparison:

Key Takeaway: The public accessibility of data is the most legally decisive factor in web scraping. Publicly visible data sits in the legally safer zone; anything behind authentication or technical barriers carries substantially higher legal risk.

Can You Scrape a Website Without Permission

You can scrape a website without explicit permission in many cases, but the absence of permission is not a legal protection, and certain types of scraping without permission are violations of federal law.

“Without permission” is not the same as “against the law.” The CFAA targets unauthorized access, not unapproved access. Courts have drawn a meaningful line between those two concepts. A website that is open to the public grants implicit authorization to access its content. Scraping that content, even without asking, does not automatically mean you accessed it without authorization in the legal sense.

Where explicit permission becomes critical is when a site has clearly communicated restrictions through its terms of service, login requirement, or technical access controls. At that point, ignoring those restrictions and scraping anyway creates a genuine legal risk under both the CFAA and contract law.

Many major platforms have moved aggressively to stop unauthorized scraping. LinkedIn, Twitter (now X), Instagram, and others have sent cease and desist letters, pursued litigation, and blocked IP addresses of scrapers. Some have won in court; others have lost.

What No Permission Actually Means Legally:

• For public data with no technical barriers: Scraping without permission is generally not a CFAA violation
• For data behind login walls: Scraping without permission is likely unauthorized access under the CFAA
• For data covered by TOS restrictions: Scraping may constitute breach of contract
• For copyrighted content: Reproducing without permission may infringe copyright regardless of access method
• For personal data: Collecting without consent may violate CCPA, GDPR, or both

Web Scraping and the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (18 USC 1030) is the primary federal law used to prosecute or sue web scrapers, and it prohibits intentionally accessing a computer without authorization or in excess of authorized access.

The CFAA was enacted in 1986 primarily to address computer hacking. Courts and litigants have stretched it to cover a wide range of conduct, including web scraping, particularly when the scraping involves bypassing technical access controls or logging in to collect data the site owner did not intend to provide to bots.

The key statutory language is “without authorization” and “exceeds authorized access.” The Van Buren v. United States Supreme Court decision in 2021 clarified that “exceeds authorized access” applies to someone who accesses areas of a computer system they are not permitted to access, not someone who accesses a permitted area for an improper purpose. That ruling narrowed the CFAA’s application but did not eliminate scraping risk.

Criminal violations of the CFAA can result in federal prosecution. Civil violations allow private parties, including website owners, to sue scrapers for damages.

CFAA Provisions Most Relevant to Web Scraping:

Is Scraping a Website a Violation of Terms of Service

Scraping a website in violation of its terms of service is a breach of contract, and while it does not automatically trigger criminal liability, it opens the door to civil lawsuits for damages.

Terms of service are contracts. When you use a website, you agree to its terms. Most major websites explicitly prohibit automated data collection, scraping, and crawling in their terms of service. Violating those terms is a breach of the contract you entered when you accepted them.

The legal consequence of a TOS breach depends on the damages the site owner can prove. If your scraping caused quantifiable harm, such as server overload, loss of competitive advantage, or reputational damage, the site can sue for those damages. If your scraping caused no measurable harm, the suit may still proceed but the damages award will be limited.

One important point: courts have not uniformly agreed that TOS violations alone convert scraping into CFAA violations. The hiQ v. LinkedIn court specifically rejected the argument that violating LinkedIn’s TOS made hiQ’s scraping “unauthorized” under the CFAA for publicly accessible data. The breach of contract claim is separate from the federal criminal or civil computer fraud claim.

TOS Violation Consequences for Scrapers:

See also: Is It Illegal to Have a Crack in Your Windshield? 2026

• Civil breach of contract lawsuit
• Injunction ordering you to stop scraping
• Damages for provable losses caused by your scraping
• Potential IP blocking and permanent platform ban
• In some cases, sought-after attorney’s fees if TOS includes fee-shifting provision
• Possible CFAA claim if TOS violation is used to argue exceeded authorization of login-gated content

Web Scraping Copyright Law

Web scraping can infringe copyright when the scraped content consists of original creative expression protected under the Copyright Act (17 USC), and the scraper reproduces, distributes, or displays that content without authorization.

Copyright law is separate from the CFAA. You can access a website legally and still infringe copyright through what you do with the content after you take it. The two legal claims operate independently.

Not all scraped content is protected by copyright. Facts, data, ideas, and other non-creative elements are not copyrightable. The Supreme Court established in Feist Publications v. Rural Telephone Service (1991) that a mere collection of facts, even if assembled with effort, is not automatically protected by copyright. So scraping a directory of business names and phone numbers likely does not infringe copyright on the data itself.

What is protected is original expression: articles, images, videos, creative writing, and other content where human creativity produced something original. Scraping that content and republishing it, feeding it into an AI training dataset, or using it to create a competing product are all potential infringement scenarios.

Key Takeaway: Copyright law applies to web scraping independently of the CFAA. Scraping facts and public data is generally safe from copyright claims, but reproducing original creative content, even from a publicly accessible site, can be copyright infringement.

Copyright Risk by Content Type:

HiQ v LinkedIn Web Scraping Ruling

The hiQ Labs v. LinkedIn Corporation ruling by the Ninth Circuit Court of Appeals in 2022 is the most important web scraping court decision in US legal history, and it held that scraping publicly accessible LinkedIn data does not violate the Computer Fraud and Abuse Act.

The case history is important to understand. hiQ, a data analytics company, scraped publicly visible LinkedIn profiles to power its workforce analytics products. LinkedIn sent a cease and desist letter and began blocking hiQ’s scrapers. hiQ sued for an injunction, and the case went to the Ninth Circuit twice.

In its 2022 decision, the Ninth Circuit held that LinkedIn’s public profile data was accessible to anyone without logging in. Because no authorization was required to view that data, there was no “unauthorized access” under the CFAA when hiQ scraped it. The court reasoned that the CFAA was designed to address hacking, not the automated collection of publicly available information.

The ruling’s protection is real but limited. It applies to the Ninth Circuit (California, Oregon, Washington, Nevada, and other western states). Other circuits have not adopted the same interpretation. It also only protects scraping of genuinely public data. The moment you scrape login-gated content, hiQ does not protect you.

What hiQ v. LinkedIn Actually Means for Scrapers:

• Scraping publicly visible data does not violate the CFAA in the Ninth Circuit
• The ruling does not protect scraping of login-gated or restricted data
• It does not eliminate copyright, TOS, or state law claims
• Other federal circuits may rule differently on the same facts
• The case was sent back to lower court, so litigation continued beyond the 2022 ruling
• The ruling creates meaningful precedent but is not a blanket legalization of all scraping

Robots.txt and Web Scraping Legality

Robots.txt is a file on websites that communicates to automated crawlers which pages they should and should not access; ignoring it does not automatically make scraping illegal, but it significantly increases legal and ethical risk.

The robots exclusion protocol is not a law. There is no statute that makes ignoring robots.txt a crime. Courts have consistently held that robots.txt is not a technical access barrier in the legal sense. Bypassing it is not the same as bypassing a password or encryption.

That said, ignoring robots.txt disqualifies you from certain legal protections. Courts have used compliance with robots.txt as one factor in evaluating good faith. A scraper that respects robots.txt instructions is treated more favorably than one that deliberately ignores them.

For CFAA analysis, the more relevant question is whether the site has implemented actual technical access controls, not just robots.txt instructions. A site that uses CAPTCHA, login requirements, or IP blocking creates a stronger legal argument that unauthorized access occurred when those controls are defeated.

Robots.txt: Legal Status at a Glance:

• Not a legally binding document under any US federal statute
• Ignoring it does not by itself create CFAA liability
• Courts treat robots.txt compliance as an indicator of good faith
• Disregarding it strengthens a site’s TOS breach argument
• Defeating actual technical access controls (not just robots.txt) is a much more serious legal risk
• Search engines routinely respect robots.txt as an industry standard, even without legal obligation

Web Scraping Personal Data Laws

Scraping personal data from websites creates legal exposure under privacy laws that apply independently of the CFAA, including the California Consumer Privacy Act, state biometric data laws, and the European General Data Protection Regulation.

The critical distinction is between scraping factual or structural data and scraping personally identifiable information. Names, email addresses, phone numbers, IP addresses, social security numbers, and similar identifiers are regulated personal data under multiple statutes. Collecting them at scale without a lawful basis triggers those regulations.

California’s CCPA applies to businesses that collect personal information about California residents, regardless of where the business is located. If your scraper collects data about California residents, the CCPA applies to you if your business meets the statute’s thresholds.

Illinois has the Biometric Information Privacy Act (BIPA), which is one of the strictest data protection laws in the US. Scraping biometric identifiers, including facial images that could be used for facial recognition, from websites of Illinois residents can trigger BIPA claims with statutory damages of $1,000 to $5,000 per violation.

Privacy Laws That Apply to Web Scraping Personal Data:

CCPA and Web Scraping

The California Consumer Privacy Act directly applies to web scraping when the scraped data includes personal information about California residents and the scraper qualifies as a business under the statute’s thresholds.

The CCPA defines “personal information” broadly. It includes names, email addresses, IP addresses, browsing history, location data, and inferences drawn from this information. Scraping any of these from websites about California residents puts you within the statute’s scope if your business earns over $25 million in annual revenue, buys or sells personal information of 100,000 or more consumers, or derives 50% or more of its revenue from selling personal information.

Smaller scrapers below those thresholds are not covered by the CCPA as a technical matter. But the CCPA is not the only California privacy law. California’s common law privacy protections and constitutional privacy rights can apply even to smaller operations.

The CCPA gives California residents the right to know what data is collected about them, the right to request deletion, and the right to opt out of the sale of their data. A scraper who collects personal data and sells it cannot honor those rights, which is itself a violation.

CCPA Compliance Checklist for Scrapers:

• Determine whether your business meets CCPA threshold requirements
• Identify whether any scraped data constitutes personal information under the CCPA
• Assess whether the scraping constitutes “selling” personal information
• Evaluate whether you can honor deletion requests for scraped data
• Review whether your privacy policy discloses your data collection methods
• Consider whether California residents whose data you scraped have a private right of action for data breaches

Key Takeaway: Privacy laws like CCPA and BIPA apply to web scraping completely independently of the CFAA. Scraping personal data at scale can produce six and seven figure liability under these statutes even when the scraping itself was technically legal under the CFAA.

Penalty for Scraping a Website

The penalty for scraping a website illegally ranges from civil damages and injunctions to federal criminal prosecution with prison sentences and fines, depending on the legal theory and the severity of the conduct.

Criminal penalties under the CFAA are serious. A basic violation of 18 USC 1030(a)(2) carries up to one year in federal prison for a first offense. If the offense involves fraud or results in significant damage, the penalty escalates to up to five years in prison. Repeat offenders face up to ten years.

A related guide: Is It Illegal to Walk Around Without ID? 2026 Laws

Civil damages under the CFAA include actual damages, injunctive relief, and in some cases attorney’s fees. The statute requires a minimum of $5,000 in loss or damage for a civil claim to proceed. That threshold is not difficult to meet when a company argues that its servers were overloaded or its competitive data was compromised.

Copyright infringement penalties are separate. Statutory damages for willful copyright infringement run from $750 to $150,000 per infringed work. That number adds up quickly when a scraper reproduces hundreds or thousands of protected articles or images.

Penalty Summary by Legal Theory:

Can a Company Sue You for Scraping Their Website

Yes, a company can sue you for scraping their website, and major platforms including LinkedIn, Twitter, and Facebook have done exactly that with varying degrees of success.

The legal theories available to a company suing a scraper include CFAA violations, breach of contract (terms of service), copyright infringement, trespass to chattels, and state computer fraud statutes. A well-funded plaintiff can pursue multiple theories simultaneously.

Trespass to chattels is a common law tort that applies when someone interferes with another person’s personal property. Courts in several cases have applied this theory to scraping that overloaded servers or disrupted service, treating the servers as the “chattel” being interfered with. This theory requires proof of actual damage to the system, not just unauthorized access.

The practical reality is that small-scale scrapers rarely face litigation because the cost of suing exceeds the recoverable damages. Large-scale commercial scrapers who compete with the platform or cause measurable harm are the primary targets. LinkedIn’s case against hiQ and its cases against other scrapers are examples of litigation driven by competitive and commercial harm.

Companies That Have Sued Scrapers:

• LinkedIn sued hiQ Labs and multiple other scraping operations
• Twitter / X sued multiple data aggregators after restricting API access
• Meta (Facebook) has pursued scraper lawsuits under federal and state law
• Craigslist successfully sued 3taps under the CFAA for continued scraping after a cease and desist
• Ticketmaster has pursued scraper litigation under CFAA and state law

Is It Legal to Scrape Social Media

Scraping social media platforms is one of the highest-risk scraping activities legally, because most platforms explicitly prohibit it in their terms of service, have implemented technical access controls, and have actively pursued litigation against scrapers.

Every major social media platform, including Facebook, Instagram, X (formerly Twitter), LinkedIn, TikTok, and Pinterest, prohibits automated data collection in its terms of service. Violating those terms is a breach of contract. When the scraping also involves bypassing technical measures like rate limiting, CAPTCHAs, or API restrictions, the CFAA risk increases substantially.

Social media platforms hold large amounts of personal data. Scraping that data at scale triggers privacy law concerns under CCPA, GDPR, and potentially BIPA, especially when the scraped data includes profile photos, location information, or other regulated personal identifiers.

The hiQ v. LinkedIn ruling provides some protection for scraping publicly visible social media profiles in the Ninth Circuit, but that protection is narrow. It does not extend to scraping direct messages, private groups, or any content that requires authentication to access.

Social Media Scraping Risk by Platform and Data Type:

How to Scrape Websites Legally

Scraping websites legally in 2026 requires following a specific set of practices that minimize exposure under the CFAA, copyright law, privacy statutes, and contractual obligations.

The starting point is always the terms of service. Read it before you scrape. If it explicitly prohibits automated data collection, you face breach of contract risk. Some sites have commercial data licensing programs that allow scraping under a formal agreement. Using those programs is the cleanest legal path.

Respect the robots.txt file as a matter of practice. While not legally required, following its directives reduces your legal risk, demonstrates good faith, and helps avoid the server-load arguments that support trespass to chattels claims.

Stay away from personal data unless you have a lawful basis to collect it. If your scraping operation collects names, emails, or other PII from websites visited by California or EU residents, you need to comply with CCPA and GDPR or face significant liability.

Legal Scraping Best Practices for 2026:

• Read and comply with the target site’s terms of service
• Check and follow robots.txt directives
• Only scrape publicly accessible data that does not require login
• Avoid collecting personally identifiable information without a lawful basis
• Do not reproduce or republish scraped copyrighted content
• Rate-limit your scraping to avoid server overload arguments
• Consider obtaining a formal data license or using the site’s official API
• Document your compliance practices in case of future legal challenge
• Obtain legal review before scraping large volumes of data from platforms known for litigation

Frequently Asked Questions

Is web scraping always illegal in the US?

No, web scraping is not always illegal in the US.
Scraping publicly accessible data that is not protected by copyright, does not include personal information regulated by privacy law, and does not violate enforceable terms of service is generally lawful.
The Ninth Circuit’s 2022 ruling in hiQ v. LinkedIn confirmed that scraping publicly visible data does not violate the Computer Fraud and Abuse Act.
Whether your specific scraping is legal depends on what you scrape, how you access it, and what you do with the data.

Can you go to jail for scraping a website?

Yes, illegal web scraping can result in federal prison time under the Computer Fraud and Abuse Act.
A basic CFAA violation carries up to one year in federal prison for a first offense.
If the scraping involves fraud or causes significant damage, the penalty rises to up to five years in prison.
Criminal prosecution for scraping is rare for small-scale operations but has occurred in high-profile cases involving large-scale data theft or competitive harm.

Does ignoring robots.txt make web scraping illegal?

No, ignoring robots.txt does not by itself make web scraping illegal under any US federal statute.
Robots.txt is a communication standard, not a legally binding access control under the CFAA.
Courts have not held that disregarding robots.txt creates criminal liability, but they do use it as a factor in evaluating good faith and TOS compliance.
Defeating actual technical access controls like CAPTCHAs or login walls is a much more serious legal risk than simply ignoring robots.txt.

Can a company sue you for scraping their publicly available data?

Yes, a company can sue you for scraping their publicly available data, though their chances of winning depend on the legal theory they pursue.
Post-hiQ v. LinkedIn, CFAA claims for scraping genuinely public data are weaker in the Ninth Circuit.
Companies can still pursue breach of contract claims for TOS violations, trespass to chattels if scraping caused server damage, and copyright claims if protected content was reproduced.
Cease and desist letters are far more common than lawsuits for smaller scrapers, but commercial-scale operations have been taken to federal court.

Is it legal to scrape data from social media platforms?

Scraping social media platforms is high-risk legally, even for publicly visible profile data.
All major platforms prohibit scraping in their terms of service, creating breach of contract exposure regardless of the CFAA analysis.
Scraping personal data from social media profiles can trigger CCPA, GDPR, and BIPA liability depending on the nature of the data and the location of the people whose data was collected.
The hiQ v. LinkedIn ruling provides some protection in the Ninth Circuit for scraping genuinely public data, but it does not protect scraping of private content, authenticated data, or personal information regulated by privacy law.

The Legal Lines Are Real in 2026

Web scraping sits in a genuinely gray legal zone, but the edges of that zone are sharper than most people expect. Publicly accessible, non-personal, non-copyrighted data scraped without defeating technical controls is your safest territory.

Save this article before your next scraping project. The laws discussed here reflect 2026 enforcement standards, active court rulings, and the regulatory trends that will define scraping liability for the next several years.

For a deeper understanding, check Is It Illegal to Borrow Money for a Down Payment? 2026