In the US, mostly yes, if the pages are public and you aren’t logged in. Courts have ruled that reading a public page isn’t hacking, even with a bot and even after the site tells you to stop. Scrapers who lose get caught on something else, and the best-known case shows how.
hiQ, the startup that won the “public pages aren’t hacking” ruling twice, still agreed to a $500,000 judgment and a permanent ban. It had accepted LinkedIn’s terms when it bought ads. Bright Data had Facebook and Instagram accounts for its own ads too, and beat Meta, because it scraped logged out.
The new risk, since July 2026, is bot checks. Four rulings let platforms and creators sue companies accused of getting past them, under the DMCA, a copyright law. That law protects posts, photos and videos, not facts: a follower count isn’t copyrighted, a video is. None of this is legal advice.
Public pages, logged out: likely not hacking
The federal anti-hacking law, the CFAA, covers accessing a computer “without authorization”. The Supreme Court read that in 2021 as a question of gates: did you go somewhere that was closed to you? Applying it to hiQ, which scraped public LinkedIn profiles, the Ninth Circuit found that a public website “has erected no gates to lift or lower in the first place”. A cease-and-desist letter didn’t change that.
Logging in is different. Power Ventures kept pulling users’ data from behind Facebook’s login after Facebook told it to stop, and the Ninth Circuit called that access without authorization in 2016. Even then, a company suing under the CFAA has to show $5,000 of loss in a year. Ryanair won a jury verdict against Booking.com and had it set aside in 2025, because it could prove only $2,457.72.
Having accounts doesn’t put you behind the login either. Bright Data scraped Meta logged out, and the judge wrote that “a visitor is not a ‘user’” bound by Meta’s terms. X’s suit against Bright Data was dismissed the same year: rate limits and CAPTCHAs didn’t make public posts “any less public”.
| What the scraper did | What courts said |
|---|---|
| Read public pages, logged out | Likely not hacking (hiQ, 2022). Meta and X lost their suits against Bright Data (2024). |
| Scraped after accepting the site’s terms | Breach of contract. hiQ agreed to a $500,000 judgment and a ban (2022). |
| Used fake accounts, or a login after being told to stop | Breach (hiQ, ProAPIs), and behind a login, access without authorization (Power Ventures, 2016). |
| Accused of getting past a bot check | DMCA claims went ahead in four rulings, July to October 2026. |
Terms you accepted: hiQ won twice and ended with a $500,000 judgment
Most articles call hiQ a win for scrapers. It ended in December 2022 with hiQ agreeing to a $500,000 judgment and a permanent ban on scraping LinkedIn “whether logged in to a LinkedIn account or not”.
The hacking rulings never touched the contract. hiQ had accepted LinkedIn’s User Agreement when it bought ads and subscriptions, and that agreement bans scraping. The trial judge found hiQ in breach, and found that contractors it hired had breached it too by making fake accounts. A month later hiQ settled.
The same judge read Meta’s terms the other way in the Bright Data case: they reached only scraping done while logged in. So whether paying a platform ties your scraping to its terms comes down to their wording.
Terms can bind you even if you never clicked Accept. Reddit’s sit behind a link saying that using the site means accepting them, and in March 2026 a federal judge said that could still bind Anthropic: Reddit alleges Anthropic’s bots kept visiting more than 100,000 times after Anthropic said it had stopped.
Reddit, X, LinkedIn and Meta all ban scraping without permission in their terms. X’s add $15,000 in liquidated damages for requesting, viewing or accessing more than 1,000,000 posts in 24 hours.
In 2026, the fight moved to bot checks
With public pages mostly out of the hacking law’s reach, platforms and creators turned to the DMCA. Its section 1201 bars getting around a measure that “effectively controls access” to a copyrighted work. Between July and October 2026, four rulings let claims like that go ahead against companies accused of getting past bot checks.
- Reddit v. SerpApi: a New York judge said Google’s bot check, which lets people through and keeps automated users out, plausibly controls access to the Reddit posts in Google’s results. Reddit’s claims go on against SerpApi and Perplexity.
- Ted Entertainment v. Snap, ByteDance and Apple: YouTube creators say the companies got past YouTube’s protections to scrape their videos. Apple argued that public videos have no access control at all, and the judge in its case wrote that this “defies logic and Ninth Circuit precedent.”
In 2024, X v. Bright Data said CAPTCHAs didn’t make posts any less public, but X had sued over its terms. Under the DMCA, these courts treat the check itself as a possible access control.
The DMCA has a built-in limit: it protects copyrighted works only. Google’s own suit against SerpApi failed for search results with no copyrighted content in them. Facts such as prices or follower counts aren’t copyrighted. Posts, photos and videos are, so most social media content is covered.
All four are rulings on motions to dismiss. The judges took the complaints’ facts as true and let the cases go on; none found that anyone broke the law.
Six answers to have before you scrape
A lawyer will ask you these:
- Are you logged in, with any account, while you collect? LurkAPI, which publishes this blog, reads public pages and doesn’t log in to anyone’s account.
- Has your company accepted the platform’s terms, and do they mention scraping?
- Has the site told you to stop?
- Is there a bot check between you and the page?
- Are you copying posts, photos or videos, or only facts about them?
- Is any of it personal data about people in the EU or UK?
In Europe, public personal data is still personal data
California’s privacy law leaves “publicly available information” out. The GDPR and the UK’s version of it have no such exception: data about a person is personal data wherever it was posted, and a company that collects it owes those people notice, unless that would take disproportionate effort. France’s regulator fined KASPR €240,000 in 2024 for a Chrome extension that pulled LinkedIn users’ contact details into a database of about 160 million contacts, some of them from people who had shown their details only to their connections.
