iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Sometimes. Website terms of use can be an enforceable contract against a scraper when the site can show assent or adequate notice, the terms clearly prohibit the conduct, and the dispute falls within the clause’s governing law and forum. Public visibility does not settle the question. A logged-out request for public pages received favorable treatment under the CFAA in hiQ Labs v. LinkedIn, and logged-out public scraping was not a contract breach on the evidence in Meta Platforms v. Bright Data. Those decisions did not create a general right to scrape: authenticated access, click-through terms, circumvention, deception, personal data, and commercial-scale extraction can create substantially greater exposure.
When terms of use become a contract
A terms page is not automatically binding merely because it exists. In a scraping dispute, a court normally asks whether a contract was formed, what the user agreed to, and whether the challenged requests fall within the promise.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Legal Guide for Starting & Running a Small Business | $34.00 | Buy on Amazon |
| 2 |
|
Legal Terminology: QuickStudy Laminated Reference Guide (Quick Study: Law) | $8.95 | Buy on Amazon |
| 3 |
|
Nurse Practitioner's Business Practice and Legal Guide | $86.43 | Buy on Amazon |
| 4 |
|
Every Landlord's Legal Guide | $35.41 | Buy on Amazon |
| 5 |
|
Every Landlord's Legal Guide | $40.16 | Buy on Amazon |
Assent and notice
A click-through flow that requires a user to select “I agree” usually produces stronger evidence of assent than a terms link that a visitor never saw. Account registration, authenticated dashboards, paid subscriptions, and other logged-in areas also create a clearer contractual record. Browsewrap arrangements—where the terms are linked but no checkbox or comparable action is required—depend heavily on how conspicuous the notice was, the design of the page, the user’s actual knowledge, and the law applied by the court.
Preserve the interface as it existed when access occurred. A screenshot or archived copy should show the notice, link placement, checkbox text, version date, and any incorporation language. A later-revised terms page may not prove what the scraper saw at the relevant time.
#1 Best Overall
The wording matters
Courts construe the language that was actually presented, rather than enforcing every broad statement of policy. The LinkedIn User Agreement discussed in the 2022 hiQ opinion prohibited users from “scrape or copy profiles and information of others through any means” and from using “manual or automated software, devices, scripts robots, other means or processes to access, ‘scrape,’ ‘crawl’ or ‘spider’ the Services.” A prohibition that expressly covers automated collection is easier to connect to a scraper’s conduct than a general statement that a service is for personal use.
Scope, governing law, and forum
Read definitions, permitted-use language, data-use restrictions, arbitration provisions, choice-of-law clauses, forum clauses, and terms incorporated by reference. A clause may cover content displayed on a public page, data obtained through an account, or only use of the service itself. Whether a particular clause is enforceable is a question for the applicable jurisdiction, not a universal internet rule.
Public pages and authenticated areas are different risk categories
“Public” describes what a browser can see without signing in; it does not answer whether a scraper accepted a contractual restriction or violated another law. The access path is therefore a primary fact.
| Access situation | Contract signal | Why exposure changes |
|---|---|---|
| Logged-out, publicly viewable page | Often no demonstrated assent by the visitor | Favorable CFAA treatment in hiQ and the facts of Meta v. Bright Data does not eliminate contract, tort, copyright, privacy, or data-protection theories. |
| Account or authenticated dashboard | Registration and click-through terms can document assent | Express anti-scraping promises and account-specific restrictions are easier to enforce. |
| Paywalled or otherwise restricted content | Subscription or access agreement | Using credentials to extract material can breach the agreement even if individual pages render in a browser. |
| CAPTCHA, IP block, or other technical barrier bypassed | Conduct may violate technical-use clauses in addition to any assent | Circumvention and unauthorized-access theories become more plausible; do not treat a public URL as permission to defeat a control. |
| Fake identity or another person’s account | Assent and identity are disputed | Deception, account misuse, and contractual claims can be added to the scraping dispute. |
| High-volume commercial extraction | Terms may limit competitive or commercial use | Scale, resource consumption, and a stated competitive-use ban can support claims that a one-time research request would not. |
| Personal or sensitive data | Terms may impose privacy and data-use duties | Privacy and data-protection obligations can apply independently of whether the page was public. |
What hiQ Labs v. LinkedIn actually decided
The Ninth Circuit held that accessing publicly viewable LinkedIn profiles was not access “without authorization” under the Computer Fraud and Abuse Act (CFAA) merely because LinkedIn objected and sent cease-and-desist notices. In that statutory context, a public page was not converted into a CFAA violation by the owner’s objection alone.
The decision did not hold that public scraping is always lawful. The court recognized that contract, trespass, and other theories could present different questions. LinkedIn’s User Agreement contained express restrictions on scraping, copying profiles, competitive use, and automated access. A scraper that assented to those terms could face a contract dispute even if the same logged-out request did not satisfy the CFAA’s “without authorization” element.
What Meta Platforms v. Bright Data adds
In a January 23, 2024 order from the Northern District of California, the court found no evidence of logged-in scraping and held that logged-out scraping of public Facebook and Instagram data did not breach the Meta/Instagram terms analyzed in that case. The order stated: “When an entity does not utilize that access to, e.g., scrape public data, it does not abuse that access; it stands in the same shoes as a visitor to whom the Terms cannot apply as a matter of basic contract law.”
That conclusion depended on the terms and evidence before the court. It is not a blanket immunity for scraping Facebook, Instagram, or any other site. A different version of terms, an account, evidence of login, or technical circumvention could produce a different result. The case also did not resolve every possible statutory, tort, copyright, privacy, or data-protection claim.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Separate the CFAA question from the contract question
These are distinct analyses:
- CFAA: Was the computer accessed “without authorization” or in a way that exceeded authorization under the facts and controlling precedent? hiQ treated logged-out access to public LinkedIn profiles favorably on that issue.
- Contract: Did the scraper assent to terms, did the terms clearly prohibit the requests or use, and did the conduct breach that promise?
- Other claims: Depending on the data and conduct, an owner may assert trespass-to-chattels, copyright or database-rights claims, privacy or data-protection violations, circumvention theories, or deception-based claims.
A favorable CFAA answer therefore does not answer the contract question. Conversely, a contractual restriction does not automatically establish a CFAA violation.
How to evaluate a scraping project before running it
- Identify the jurisdiction. Record where the site operator, your organization, and the relevant servers are located, and check the governing-law and forum clauses. The authorities discussed here are U.S. decisions, principally from the Ninth Circuit and the Northern District of California; they do not establish a worldwide rule.
- Capture the exact terms. Save the current text, version or “last updated” date, linked policies, registration screens, and any banner or checkbox shown during account creation. Keep timestamps and the URL path.
- Map the access path. Document whether requests are logged out, authenticated, paywalled, rate-limited, or routed through an API. Do not describe an authenticated workflow as “public” merely because a page is visible after login.
- Search for precise restrictions. Look for “scrape,” “crawl,” “spider,” “automated access,” “copy,” “competitive use,” “commercial use,” resale, reverse engineering, and data-retention language. Read definitions and exceptions as well as prohibitions.
- Do not bypass controls. Stop rather than defeat a CAPTCHA, IP block, authentication gate, or similar technical measure. Bypass techniques can create separate legal and contractual issues.
- Limit the data. Avoid collecting personal or sensitive information unless you have a documented lawful basis, a retention plan, and a jurisdiction-specific privacy review. Public availability is not the same as unrestricted reuse.
- Control volume and purpose. Record the intended rate, duration, fields, and business purpose. A one-time study and continuous competitive extraction may be treated differently under the same terms.
- Set an escalation trigger. If you receive a cease-and-desist, lose access, discover that an account or paywall is involved, or plan commercial-scale collection, pause and obtain advice from counsel familiar with the relevant jurisdiction.
Documenting the terms page without building a browser stack
If you need an audit trail, capture the terms page and the surrounding notice before you run a job. A normal browser can save a full-page PDF or image, but dynamic banners, lazy-loaded content, chat widgets, and consent dialogs can obscure what was visible. Keep the raw capture, request time, URL, and a hash in your project records; a screenshot is evidence of presentation, not proof that the terms are enforceable.
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server for developers. It can capture a terms page with one GET request, while removing cookie or consent banners, newsletter popups, and chat widgets before the shot. You can turn each cleanup step off. The service reports page and billing outcomes in X-Page-Verdict and X-Billed headers: bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed.
cURL
See the complete parameter reference in the ScreenshotNeo documentation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/terms -o terms.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com/terms"}, timeout=90)
open("terms.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com/terms' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);For a terms-record workflow, useful options include full-page capture with lazy images loaded, a CSS-selector capture for the notice or checkbox, custom viewport and device presets, retina scale, PDF output with paper size and margins, custom CSS or JavaScript, selector waits, delay or network-idle waits, hiding selectors, custom headers, cookies, user agent and Authorization, timezone and geolocation, transparent backgrounds, resizing, a chosen cache TTL, signed links, asynchronous jobs with signed webhooks, bulk capture of up to 100 URLs per call, a usage API, and an OpenAPI specification. Parameter names used by other screenshot APIs also work, which can simplify migration. ScreenshotNeo does not grant permission to scrape; it only records what a supplied URL returns.
Plans and billing
| Plan | Included shots per month | Price |
|---|---|---|
| Free | 1,000 | $0, no card |
| Starter | 3,000 | $5 |
| Growth | 15,000 | $15 |
| Pro | 60,000 | $39 |
| Scale | 250,000 | $99 |
| Business | 1,000,000 | $249 |
Every feature is included on every plan, and yearly billing gives two months free. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients, so an AI agent can collect the same documentation without custom browser orchestration. Create a free ScreenshotNeo account for 1,000 screenshots a month with no card.
Common mistakes and how to correct them
“The data is public, so the terms cannot apply.”
Public visibility addresses only one part of the analysis. Check whether you created an account, accepted click-through terms, or used an authenticated route, then read the actual anti-scraping language.
Rank #4
“A cease-and-desist automatically makes the requests unauthorized.”
hiQ rejected that automatic CFAA theory for the public LinkedIn profiles at issue. A notice can still matter to contract, trespass, or other claims, and it is a reason to pause and obtain advice rather than continue unchanged.
Recommended Free Tools
“Logging out removes every legal risk.”
Logging out may reduce the contract and CFAA risk shown in the cited cases, but it does not resolve copyright, privacy, database-rights, trespass, circumvention, or deception issues. It also does not defeat a clearly applicable term accepted earlier through an account.
“A general acceptable-use sentence is the same as an express ban.”
Courts examine wording and context. Preserve the full clause, definitions, exceptions, and incorporated policies instead of relying on a search result or a single sentence.
“The U.S. cases settle the issue everywhere.”
They do not. The cited decisions are U.S. authorities, and their reasoning is tied to particular terms, evidence, and procedural postures. Cross-border collection requires advice on each relevant jurisdiction.
Best Value
When to obtain legal advice
Get jurisdiction-specific advice before collecting personal data, accessing an authenticated or paywalled system, using accounts that do not identify the real operator, bypassing a technical control, making a commercial or competitive product from the data, or continuing after a legal notice. Bring counsel the terms version, assent records, request design, data fields, volume, purpose, and any correspondence. Those facts let counsel separate contract exposure from CFAA, privacy, copyright, and tort questions instead of treating “scraping” as a single legal category.
Frequently Asked Questions
Can a website’s terms bind someone who never created an account?
Possibly, but formation and notice become the central disputes. A conspicuous notice or proof of actual knowledge is stronger than a terms link a visitor never saw; the answer depends on the interface and governing law.
Does using an official API avoid all scraping-related restrictions?
No. An API may have its own terms, authentication requirements, rate limits, and data-use restrictions. Review that agreement separately from the website’s public-page terms.
What should I preserve if I receive a cease-and-desist letter?
Preserve the letter, request logs, terms version, assent records, captured pages, and your data fields and purpose. Do not delete evidence or continue the disputed collection while obtaining jurisdiction-specific advice.
Is a screenshot of a terms page proof that I agreed to it?
No. It can document notice and wording at a particular time, but assent usually requires additional evidence such as a registration record, checkbox event, account log, or proof of actual knowledge.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
