Is Web Scraping Legal, and Can We Stop a Competitor From Scraping Our Site?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

It depends on what is scraped and how. Collecting facts from public pages, such as prices and listings, is often lawful, and the Ninth Circuit has seriously questioned whether it violates the federal computer fraud statute at all. (hiQ Labs, Inc. v. LinkedIn Corp. (9th Cir. 2022) 31 F.4th 1180, 1201.) Scraping behind a login, in breach of terms the scraper accepted, or in a way that burdens your servers is different. Kolmogorov Law, P.C. represents site owners and data companies in Orange County, Los Angeles, and across California.

Call (909) 235-6116 or contact us online to discuss a scraping problem or a cease and desist letter you received for scraping.

Public pages versus pages behind a login

No single statute says "scraping is illegal" or "scraping is legal." Five different bodies of law can apply, and the first question for each is whether the data sat on a public page or behind a gate.

The federal Computer Fraud and Abuse Act prohibits intentionally accessing a computer without authorization and obtaining information from it. (18 U.S.C. § 1030(a)(2)(C).) The Ninth Circuit has reasoned that a public web page, open to anyone with a browser, has no gate to pass. On that view, scraping it is probably not access without authorization, even after a cease and desist letter. The same court treated password-protected data differently. (hiQ, supra, 31 F.4th at pp. 1199-1201.) That ruling came on a preliminary injunction, so it is strong guidance, not a final word.

For most businesses, a civil claim under the federal statute also needs at least $5,000 in loss within a one-year period. It must be filed within two years of the act or of discovering the damage. (18 U.S.C. § 1030(c)(4)(A)(i)(I), (g).) Our CFAA page covers those requirements.

California's computer access statute

California has its own law. It reaches a person who knowingly accesses a computer system and, without permission, takes, copies, or makes use of data from it. (Pen. Code, § 502, subd. (c)(2).) The owner of the system or data who suffers damage or loss may sue for compensatory damages and injunctive relief. (Pen. Code, § 502, subd. (e)(1).) Under both statutes, the firm pursues the civil remedy.

Everything turns on "without permission." The California statute is worded differently from the federal one, and how far it reaches on fully public pages is unsettled. The claim is stronger when the scraper got past a login, used credentials that were not its own, or kept going after its access was blocked and revoked in writing. Our page on Penal Code 502 civil claims has more.

Terms of use as a contract

Most sites forbid automated collection in their terms. Whether that prohibition binds a scraper is a contract question: did the scraper agree?

A scraper that created an account and clicked "I agree" is in a different position than one that never logged in. Terms that sit behind a footer link, with no act of assent, are hard to enforce against anyone. Whether a site's terms reach scraping done without logging in depends on how they are written and how the scraper assented. Our page on clickwrap and browsewrap terms explains what courts require for assent.

Copyright protects expression, not prices

Site owners often assume their data is copyrighted. Much of it is not. Copyright does not extend to ideas, systems, or discoveries, and a compilation's copyright covers only what its author contributed. (17 U.S.C. §§ 102(b), 103(b).) A price, a stock level, an address, and a product specification are facts.

Your product descriptions, photographs, and articles are another matter. If the competitor republishes those without permission, you may have a copyright claim and can use the takedown procedure. See our pages on copied website content and DMCA takedowns.

Trespass to chattels and the harm requirement

The oldest theory treats your servers as personal property and the scraper as an intruder. California limits it sharply. The state Supreme Court held that the tort does not cover an electronic contact that neither damages the computer system nor impairs its functioning. (Intel Corp. v. Hamidi (2003) 30 Cal.4th 1342.)

So the question is evidence. Did the nightly crawl slow the site, consume measurable capacity, cause outages, or force you to buy more infrastructure? A scraper that makes a few thousand polite requests probably does not meet the test. One that hammers the site at peak hours might.

If you are the site owner

Build the record before you send a letter.

• Pull server logs showing the volume, timing, and source of the automated requests.
• Measure the effect on performance and cost.
• Identify exactly what was taken and where it reappeared.
• Check whether the scraper holds an account and accepted your terms.

Then raise the gates. Put valuable data behind a login. Require affirmative assent to terms that prohibit automated collection. Add rate limits and blocking. Each step improves both your security and your legal position, because access past a barrier is easier to call unauthorized.

A cease and desist letter should revoke permission in plain words and identify the conduct. Many pricing disputes end there or with a negotiated data license. If they do not, the state-law claims can be filed in Superior Court. A case with a federal claim can be filed in the Central District of California, and a copyright claim has to be in federal court.

If you received a cease and desist for scraping

Take it seriously without assuming you are wrong. Ask four questions. Was the data public or behind a login? Did anyone on your team create accounts or accept terms? What exactly do you copy and republish: facts, or text and images? How much load do you place on the site?

Two things can turn a defensible position into a weak one. One is evading technical blocks after written notice, for example by rotating IP addresses. The other is using fake or borrowed accounts. Stop both immediately, preserve your logs, and get advice before replying.

Many data companies can keep operating with changes: public pages only, lower request rates, facts only, and no accounts.

What to bring to the first meeting

• Server logs or analytics showing the scraping, or your own crawl logs if you are the one accused.
• The site's terms of use and how users accept them.
• Any cease and desist letters sent or received.
• Examples of where the scraped data was used or published.
• Records of slowdowns, outages, or added infrastructure costs.

Frequently asked questions

Is web scraping legal in California?

Sometimes. No California or federal statute bans scraping as such. Scraping facts from public pages is often lawful, and the Ninth Circuit has questioned whether it violates the federal Computer Fraud and Abuse Act. Scraping behind a login, breaching terms you agreed to, copying protected text or images, or impairing a site's servers can each create liability.

A competitor is scraping our pricing and listings every night. Is that illegal and can we stop it?

Possibly, though public prices are hard to protect. A California business has stronger claims if the competitor uses an account, agreed to terms that ban scraping, burdens the servers, or copies descriptions and photos. Practical steps often work faster than a lawsuit: require a login, add rate limits, and send a letter revoking permission.

Can I sue someone for scraping my website?

Yes, if the facts fit a recognized claim. California site owners sue under Penal Code section 502, the federal computer fraud statute, breach of contract, copyright, and trespass to chattels. Each has its own hurdle, such as lack of permission, agreement to the terms, protected expression, or actual harm to the system. (Intel Corp. v. Hamidi (2003) 30 Cal.4th 1342.)

Does a website's terms of use make scraping illegal?

Terms of use are a contract, not a statute. They bind a scraper who agreed to them, usually by creating an account or clicking to accept. In California federal courts, terms that a visitor never had to accept are difficult to enforce, so a ban on scraping in a footer link may not reach a scraper that only visits public pages.

We run a price comparison service and just got a cease and desist letter from a retailer. Do we have to stop scraping?

Not automatically, but do not ignore it. The letter revokes whatever permission you had, which matters most if you use accounts or bypass blocks. A California data company that collects only public facts at modest request rates is in a far better position than one evading technical barriers. Have counsel review your methods before you answer.

Talk to a California internet and data litigation attorney

If your data is being scraped, or you have been told to stop scraping, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. Our intellectual property practice covers the related copyright and trade secret claims.

This page provides general information about California and federal law and is not legal advice. Outcomes depend on the data, the access method, the terms, the facts, and the court.