Can a Website Sue You for Scraping? What US Courts Do

The short answer

Yes, a website can sue you for scraping, and websites do. Whether they win is a different question, and the record in US courts is far more mixed than the cease and desist letters suggest. Almost nobody loses on the federal computer crime statute anymore, because the Supreme Court narrowed it in 2021. The claims that actually have teeth are breach of contract, copyright infringement and trespass to chattels, and the fact patterns that lose are consistent: you were logged in, you republished the content, or you hit the servers hard enough to cause measurable harm. Public, logged out, polite collection of factual data is the defensible end of the spectrum. This is general information, not legal advice.

What can a website actually sue you for?

A scraping complaint is rarely one claim. Plaintiffs plead a stack of them and hope something survives. These are the six you will see, roughly in order of how often they matter.

Is it illegal to scrape a website without permission?

Reading a public web page without asking is not illegal in the United States, in the sense that no statute makes it a crime. A browser and a script both send the same GET request, and courts have declined to treat automation as the thing that transforms lawful reading into unlawful access. What "without permission" changes is the civil picture, because permission is what a Terms of Service claim is about.

The distinction worth internalizing is between a site telling the world something and a site telling you something. robots.txt and a public terms page tell the world. An account you registered, a contract you signed, a cease and desist letter addressed to you personally: those tell you, specifically, and they change your position materially. A plaintiff who can show you kept going after being told to stop has a much better case on every claim in the table above.

What happens if you get caught scraping a website?

Litigation is the last step, not the first, and most scraping disputes end long before it. The usual sequence is that your requests get rate limited, then your IP range gets blocked, then a lawyer sends a cease and desist letter, and only then, if you continue and there is money at stake, does anyone file. The overwhelming majority of scrapers never get past step two, because blocking is cheap and lawsuits are not.

Lawsuits happen when three things line up: the scraping is commercially painful to the target, the target is large enough to have in-house counsel with time, and there is a contract or a copyright hook to hang the complaint on. A researcher pulling a few thousand public pages does not meet that bar. A competitor rebuilding a rival's core dataset does.

The Ryanair case is the most instructive recent example

In July 2024 a Delaware jury found that Booking.com violated the CFAA by scraping Ryanair's site, in what appears to be the first civil CFAA claim ever decided by a jury. The damages award was $5,000, which is not a coincidence: it is precisely the statutory minimum loss required to bring a civil CFAA claim at all.

Then in January 2025 the court granted Booking.com judgment as a matter of law and threw the verdict out, concluding that Ryanair had not actually proven the $5,000 in loss the statute requires. The case is on appeal to the Third Circuit.

Two lessons come out of that. The first is that the CFAA's loss threshold is a genuine obstacle for plaintiffs, because "loss" means investigation and response costs, not lost business, and polite scraping generates very little of it. The second is more sobering: Booking.com won, and it still spent years and a jury trial getting there. Being right is not the same as being cheap to defend. That gap is the actual reason to run a conservative collection policy.

Can a website sue you for scraping public data?

They can file, and courts have repeatedly been unimpressed. hiQ Labs v. LinkedIn held that scraping public profiles was not access without authorization under the CFAA, and Meta v. Bright Data in 2024 found that logged out collection of public pages did not breach Meta's terms, because those terms bound account holders and Meta had not shown the scraping happened while logged in.

But read how hiQ ended. hiQ won the CFAA question and then lost on breach of contract, because it had accepted LinkedIn's user agreement. The public nature of the data was never the problem. The account was. That is why the single most valuable rule in scraping compliance is also the simplest: never scrape a site using credentials you agreed to terms for.

How do I reduce the risk of being sued?

Most exposure comes from habits rather than decisions, so the fixes are procedural and cheap.

• Stay logged out. No accounts, no trials, no shared credentials, no session cookies borrowed from a browser.
• Read robots.txt and obey it. It is not a contract, but ignoring it is the fact a plaintiff will put in the first paragraph of the complaint.
• Be slow and identifiable. Limit concurrency, honor crawl-delay, back off on 429 and 5xx, and send a real User-Agent with a contact URL. This nearly eliminates trespass to chattels and the CFAA loss threshold at the same time.
• Take facts, leave expression. Prices, availability, SKUs, dates and counts are facts. Descriptions, photos and editorial copy are somebody's copyright.
• Do not republish. Internal analysis is a very different posture from putting a competitor's content on your own site.
• Keep provenance. Source URL, UTC timestamp and the robots decision on every record, so you can show what you took and delete a source cleanly.
• Stop when told to stop. A cease and desist you ignored converts a weak case into a willful one.

What should I do if I receive a cease and desist letter?

Pause collection from that source the same day, before you reply. That single act removes the ongoing harm argument and takes the urgency out of the other side's position, and it costs you almost nothing compared to what an injunction motion costs. Do not respond substantively without counsel, and do not delete anything reflexively, since destroying records after notice creates a spoliation problem worse than the original claim.

Then work out what they are actually asserting. A letter claiming you breached terms is answered very differently from one claiming copyright infringement, and many letters are form documents sent to everyone whose user agent appeared in a log. Companies that already have a named owner for obligations like this handle it in a week. Companies without one spend a month deciding who is responsible before anyone reads the letter.

Where we draw the line, and why

ClawEngine crawls public, logged out pages, reads robots.txt and obeys it, honors crawl-delay, and identifies itself. It does not log in, defeat anti bot systems or touch paywalled content. That excludes large marketplaces and social platforms from what we can serve, which is a genuine limitation on our addressable market and one we would rather state plainly than paper over.

The reason is in the table at the top of this page. Every claim that has real teeth gets stronger the moment you authenticate, circumvent or republish, and weaker the moment you do not. Our compliance policy sets out the boundaries in full. For the broader legal picture start with the guide to whether web scraping is legal, and for the two commercial cases people ask about most, see whether scraping competitor prices is legal and whether scraping data for AI training is legal.