Is Scraping Job Postings Legal?

The short answer

Scraping job postings that a company publishes publicly is broadly lawful in the United States. Courts have repeatedly declined to treat reading a public web page as unauthorized access under the Computer Fraud and Abuse Act, and the facts in a posting, job title, location, salary band, employer, are not copyrightable. The exposure sits somewhere quieter: the job board's Terms of Service as a contract, copyright in the description text you republish, and the personal data that rides along in recruiter contact details. This is general information, not legal advice.

Is it legal to scrape job postings in the US?

Yes, for public postings collected without logging in. The Ninth Circuit in hiQ Labs v. LinkedIn held that scraping publicly available data, the kind anyone with a browser and no account can see, is not access "without authorization" under the CFAA. Van Buren v. United States (2021) pointed the same direction, holding that "exceeds authorized access" covers reaching areas of a system you are not entitled to enter at all, rather than using data you legitimately obtained for a purpose the owner dislikes.

The part of the hiQ story that gets left out of most summaries is how it ended. hiQ won the CFAA question and then lost anyway. In late 2022 the case resolved with a $500,000 judgment against hiQ, a stipulation to liability under California trespass to chattels and misappropriation, and an injunction that effectively ended its ability to scrape LinkedIn. The public data was never the problem. The user agreement hiQ had accepted was.

That is the whole lesson in one sentence: the federal computer crime statute is rarely your risk, and the contract you clicked through almost always is.

Can I scrape job postings from Indeed, LinkedIn or Glassdoor?

Legally this is a different question from the one above, and the answer is much less comfortable. Large job boards are aggregators whose entire business is the aggregated data, so their terms prohibit automated collection in explicit language, and they enforce. LinkedIn in particular has litigated this for years and largely gets what it wants through contract and tort claims rather than the CFAA.

There is also a practical wall in front of the legal one. These platforms deploy serious bot detection, and a lot of their inventory sits behind a login. Getting past either means either accepting terms you are about to breach or escalating against a system whose owner has clearly stated its position. Both moves hand a plaintiff the sympathetic narrative they need, and both are outside what we will do. ClawEngine does not target those platforms, and any vendor promising you reliable LinkedIn job data is selling you a legal posture along with the rows.

The alternative most teams land on after doing this math is better anyway, and we get to it below.

Is scraping a company's own careers page legal?

This is the strongest position in the entire category, and it is where serious job data programs end up. An employer's careers page is public by design and by purpose. The company wants those postings read, indexed and distributed, because being found is the entire point of publishing a role. There is typically no click-through agreement to accept, no login, and no anti-bot posture, because none of that would serve the business.

Coverage is better than people expect, too. Most US employers run their careers page on one of a small number of applicant tracking systems, Greenhouse, Lever, Workday, Ashby, SmartRecruiters, iCIMS, and each renders postings in a consistent structure across every customer. Build extraction once per ATS and you cover thousands of employers with predictable fields rather than fighting one aggregator's defenses. Many of those pages are client-rendered, which is a technical problem rather than a legal one, and solved by rendering JavaScript before extraction.

Are job descriptions protected by copyright?

The facts are not. A job title, an employer name, a location, a posting date, an employment type and a salary range are facts, and facts cannot be copyrighted no matter how much effort went into gathering them. That principle, from Feist Publications v. Rural Telephone Service, is why a database of job facts is on solid ground.

The prose is a different matter. A well-written description with a company blurb, a responsibilities section and a benefits pitch is original expression, and someone at that company wrote it. Copying those paragraphs verbatim onto your own site is republishing someone else's copyrighted text, whether you typed it or a crawler fetched it.

So the useful line is collect versus republish. Storing full description text to parse for skills, seniority signals or salary mentions is ordinary internal analytical use. Reprinting it publicly is not. If you run a job board and want the description on the page, link out to the original posting and show a short factual summary, which is both safer and what candidates actually prefer. Sites that aggregate fully-remote roles from verified employers tend to work this way for exactly that reason: facts on the listing page, click through to the source for the full text.

What about recruiter names, emails and other personal data?

This is the risk most teams underestimate, because it does not feel like scraping at all. A posting often carries a hiring manager's name, a recruiter's email address and sometimes a direct phone number. That is personal data, and personal data is governed by privacy law regardless of how public the page was.

For a US company the two that bite are the California Consumer Privacy Act, which applies to personal information about California residents whether or not you have any relationship with them, and the GDPR, which can reach a US business collecting data about people in the EU with no European office at all. "It was publicly available" is not an exemption under either one. It affects your risk profile, not your obligations, which include telling people you hold their data and honoring deletion requests you have to actually be able to execute.

The mitigation is unglamorous and effective: extract narrowly. Define a schema with the fields your product needs and no others, and personal data never enters your systems in the first place, which means there is nothing to disclose, secure or delete. Typed extraction makes that a one-line decision rather than a data governance project. We cover the wider picture in GDPR and web scraping for US companies and in whether scraping public data for lead generation is legal.

Does robots.txt make job scraping illegal?

Ignoring robots.txt is not itself a crime, and no US court has held that a robots.txt file creates a binding contract on its own. Treating it as optional is still a poor decision. It is the clearest available statement of what a site operator permits, it is what every court, regulator and opposing counsel will look at first when deciding whether your collection was reasonable, and honoring it costs you nothing but a few paths.

Practically, respecting robots.txt and crawl-delay is what separates a program that looks like a search engine from one that looks like an intrusion. That framing decides more outcomes than the underlying statutes do. Our full guide to web scraping legality and robots.txt works through how courts have actually treated it.

What does compliant job posting collection look like?

Do postings expire, and does that matter legally?

It matters more than most teams plan for. A filled or withdrawn role that stays live in your index is a stale fact you are asserting publicly, and for a job board that is both a candidate experience failure and a credibility problem with the employers you want as customers. The fix is a re-crawl cadence with removal on 404 or on a posting disappearing from an employer's board, not an append-only pipeline.

Keeping the fetch timestamp on every record is what makes this tractable. It tells you what to refresh, lets you show candidates how current a listing is, and gives you a defensible answer if an employer asks why a closed role appeared on your site last week.

The practical takeaway

Public job postings are among the safest data on the open web to collect, and the boards that make it hardest are also the ones whose data you have the least right to. Point your crawler at employer careers pages and ATS-hosted boards, stay logged out, honor robots.txt, store facts rather than prose, and define a schema that never pulls in a recruiter's personal contact details. That combination is legally durable and, because ATS pages are structurally consistent, it also produces cleaner data than fighting an aggregator ever would.

ClawEngine is built for exactly that shape of work: public and permitted pages, robots.txt and Terms of Service respected, crawl-delay honored, and typed extraction so you take the fields you need and leave the rest on the page. The job scraping API covers the mechanics, and our compliance policy states the boundaries we hold to. If you want to know what happens when a site does decide to litigate, we walk through the claims that actually succeed in can a website sue you for scraping.