The CFAA and web scraping: Van Buren, hiQ, and the limits of 'unauthorized access'

The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, is the main US federal anti-hacking statute. It prohibits intentionally accessing a computer “without authorization” or exceeding authorized access in certain circumstances. Scraping cases turn on what those phrases mean, especially when the data is public.

This page is research material, not legal advice. It summarises the statute and the leading cases; it does not apply them to your facts.

The statutory hook

The CFAA is broad, but the relevant clause for scraping is usually § 1030(a)(2): intentionally accessing a computer without authorization or exceeding authorized access, and thereby obtaining information from a protected computer. There is also § 1030(a)(4) (fraud and obtaining anything of value) and civil liability under § 1030(g).

“Protected computer” is defined broadly enough to include most internet-connected servers. The fight is usually about “without authorization” and “exceeds authorized access”.

Van Buren v. United States (2021)

In Van Buren, the Supreme Court narrowed “exceeds authorized access”. A police officer used a database he was authorized to access, but for an improper purpose. The Court held that the clause covers accessing information in areas of the computer that are off limits, not using authorized access for an improper reason.

The “gates-up-or-down” metaphor matters: if you are authorized to access a system, using that access for a prohibited purpose is not automatically a CFAA violation. That reading makes it harder to turn a terms-of-service violation into a federal crime.

hiQ Labs v. LinkedIn (9th Cir. 2022)

hiQ scraped public LinkedIn profiles. LinkedIn sent a cease-and-desist and used technical measures to block hiQ. The Ninth Circuit held that scraping publicly available data was likely not “without authorization” under the CFAA, because the data was open to the public and LinkedIn had not used an authentication gate. The court vacated a preliminary injunction and remanded.

Important limits:

The decision is about the CFAA, not contract, privacy, or copyright.
It was a preliminary stage; the case later settled.
It does not say all scraping is lawful.
A login, paywall, or technical gate changes the analysis.

Power Ventures and 3Taps

Facebook v. Power Ventures (9th Cir. 2016) held that continued access after a cease-and-desist and technical blocking could support a CFAA claim. A clear revocation of permission matters.

Craigslist v. 3Taps (N.D. Cal. 2013) found that a cease-and-desist and IP blocking revoked authorization for a scraping service. The cases show that the “gates” are not only passwords; a clear demand to stop can change the analysis.

What this means in practice

Public data, no gate, no objection: the CFAA risk is lower, but contract, privacy, and copyright still apply.
Login, paywall, API key, CAPTCHA: there is a gate. Passing it without permission is high risk.
Cease-and-desist: stop. Continuing can turn a dispute into a CFAA claim.
Technical block: do not rotate IPs to evade it. That is evidence of circumvention, not a fix.
Terms of service: a contract issue, not necessarily a CFAA issue. The two can be pleaded together.

State law and other claims

The CFAA is not the only claim. Plaintiffs also plead:

breach of contract (the terms of service);
trespass to chattels;
misappropriation;
copyright infringement;
database rights (EU/UK);
privacy and data-protection claims;
unfair competition.

A crawl can be lawful under the CFAA and still breach a contract or privacy law. The terms guide and the GDPR guide cover those.

A defensive posture

Use official APIs where they exist.
Do not pass a login, paywall, or CAPTCHA without permission.
Read the terms and document your reasoning.
Identify your crawler honestly.
Stop on a cease-and-desist or a technical block.
Keep logs and a data-retention policy.
Get legal advice for a commercial, high-volume, or personal-data crawl.