Current status of "is scraping websites, even if you use residential proxies and tricks to bypass blocks" being illegal:


Van Buren (2021) adopted a "gates-up-or-down" reading of "exceeds authorized access": liability turns on whether you got into areas of a computer that were off limits to you, not on whether you used permitted access for an improper purpose.

The Ninth Circuit in hiQ v. LinkedIn (2022) reasoned scraping public pages against the owner's wishes likely isn't access "without authorization"

The Third Circuit in NRA Group v. Durenleau (2025) concluded that policy/contract violations aren't CFAA violations absent "code-based hacking"

The DOJ in 2022 set a charging policy that prosecutors may not charge "exceeds authorized access" based solely on violating terms of service on a public website, and may not treat a ToS breach as automatically revoking authorization. This is why the AI companies aren't being swarmed with lawsuits for scraping the internet right now.

BUT

In Amazon v. Perplexity, a district court allowed a CFAA claim against the agentic browser that accessed Amazon on users' behalf, relying on Facebook v. Power Ventures rather than hiQ. That ruling is on appeal to the Ninth Circuit, where EFF argues it should be reversed.

EVEN THE EFF THINKS SCRAPING ISN'T A CFAA VIOLATION

DOUBLE BUT:

In X Corp. v. Bright Data (2024) the court dismissed X's claims over logged-out scraping of public posts, including the system-access/trespass theories.

This doesn't absolve Nitter because the C&D letter they received means if they continue there's now a clear boundary of "without authorization".

but since the world isn't sane, we have an outlier:

Ticketmaster v. Prestige Entertainment involved bots placing a large load on Ticketmaster's servers while using rotating IPs and URLs to evade the blocks Ticketmaster imposed. The Ninth Circuit held that circumventing technical access barriers can render access "without authorization".

We know from unsealed records of the The New York Times v. OpenAI and Microsoft case that an engineer at OpenAI found a way to bypass the NYTimes paywall so they could access every article was acknowledged with "ah nice", but apparently that doesn't matter because X Corp. v. Bright Data said so.

State computer crime laws like California Penal Code § 502 don't require "hacking", so that could still apply but nobody seems to be pursuing it after all these years.