Collecting public pages while logged out has held up in US courts: hiQ won the hacking-law argument and Meta lost its contract claim against Bright Data. Logged-in scraping still carries contract risk, as hiQ’s $500,000 settlement shows. The newer line is circumvention: in July 2026 a New York court treated Google’s SearchGuard as an access control under the DMCA, while a California court dismissed most of Google’s own claims against SerpApi. In Germany, scraping against a site’s terms is not unfair competition by itself, but losing control of personal data can cost about €100 per person. This is a summary, not legal advice.
The timeline at a glance
| Date | Case or event | Where | What happened |
|---|---|---|---|
| 30 Apr 2014 | Ryanair v. a flight portal (I ZR 224/12) | Germany, Federal Court of Justice | Screen scraping against a site’s terms is not unfair competition by itself |
| Jun 2021 | Van Buren v. United States | US Supreme Court | The federal hacking law’s “exceeds authorized access” covers only areas that are off-limits to you |
| Apr 2022 | hiQ v. LinkedIn | US Ninth Circuit | Scraping public profiles is likely not access “without authorization” |
| 6 Dec 2022 | hiQ v. LinkedIn settlement | N.D. California | $500,000 judgment against hiQ, a scraping ban and data deletion |
| 23 Jan 2024 | Meta v. Bright Data | N.D. California | Logged-out collection of public data is not “use” under Meta’s terms |
| May and Nov 2024 | X Corp v. Bright Data | N.D. California | Suit dismissed, then partly revived on a server-load theory |
| 18 Nov 2024 | Facebook scraping (VI ZR 10/24) | Germany, Federal Court of Justice | Loss of control over scraped personal data is damage, about €100 |
| 15 Jan 2025 | Google requires JavaScript (SearchGuard) | Google Search | Plain HTTP scrapers stop getting results |
| 22 Oct 2025 | Reddit sues SerpApi, Perplexity, Oxylabs and AWMProxy | S.D. New York | DMCA anti-circumvention claims over Google results |
| 19 Dec 2025 | Google v. SerpApi filed | N.D. California | DMCA claims over getting past SearchGuard |
| 2 Jul 2026 | NetNut domains seized | FBI and IRS-CI | Residential proxy service linked to the Popa botnet |
| 20 Jul 2026 | Google v. SerpApi ruling | N.D. California | Most claims dismissed; a narrow claim may be refiled |
| 31 Jul 2026 | Reddit v. SerpApi ruling | S.D. New York | SearchGuard is an access control; core claims go ahead |
Public data while logged out
hiQ Labs scraped public LinkedIn profiles and argued it was not “hacking” under the Computer Fraud and Abuse Act. The Ninth Circuit agreed in 2019, the Supreme Court sent the case back after Van Buren narrowed the law in June 2021, and in April 2022 the Ninth Circuit reached the same conclusion again. The win did not last. In November 2022 the district court found hiQ had breached LinkedIn’s User Agreement, through scraping and through fake accounts, and the case settled on 6 December 2022 with a $500,000 judgment against hiQ, a permanent ban on scraping LinkedIn and an order to delete the data and code.
Meta’s suit against Bright Data went the other way on contract. On 23 January 2024 Judge Edward Chen granted Bright Data summary judgment: Meta’s terms govern how account holders use its products, and collecting public Facebook and Instagram pages while logged out is not “use”. The court found no evidence that Bright Data scraped behind a login. A month later Meta dropped its remaining claim and gave up its appeal.
Put together, the two cases draw a line most teams can work with. Public pages collected without an account have held up; anything done through an account, especially a fake one, puts you inside a contract the platform can enforce. Both are district or appeals rulings in one US circuit, not a nationwide rule.
X Corp v. Bright Data and the server-load theory
X sued Bright Data in 2023 over scraping public posts. A federal judge dismissed the suit in May 2024, but on 26 November 2024 the court let X amend part of it. Claims built on scraping itself were held preempted by copyright law, while trespass, interference and access-based contract claims could go forward on the theory that heavy scraping impairs X’s servers. Bright Data answered with an antitrust counterclaim in December 2024. We found no later ruling.
The practical point survives whatever happens next: the volume and pace of collection can become the legal issue, even when the data is public.
Anti-bot systems as access controls
Since 15 January 2025 Google has required JavaScript to show search results, and the system that challenges unrecognised clients is known as SearchGuard. Two lawsuits now ask whether getting past it breaks Section 1201 of the DMCA, the 1998 provision that bans getting around technological measures protecting copyrighted works.
Google sued SerpApi on 19 December 2025, alleging fake browsers, rotating identities and large networks of IP addresses. On 20 July 2026 Chief Judge Yvonne Gonzalez Rogers dismissed most of the case. Search results with no copyrighted content cannot support a Section 1201 claim, she held, so those claims ended without leave to amend. Claims over copyrighted Knowledge Panel images were dismissed with leave to amend, because Google had not shown it controlled access with the copyright owners’ authority. She did find that Google had adequately alleged circumvention, including disguising automated queries as human traffic. Google filed an amended complaint in August, and SerpApi moved to dismiss it again; we found no reported ruling on that motion by the time of writing.
Reddit’s case went further against the scraper. Reddit sued in October 2025 over Google results that include Reddit content, naming SerpApi, Perplexity and two proxy providers, Oxylabs and AWMProxy. On 31 July 2026 the court in New York ruled on SerpApi’s and Perplexity’s motions: SearchGuard is a technological measure that effectively controls access, even though people pass through it, because it separates automated clients from humans. The circumvention and trafficking claims and a civil-conspiracy claim go ahead; the unjust-enrichment and unfair-competition claims were dismissed as preempted.
Why this matters for a proxy user
Two federal courts have now ruled on claims about the same anti-bot system, with different outcomes, and one complaint named proxy providers alongside the scraper. No court has held that using a proxy by itself is circumvention. Selling or running tools built to defeat an anti-bot challenge is where the legal risk now sits, and marketing that promises to “bypass” protection is the kind of evidence these complaints quote.
Where proxy IPs come from: the NetNut seizure
On 2 July 2026 the FBI and IRS Criminal Investigation, with Google, Lumen, Shadowserver and other partners, seized hundreds of domains associated with NetNut, a residential proxy service. Two weeks earlier, security firms had reported that NetNut’s software populated the Popa botnet of at least two million devices, including smart TVs and streaming boxes, some sold with proxy software preinstalled. Google’s threat intelligence team said it saw 316 distinct threat-actor clusters using suspected NetNut exits in one week of June 2026. KrebsOnSecurity reported no charges or arrests, and the parent company said it was cooperating with investigators.
The case moves the sourcing of residential IPs from an ethics footnote to a due-diligence question. If a provider cannot explain how the devices in its pool joined it, a customer has no way to know whether its traffic runs through someone’s compromised television.
Germany: competition law and data protection
German law splits the question in two. On competition, the Federal Court of Justice held in 2014 (I ZR 224/12) that a flight portal reading Ryanair’s site automatically, against its terms, was not unfairly obstructing it. A terms-of-use checkbox is not a technical protection, and the public interest in price transparency counted in the portal’s favour.
On personal data the same court is strict. In the Facebook scraping case of 18 November 2024 (VI ZR 10/24), about 533 million users’ data had been harvested through a contact-import feature and published. The court held that even a brief loss of control over personal data is damage under Article 82 GDPR, without proof of misuse, and treated about €100 as an acceptable amount. Multiplied across a dataset, that is the number to keep in mind.
Bots and purchase limits
In the US, the BOTS Act covers tickets only. The FTC used it on 18 August 2025 against Key Investment Group, which allegedly bought at least 379,776 tickets in just over a year using false IP addresses, cards and phone numbers. A bill to extend similar rules to retail purchase limits, the Stopping Grinch Bots Act (S.3516), was introduced on 17 December 2025 and had not moved by October 2026. For sneakers and other retail goods the binding rules are still each store’s terms, enforced through cancelled orders and closed accounts.
What this means for teams using proxies
- Public pages collected without logging in are on the firmest ground in the US. Work behind a login, and above all with fake accounts, is where contract claims land.
- Volume matters. The X case shows that load on a site’s servers can carry a claim even when the data is public, so pace requests and back off on errors.
- Do not defeat challenges. After the SerpApi rulings, solving CAPTCHAs and JavaScript challenges at scale carries the clearest legal risk, separate from using a proxy at all.
- In the EU, personal data changes everything. Prices, stock and rankings are low risk; names, contacts and profiles need a lawful basis, and German courts treat loss of control as damage.
- Ask where the IPs come from, and keep the answer on file.
- In the US, using bots to get around ticket sites’ security or purchase limits, or reselling tickets bought that way, breaks the BOTS Act. Retail bots break store terms, and may break the law later.
How we apply it
Our guides tell you to slow down on a CAPTCHA or a 429 and never include code to solve challenges or get around anti-bot systems. We do not support ticket bots, ban evasion, bought engagement, account farms or getting around age checks, and the gateway blocks resources that are prohibited by law or by our terms. The SERP page and the Instagram page apply these rules to their own targets.
Court cases move. We will update this guide when the SerpApi motions are decided; the dates above are as of 18 October 2026.
Published Oct 18, 2026. We update this guide when the platforms change; dated facts above are as of publication.