Crawls the web, in the United States

17 U.S.C. §§ 105, 302 and 511 · Read the law's page

• Do not assume you need the Government's permission to reproduce a work of the United States Government: copyright protection under title 17 is not available for it (s. 105(a)).
• Get permission from the owner before you reproduce a copyright that the United States Government holds by transfer, whether by assignment, bequest, or otherwise (s. 105(a)).
• Treat the covered author, not the Government, as the owner of the copyright in a literary work produced by a civilian faculty member of a covered institution in the course of employment there for publication by a scholarly press or journal (s. 105(b), (d)).
• Count a work created on or after January 1, 1978 as protected for the life of the author and 70 years after the author's death, and a joint work not made for hire for the life of the last surviving author and 70 years after that author's death (s. 302(a), (b)).
• Count an anonymous work, a pseudonymous work, or a work made for hire as protected for 95 years from the year of its first publication or 120 years from the year of its creation, whichever expires first (s. 302(c)).
• Do not rely on section 511(a) to sue a State or State instrumentality for infringement: the Supreme Court held that Congress lacked authority to abrogate the States' immunity from copyright infringement suits in the Copyright Remedy Clarification Act (Allen v. Cooper (2020)).

17 U.S.C. §§ 106 and 501 · Read the law's page

• Get the copyright owner's permission before you reproduce a copyrighted work in copies or phonorecords, prepare a derivative work based on it, or distribute copies or phonorecords of it to the public by sale or other transfer of ownership, or by rental, lease, or lending, unless sections 107 through 122 allow the use (s. 106(1) to (3)).
• Get the copyright owner's permission before you publicly perform or publicly display a work of a kind clauses (4) and (5) of section 106 name, or publicly perform a sound recording by means of a digital audio transmission, unless sections 107 through 122 allow the use (s. 106(4) to (6)).
• Treat transmitting or otherwise communicating a performance or display of a work to the public by any device or process as performing or displaying it publicly, whether the recipients receive it in the same place or in separate places and at the same time or at different times (s. 101).
• Do not violate any of the exclusive rights provided by sections 106 through 122, or import copies or phonorecords into the United States in violation of section 602: anyone who does is an infringer, including a State, a State instrumentality, and a State officer or employee acting in an official capacity (s. 501(a)).
• Do not induce or encourage users to infringe, and do not profit from their infringement while declining to exercise a right to stop or limit it: the Supreme Court describes the first as contributory infringement and the second as vicarious infringement (MGM Studios v. Grokster, 545 U.S. 913 (2005)).

18 U.S.C. § 1030 · Read the law's page

• Scraping a public, unauthenticated page does not by itself expose you to CFAA liability (hiQ Labs v. LinkedIn, 9th Cir. 2022).
• Do not continue accessing a site, or circumvent a technical block, after the operator has sent an individualized notice revoking your access (Facebook v. Power Ventures, 9th Cir. 2016).
• A CFAA win does not clear you of state-law exposure: hiQ itself was ultimately held liable under contract and trespass-to-chattels theories for the same conduct.

18 U.S.C. § 2701 · Read the law's page

• Do not intentionally access without authorization a facility through which an electronic communication service is provided, or intentionally exceed an authorization to access that facility, and thereby obtain, alter or prevent authorized access to a wire or electronic communication while it is in electronic storage in that system (18 U.S.C. § 2701(a)).
• Access such a facility only with authorization from the person or entity providing the service or, for a communication of or intended for that user, from a user of that service (18 U.S.C. § 2701(c)(1) and (2)).

17 U.S.C. § 1201 · Read the law's page

• Do not circumvent a technological measure that controls access to a copyrighted work in order to collect it.

17 U.S.C. § 1202 · Read the law's page

• Do not intentionally remove or alter copyright management information, meaning the title, the names of the author and copyright owner, the copyright notice and the terms and conditions for use, on works you copy, unless the copyright owner or the law authorizes it.
• Do not distribute, import for distribution or publicly perform works or copies, or distribute the information itself, knowing that copyright management information has been removed or altered without authority; for works and copies the text also requires that you know, or for civil remedies have reasonable grounds to know, that doing so will induce, enable, facilitate or conceal an infringement.
• Do not provide or distribute false copyright management information with the intent to induce, enable, facilitate or conceal infringement.

306 F.3d 17 (2d Cir. 2002)

• A site that wants a user bound by license or use terms has to give notice of their existence where a reasonably prudent user will see it before acting: a reference to the terms below the download button, on a screen reached by scrolling, was held not to bind users who downloaded the software.
• Secure an unambiguous manifestation of the user's assent to the terms; the Second Circuit stated that reasonably conspicuous notice of the terms and unambiguous manifestation of assent are essential to the integrity and credibility of electronic bargaining.

356 F.3d 393 (2d Cir. 2004)

• Comply with the conditions on which a site offers its data once you know them, even though the site offered no I agree icon to click: the Second Circuit affirmed a preliminary injunction on a contract theory against a collector that knew the conditions and kept taking the data.
• Treat conditions of use that a site returns with each response as notice of them when you query repeatedly: the court treated each of Verio's numerous daily queries as one that returned the terms, and said its contrary argument might well have been persuasive had the queries been sporadic and infrequent.

412 F. Supp. 2d 1106 (D. Nev. 2006)

• Expect caching of web pages for search results to be defensible: the District of Nevada granted Google summary judgment, holding that it did not directly infringe, that the caching was fair use, and that the DMCA's system-cache safe harbor barred damages.
• Expect an implied license to be found where a site owner knew it could stop cached links with the 'no-archive' meta-tag and did not use it: the court so held against this author and held him estopped from suing.
• Do not assume the same result where a site has used the 'no-archive' meta-tag.

868 F.3d 66 (2d Cir. 2017)

• Treat a site's linked terms as binding on you when you register an account through a screen that conspicuously puts the link beside the register button and states that creating an account means agreeing to them, whether or not you open the link (Meyer v. Uber, 2d Cir. 2017, applying California law).
• A site that wants its terms enforced against a registered user has to give reasonably conspicuous notice of them and secure an unambiguous manifestation of assent, judged from the position of a reasonably prudent user of the device.

No. 3:21-cv-00098-E (N.D. Tex. Sept. 30, 2021)

• Do not scrape a site's data in breach of terms you know of: the district court enjoined a company from scraping flight and fare data after finding that it bound itself to the website's terms by continuing to use the site with actual knowledge of them.
• Treat a cease-and-desist letter that quotes or attaches a site's terms as notice of them: the court relied on repeated notices of that kind, together with the company's acceptance of the terms at each ticket purchase, in finding a valid contract.

30 F.4th 849 (9th Cir. 2022)

• A site that wants its terms to bind a visitor has to display the notice of them in a font size and format that a reasonably prudent Internet user would have seen; fine print in a tiny gray font, smaller than the surrounding text, was held not conspicuous.
• Make the presence of a hyperlink to the terms readily apparent: the court held that underscoring words alone will often be insufficient, and named a contrasting font color, typically blue, and all capital letters as customary signals.
• Tell the user explicitly that the action being taken, such as clicking a button, means agreement to the terms: the court held that a click on a button signifies assent only if the user is explicitly advised that the click will constitute assent.

31 F.4th 1180 (9th Cir. 2022)

• Expect the Computer Fraud and Abuse Act case against scraping public webpages to be contested: affirming a preliminary injunction for the scraper, the Ninth Circuit found a serious question whether 'without authorization' reaches only computers where authorization, such as password authentication, is generally required.
• Do not read the ruling as clearing scraping under other laws: the court noted that state-law trespass to chattels claims may still be available, and that copyright infringement, misappropriation or breach of contract claims may also lie.

No. 23-cv-00077-EMC (N.D. Cal. Jan. 23, 2024)

• Under the district court's summary judgment reading of Meta's Facebook and Instagram Terms, scraping of publicly available data while logged off is not a breach of those Terms, even by a company that holds or held accounts with the service.
• Do not use an account's access to scrape: the court read the Terms as aimed at account holders abusing the access their accounts give them, and its holding covers logged-off scraping of public data.

No. C 23-03698 WHA (N.D. Cal. May 9, 2024)

• A platform's state-law claims that rest on your scraping and selling of publicly visible user content were held preempted by the Copyright Act at the pleading stage (X Corp. v. Bright Data, N.D. Cal. 2024); the court concluded that how far public data may be copied from social media platforms should generally be governed by the Copyright Act rather than by the platform's terms.
• Treat access to a platform's systems separately from scraping of its public data: the court dismissed the access-based claims only because X Corp. pleaded threadbare, conclusory facts, not because they were preempted.

28 CFR Part 202 · Read the law's page

• Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.
• Apply the required security safeguards to a restricted vendor, employment, or investment transaction that would give a country of concern or covered person access to that data.
• Treat data as in scope even when it is anonymized, pseudonymized, de-identified or encrypted: a collection of sensitive personal data counts toward the bulk threshold in any of those forms (28 CFR 202.206).

Discussion Draft, 119th Cong. (June 4, 2026)

H.R. 9915, 119th Congress · Read the law's page

• Do not deploy a bot that accesses a website, digital platform, or online service without disclosing its identity and purpose, in a manner reasonably likely to damage, impair, or burden the technical or commercial operation of the website or service.
• Identify your bot through a valid and accurate user-agent string, and disclose its specific nature and purpose, including any proposed use of page content such as search indexing or artificial intelligence training, at the time access is requested and in a format the website operator can access.
• Do not intentionally misrepresent, conceal, or obscure the nature of a bot so that it appears to be a human user, for use in connection with a generative AI model or service.

H.R.7209 / S.2455, 119th Cong. (2025-2026)

S. 2367, 119th Congress · Read the law's page

• Do not appropriate, use, collect, process, sell, or otherwise exploit an individual's covered data, in or affecting interstate or foreign commerce, without the individual's express, prior consent (Section 3(a)).
• Do not train a generative artificial intelligence system that you sell, rent, license, or otherwise use on an individual's covered data without that individual's express, prior consent, and do not generate covered data pertaining to an individual, including content that imitates, replicates, or is substantially derived from the individual's covered data, without it (Section 2(1) with Section 3(a)).
• Treat covered data as information that can reasonably be linked to a specific individual, information derived, inferred, or generated from it, and material the individual created that is protected by copyright whether or not it is registered (Section 2(4)).
• Obtain consent as a clear, affirmative act made in advance, freely given, informed, and unambiguous, for the specific use (Section 2(5)); consent obtained through coercion or deception, or as a condition of using a product or service where the use exceeds what is reasonably necessary to provide it, is not valid (Section 3(b)(3)(B)).
• Where covered data goes to or is used by a third party, specifically and clearly disclose each third party to the individual when consent is sought, present the disclosure distinctly and separately from any privacy policy or terms of service, and do not rely on a hyperlink or a general reference to a privacy policy (Section 3(d)).
• Do not rely on a predispute arbitration agreement or a predispute joint-action waiver to avoid a claim under the Act; neither is valid or enforceable for it (Section 3(c)).