Section 1201 of the Digital Millennium Copyright Act bars circumventing a technological measure that controls access to a copyrighted work, regardless of whether the underlying content itself is independently copyrightable — in 2026 it became the central legal theory platforms use against scrapers, arguing that defeating a CAPTCHA or bot-detection system is itself the circumvention, separate from any copyright claim over the scraped data.
Ordinary copyright claims over scraped data often fail outright because facts, URLs, and short snippets aren't copyrightable subject matter — exactly the kind of content a search-results page mostly consists of. A Section 1201 claim sidesteps that weakness: it targets the act of defeating an access-control measure, not the copyright status of what's behind it, so a plaintiff can argue a CAPTCHA or anti-bot check is itself a technological measure controlling access to a copyrighted work, even when most of the individual data points accessed aren't independently protectable.
This is the theory Reddit used in 2026 against SerpApi and Perplexity, arguing that scraping Google search-results pages containing Reddit content required defeating Google's own bot detection as the access-control step — a federal court let the core circumvention claim proceed past a motion to dismiss, treating CAPTCHA and bot-detection systems as access controls even though a human visitor can view the same content without circumventing anything.
The CFAA (covered elsewhere in this glossary) targets unauthorized access to a computer system, and has mostly failed against scrapers of public pages since hiQ v. LinkedIn established that data visible without logging in isn't "without authorization" in the CFAA sense. Section 1201 asks a different question entirely — not whether access was authorized, but whether a technological access-control measure was circumvented to get it — which is a separate statute these CFAA precedents don't foreclose.
As of late 2026 this remains an actively litigated, largely untested theory still at the motion-to-dismiss stage across multiple parallel cases, with courts reaching different outcomes on closely related claims depending on the specific content and access control involved. Treat "scraping behind a CAPTCHA raises Section 1201 exposure" as a live, unsettled risk rather than a resolved rule in either direction.
How Crawlora handles this
Crawlora's platform endpoints collect structured, publicly visible data without defeating a CAPTCHA, login wall, or anti-bot challenge the target didn't choose to expose through its own API or public pages — the acceptable-use policy scopes collection to that boundary, the same side of the circumvention question this emerging 2026 case law is drawing a line around.
Related reading
Glossary
FAQ
The theory being litigated in 2026 argues yes — the claim targets circumventing the access-control measure itself, not the copyright status of what's behind it — though this remains an active, unsettled question across parallel cases.
The CFAA asks whether access to a computer system was authorized, and has mostly failed against scrapers of public pages since hiQ v. LinkedIn. Section 1201 asks whether a technological access-control measure like a CAPTCHA was circumvented — a separate, currently more active legal theory.
Not settled. Courts were still ruling on motions to dismiss in 2026 scraping cases raising this theory, with no final merits decision yet — treat it as a real, developing risk rather than a resolved rule either way.
Beyond DMCA Section 1201 (Anti-Circumvention), Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.