The Computer Fraud and Abuse Act (CFAA) is the primary U.S. federal law governing unauthorized computer access, and it's the statute most often invoked against web scrapers. Courts have narrowed it significantly — most notably in hiQ v. LinkedIn and the Supreme Court's Van Buren decision — to mean that scraping publicly accessible data generally isn't "unauthorized access" under the law.
Van Buren v. United States (2021) narrowed the CFAA's "exceeds authorized access" language, rejecting the argument that misusing data you're technically permitted to access counts as a violation. On remand after Van Buren, the Ninth Circuit reaffirmed in hiQ Labs v. LinkedIn that automated scraping of a website's publicly accessible pages does not constitute access "without authorization" — a site can't turn public data into a CFAA claim just by sending a cease-and-desist. (The underlying dispute ultimately settled, but the legal reasoning on public-data scraping stands as circuit precedent.)
The throughline across both rulings: the CFAA is an anti-hacking statute aimed at breaching access barriers — passwords, logins, technical restrictions — not a general-purpose tool for controlling what happens to data a site already serves to anyone who visits.
A favorable CFAA reading covers one specific legal risk, not every risk. Scraping data behind a login or paywall is a different fact pattern entirely, and courts have treated circumventing an authentication wall far less permissively. Separately, a site's terms of service can still support a breach-of-contract claim even where the CFAA doesn't apply, copyright covers the content itself regardless of access method, and privacy statutes (GDPR, CCPA) govern personal data independent of how it was collected.
"Not a CFAA violation" is a narrower and different claim than "legally risk-free" — treat CFAA analysis as one input to a scraping project's legal review, not the whole assessment.
How Crawlora handles this
This is the exact legal boundary Crawlora's acceptable-use policy is built around — public, structured data workflows within the scope courts have actually cleared, rather than access methods (credential stuffing, paywall circumvention) that fall outside it.
Related reading
Glossary
FAQ
Not generally, for publicly accessible data — hiQ v. LinkedIn and Van Buren narrowed the CFAA to cover breaching actual access barriers, not scraping pages a site already serves to any visitor. Other laws (contract, copyright, privacy statutes) can still apply, though.
The CFAA is a federal criminal and civil statute about unauthorized computer access. Terms of service are a private contract between the site and its users — violating them can support a breach-of-contract claim independent of whether the CFAA applies at all.
Yes, more than public-page scraping does — courts have treated circumventing authentication as a materially different fact pattern from accessing pages already open to the public, and it carries real CFAA exposure that public-data scraping generally doesn't.
Beyond CFAA (Computer Fraud and Abuse Act), Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.