---
title: "Is Scraping Public Data Legal? The Logged-Out Rule and 2026 Rulings"
slug: "is-scraping-public-data-legal-logged-out-rule-2026-checklist"
type: "blog-post"
url: "https://automationbyexperts.com/blog/is-scraping-public-data-legal-logged-out-rule-2026-checklist"
date: "2026-11-07"
category: "Web Scraping"
tags: ["web scraping legal", "logged-out scraping", "Meta v Bright Data", "Reddit v SerpApi", "DMCA 1201", "lead generation"]
read_time: 8
author: "Youssef Farhan"
---

# Is Scraping Public Data Legal? The Logged-Out Rule and 2026 Rulings

> Logged-out scraping of public pages has fared better in court than anything behind a login, but anti-circumvention claims are the new risk. What Meta v. Bright Data and Reddit v. SerpApi mean, plus a checklist.

**Short answer:** In the US, scraping public pages that a logged-out visitor can see has held up in court better than anything involving a login, but it is not risk-free. Two things decide most cases: whether you agreed to the site's terms (logging in usually means you did), and whether you got past a technical access control. Facts like prices and addresses are safer than personal data, and none of this is legal advice.

## What did the Meta v. Bright Data ruling say about logged-out scraping?

On 23 January 2024, Judge Edward Chen of the Northern District of California granted summary judgment to Bright Data in Meta's breach-of-contract suit, according to a [Lowenstein client alert](https://www.lowenstein.com/news-insights/publications/client-alerts/meta-v-bright-data-ruling-has-important-implications-for-webscraping-activities-by-investment-advisers-im). The court found that Meta's terms for Facebook and Instagram prohibit scraping while logged in, not while logged out. Bright Data argued it is not a "user" when it is not logged into an account, and the judge agreed.

The judge also held that once Bright Data closed its Meta accounts, Meta could no longer bind it to the earlier prohibition, and that Meta had not shown evidence that Bright Data scraped while logged in to reach nonpublic data. [MediaPost](https://www.mediapost.com/publications/article/392920/judge-sides-against-meta-in-battle-over-scraping-p.html) covered the decision and later ran a headline reporting that Meta abandoned the lawsuit.

Commentators stress how narrow this is. The same Lowenstein note says current terms are unlikely to expressly restrict logged-out scraping, so the outcome depends on the exact contract wording. It is a district court ruling, not a rule for every site.

## Is scraping public data a crime under the CFAA?

The long-running reference point is hiQ v. LinkedIn. A summary on [Signal Census](https://signalcensus.pages.dev/articles/linkedin-hiq-ninth-circuit-doctrine-2026) says the Ninth Circuit found that scraping publicly accessible data is not a violation of the Computer Fraud and Abuse Act, and that hiQ was later found to have breached LinkedIn's user agreement before the parties settled. That second half matters: avoiding a criminal-style claim did not protect hiQ from a contract claim.

## What changed in 2026: Reddit v. SerpApi and anti-circumvention claims?

The newer risk is not contract law, it is copyright law's anti-circumvention rules. According to a [Loeb & Loeb note](https://www.loeb.com/en/insights/publications/2026/08/reddit-v-serpapi-llc) and other summaries, on 31 July 2026 Judge Paul Engelmayer (S.D.N.Y.) largely denied the motions to dismiss in Reddit v. SerpApi and Perplexity. Reddit's DMCA Section 1201(a) claims survived, with the court treating Google's SearchGuard as a technological measure that controls access. The Section 1201(b) claim against SerpApi, and the unfair competition and unjust enrichment counts, were dismissed.

This was a motion-to-dismiss ruling, so it only means the claims were plausibly pleaded. It is not a finding that Reddit wins. Reports on the separate Google v. SerpApi case, which we cover in [our Google v. SerpApi post](https://automationbyexperts.com/blog/google-v-serpapi-ruling-is-scraping-search-results-legal), describe a July 2026 dismissal in a different court, so courts are not yet speaking with one voice.

The practical lesson: public is not the same as unprotected. If a site puts a deliberate technical barrier in front of data, the legal question can change from "was it public?" to "did you circumvent a barrier?".

## Which scraping risks apply to which situation?

| Situation | Main legal risk | Lower or higher? |
| --- | --- | --- |
| Official open data (city registers, government portals) | Little beyond the dataset's own licence | Lower |
| Public pages, logged out, no access controls bypassed | Contract terms you never accepted, robots.txt, copyright in creative content | Lower to moderate |
| Public pages behind anti-bot systems you work around | Anti-circumvention claims (the Reddit v. SerpApi theory) | Moderate to higher |
| Anything behind your own login | Breach of terms you accepted, account termination | Higher |
| Personal data of EU or California residents | GDPR, CCPA, whatever the access method | Depends on the data |

This table is our summary of the sources cited in this article, not a legal classification.

## Why does logged in versus logged out matter so much?

A contract needs agreement. When you create an account you click through terms, and those terms often ban automated collection. When you load a public page without an account, a court may ask whether you ever agreed to anything. The Bright Data decision turned on exactly that distinction: Bright Data argued it was not a "user" while logged out, and the judge agreed. One source in our research makes the same point from the other side, noting that a clicked agreement is a stronger basis for liability than a browsewrap notice at the bottom of a page.

The consequence for anyone running scheduled scrapers is simple. Do not feed a scraper your own social or marketplace account credentials to reach more data. Even if the data looks public once you are inside, you have attached yourself to terms you accepted, and you have given the platform a reason to close the account on top of any legal claim.

## What is still unsettled?

Plenty. The Reddit case is at the pleading stage and will go to discovery, so the court has not decided whether the scrapers actually circumvented anything. The Google case against SerpApi, as we covered in the earlier post, saw a dismissal followed by an amended complaint according to the reports we read. The Meta case ended without an appeal, which means no higher court ever tested the logged-out reasoning. And privacy law sits on a separate track entirely: how you got the data does not change whether personal data in it is regulated.

Several of the 2026 summaries we read come from vendors that sell scraping tools or proxies, and some are blogs rather than legal analysis. We have only cited points that more than one source supports or that come from a law-firm note, and we have flagged the ones we could not confirm against court filings. If your project depends on the answer, read the opinions and ask a lawyer who knows your jurisdiction.

## How should a business decide what to scrape?

A simple order of preference works well. First, check whether the publisher offers an official API or open data download, because that removes the question. Second, if you need pages, confirm they are visible to a logged-out visitor and that you are not defeating a protection system to read them. Third, collect only the fields you need, and drop personal fields you will never use. Fourth, write down your reasoning so that if a complaint arrives you can show what you did and why. Teams that follow those four steps tend to spend less time worrying and more time using the data.

## What is a practical checklist for scraping public data?

- **Stay logged out.** Several 2026 guides, including the one from [use-apify.com](https://use-apify.com/docs/what-is-apify/is-apify-legal), treat a login as the point where contract and anti-hacking laws start to bite.

- **Do not bypass access controls.** No CAPTCHA-cracking or defeating a protection system that is clearly meant to keep automated access out. See [our guide to sites that block bots](https://automationbyexperts.com/blog/scrape-website-that-blocks-bots-anti-bot-protection) for the legitimate options.

- **Prefer facts to people.** Prices, specifications, dates and licence records are safer than personal profiles.

- **Read the terms and robots.txt.** They are not the whole law, but they shape how a dispute looks.

- **Rate-limit and identify your bot.** It lowers the chance of a technical or contractual complaint.

- **Keep a record.** Note what you collected, from where, logged out or not, and why.

- **Get advice for risky sources.** Authenticated content, social platforms and anything commercially sensitive deserve a lawyer, not a blog post.

## What is the lowest-risk way to build a lead list from public data?

Start from sources whose publisher expects you to reuse the data. Cities publish business licence registers as open data, so a new-business lead feed can be built without logins, proxies or anti-bot workarounds. Our [New Business License Feed](https://automationbyexperts.com/apify/business-license-feed) reads the official open data for Chicago, Los Angeles, New York City, Seattle and New Orleans, filters to the licence types you care about, and on a weekly schedule returns only openings it has not already sent. Per its page it needs no API key, account or proxy, and costs $0.002 per new licence returned, so about $2 per 1,000.

For more options by use case, see the [lead generation actors hub](https://automationbyexperts.com/apify/category/lead-generation) and our post on [tracking competitor prices automatically](https://automationbyexperts.com/blog/track-competitor-prices-automatically-2026), which applies the same public-data-first approach to price monitoring.

## Frequently asked questions

**Is web scraping legal in the US?**Scraping public, logged-out pages has generally fared well in the cases above, but contract, anti-circumvention, copyright and privacy claims can still apply. The answer depends on the site, the data and how you collected it.

**Does Meta v. Bright Data mean I can scrape any site while logged out?**No. It was a district court ruling about Meta's specific terms. Commentators note the result depends on the exact contract language, and other claims were not decided that way.

**Can ignoring robots.txt get me sued?**One 2026 summary reports a ruling that ignoring robots.txt does not itself circumvent a DMCA technological measure because it is a request, not an access barrier, but that summary could not be confirmed against the docket. Treat robots.txt as a courtesy that still shapes how a dispute looks.

**Is scraping personal data different?**Yes. Privacy laws such as GDPR and CCPA apply regardless of how the data was accessed, so collect the minimum and avoid personal data you do not need.

## Try it on data meant to be reused

If you want a lead feed with the lowest legal friction, run the [New Business License Feed](https://automationbyexperts.com/apify/business-license-feed) on a weekly schedule. New Apify accounts can start with free credit through our [Apify link](https://apify.com/fayoussef?fpr=youssef&fp_sid=blog). This article is general information, not legal advice.

*Last updated: November 2026*

## Actors used in this guide

- [New Business License Feed - Fresh Openings by City](https://automationbyexperts.com/apify/business-license-feed): It returns every business, food, liquor and trade license newly issued in Chicago, Los Angeles, New York, Seattle and…
- [Reddit Lead Finder - Buying-Intent Posts, Comments & Alerts](https://automationbyexperts.com/apify/reddit-lead-finder): It scans Reddit posts and comments for buying intent - people asking for a tool, an alternative to X, or recommendati…