hiQ Labs v. LinkedIn is the case people cite to say scraping public data is legal, and that citation is half right. The Ninth Circuit did hold, twice, that collecting data available to the general public is not access "without authorization" under the Computer Fraud and Abuse Act. That holding stands. What almost nobody cites is the ending: LinkedIn won summary judgment on its breach-of-contract claim in November 2022, and the case settled that December with hiQ accepting a permanent injunction, $500,000 in damages, and an order to delete both the scraped data and the code that collected it. The company that won the landmark scraping precedent was put out of the scraping business by the same lawsuit.
Both halves still apply, and the second half is the one that should change what you build.
This page describes how the case was decided. It is not legal advice.
hiQ Labs built a people-analytics product on public LinkedIn profiles. LinkedIn sent a cease-and-desist in 2017 and blocked hiQ's access, and hiQ sued for an injunction.
2019 and 2022, the Ninth Circuit sided with hiQ on the CFAA. The court reasoned that the statute's "without authorization" language presumes a barrier to get past, and that a profile served to any anonymous visitor has no such barrier. After the Supreme Court decided Van Buren v. United States in 2021, adopting a gates-up-or-down reading of the CFAA, the Ninth Circuit reaffirmed its position.
November 2022, the district court sided with LinkedIn on the contract. LinkedIn's user agreement prohibited automated scraping, hiQ had accepted it, and the court found hiQ had breached it. The record also included hiQ's use of crowdsourced workers to create fake accounts, which is a different and worse fact than reading public pages.
December 2022, the case ended by consent judgment. hiQ agreed to stop scraping, delete the data, the source code, and the algorithms, pay $500,000, and stipulate that LinkedIn could establish CFAA liability. That stipulation was a settlement term, not a judicial finding, so it carries no precedential weight, but the practical outcome was total.
The CFAA holding is intact and useful: for public pages, the federal hacking statute is not the site's weapon. That has been reinforced since. In Meta Platforms v. Bright Data (January 2024), the Northern District of California granted Bright Data summary judgment, reasoning that a scraper operating while logged out was not a "user" of Facebook or Instagram and so was never bound by their terms. The same court struck down Meta's survival clause, which had tried to prohibit public scraping in perpetuity after account termination.
Put those beside hiQ and a working rule appears, one that has nothing to do with hacking law:
Do you have an account with the site you are collecting from? If yes, you accepted terms and those terms are enforceable against you. If no, and the pages are genuinely public, the site's contract theory is much weaker.
hiQ had an account. Bright Data scraped logged out. That difference, more than any statute, decided both cases.
Three things follow for anyone building on public web data.
Anonymous, logged-out collection of public pages is the defensible posture, and it is the one to design for deliberately rather than by accident.
Accepting terms of service on a site you intend to collect from is the risk, and it is often created casually by an engineer signing up to look around.
Winning on the CFAA is not the same as winning. hiQ was right about the statute for five years and still ended up enjoined and paying.
String's Web Access API fetches the pages a customer names. What you are permitted to collect depends on your own targets, your jurisdiction, and your counsel, not on your choice of vendor. Our terms of service set out what we require of customers, and the trust center covers our compliance status.
Both, and the loss is what ended the company. hiQ won on the Computer Fraud and Abuse Act at the Ninth Circuit in 2019 and again in 2022. It lost on breach of contract in the district court in November 2022 and settled in December, accepting a permanent injunction, $500,000 in damages, and deletion of its data and code.
The CFAA holding does: scraping public data is not access without authorization in the Ninth Circuit. The case is also a live warning that contract claims are the real exposure, which the settlement demonstrated more clearly than the appellate opinions did.
No. hiQ itself was permanently enjoined from doing exactly that. The ruling says the CFAA is not the right tool against public scraping; it does not say a site's user agreement is unenforceable against someone who accepted it.
Bright Data scraped while logged out, so the court found it was not a "user" bound by Meta's terms. hiQ had accepted LinkedIn's user agreement. The presence or absence of an accepted contract is the hinge in both cases.
Collect public pages anonymously, avoid creating accounts on sites you intend to collect from, honour published crawler policies, and take advice on personal data and copyright separately, because neither is governed by the CFAA at all.
