Terms of Service (ToS) Violation

A Terms of Service violation happens when a scraper accesses or uses a site's data in a way its published terms explicitly prohibit. This is a contract-law question, separate from the copyright and computer-fraud questions it gets confused with, and violating a ToS alone, without also bypassing a technical access control, has historically produced weaker legal consequences than the reverse.

This page is general information, not legal advice. Scraping law varies by jurisdiction and keeps moving. Talk to a lawyer about your specific situation.

What Counts as a ToS Violation?

Most terms of service include a clause covering automated access. Typical prohibited activities are using bots, crawlers, or scrapers; collecting data in bulk; reproducing content commercially; creating accounts programmatically; and circumventing rate limits or access restrictions.

Breaching one of these is a breach of contract if the terms form a contract with you. That "if" is doing more work than most discussions of scraping terms of service acknowledge.

Three Legal Questions People Merge Into One

You can be exposed on one and clear on the others. Scraping public pages in breach of a browsewrap ToS is primarily a contract issue. Scraping the same data after logging in with a fake account adds an authorization question. Republishing the content wholesale adds a copyright question. Does web scraping violate ToS is therefore the narrowest of the three questions, and rarely the most consequential one.

Browsewrap vs Clickwrap

Enforceability turns largely on whether you agreed to the terms at all.

Clickwrap terms require an affirmative action, typically checking a box or clicking accept during signup. Courts enforce these routinely. If your scraper runs from a logged-in account, you almost certainly accepted clickwrap terms.

Browsewrap terms sit behind a footer link with no acceptance step. Enforceability is far shakier, and often depends on whether a reasonable user would have had notice. A scraper that never logs in and never sees the footer has a meaningfully different position from an account holder.

This is why the login question matters so much more than it first appears. Authenticating usually converts an ambiguous browsewrap argument into a clear clickwrap agreement, and it can turn an access question into a much more serious one.

What a ToS Violation Actually Leads To

In practice, the common outcomes are mundane rather than dramatic:

• IP blocks and rate limiting. By far the most frequent response, and purely technical.
• Account termination, where an account was used.
• A cease-and-desist letter, the typical first formal step.
• Civil litigation. A ToS violation lawsuit is a breach-of-contract claim, where the plaintiff generally needs to show a contract existed and that the breach caused damages. Both can be difficult where data was public and no account was involved. Claims that stick tend to bundle the contract claim with something else: circumvention of technical measures, copyright infringement, or misappropriation. The contract claim alone is usually the weakest piece.

Reducing Your Risk

• Read the terms of the sites you target. Obvious, routinely skipped, and the only way to know what you're dealing with.
• Prefer public pages over authenticated ones. See public data scraping for why the line matters.
• Don't create accounts to scrape with. That's the single change that most reliably worsens your position.
• Respect rate limits and crawl-delay. Volume that degrades a site invites both blocks and damages arguments.
• Check robots.txt and robots meta tags. Not binding on their own, but a documented statement of intent.
• Collect only what you need, and think separately about what you do with it, particularly personal data under GDPR or CCPA.
• Get advice before commercial-scale collection. The cost of a legal consultation is small next to the cost of getting this wrong at volume.