Is Web Scraping Legal? The 2026 Rules for Sales Teams — 930/mo
TL;DR:
- Federal courts have established that scraping publicly accessible web data without bypassing authentication walls does not violate the Computer Fraud and Abuse Act (CFAA).
- Breach of contract claims remain the primary enforcement mechanism for platforms against users who scrape while authenticated under registered accounts.
- The sunset of California's B2B privacy exemption and active enforcement under the Delete Act classify third-party scraped B2B contact lists as regulated personal data.
- Modern anti-bot systems detect headless automation via JA4+ cryptographic handshakes, JavaScript prototype inspection, and WebGL hardware telemetry.
- Running research directly through local desktop browser sessions provides verifiable data provenance while eliminating platform terms exposure and vendor chain-of-custody liabilities.
Public web scraping is legal under United States federal statutory law when collecting unauthenticated, publicly accessible data. At Drevon, we built our free Mac prospect research app around this legal baseline, running browser-native research that observes public business signals directly. For sales and revenue operations teams, however, legal risk has migrated away from federal computer crime statutes toward state privacy enforcement, contractual terms of service claims, and account security controls.
The Legal Baseline: Public Web Data vs. Authenticated Scraping
Accessing publicly available web data without circumventing technical access barriers does not constitute unauthorized access under federal statutory law. The Ninth Circuit affirmed this standard in hiQ Labs, Inc. v. LinkedIn Corp. following the Supreme Court's ruling in Van Buren v. United States. However, accessing information behind an authentication barrier or violating signed terms creates distinct legal liabilities.
The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, prohibits unauthorized access to protected computers. In hiQ Labs v. LinkedIn (31 F.4th 1180, 2022), the Ninth Circuit ruled that when a website makes data available to the general public without requiring user authentication, viewing or extracting that data does not constitute access without authorization. A computer system with an open front door cannot declare that viewing its public pages is a federal crime.
The legal boundary shifts entirely once authentication is introduced. While federal hacking claims fail against public data extraction, state-level breach of contract claims remain enforceable when a user agrees to a platform's Terms of Service. On remand in late 2022, the U.S. District Court for the Northern District of California ruled that hiQ breached LinkedIn’s User Agreement because hiQ created and maintained authenticated accounts that explicitly agreed to terms prohibiting automated data extraction. hiQ subsequently entered into a $500,000 consent judgment and agreed to delete its scraped records.
Subsequent federal rulings have clarified the boundary between public collection and contractual breach. In Meta Platforms, Inc. v. Bright Data Ltd. (N.D. Cal. 2024), Judge Edward Chen granted summary judgment against Meta, holding that collecting public, un-gated data while logged out does not constitute use of the platform under standard account terms. In X Corp. v. Bright Data Ltd. (N.D. Cal. 2024), Judge William Alsup dismissed X Corp.'s contract claims with prejudice, holding that platforms cannot use boilerplate browsewrap terms to establish copyright-like monopolies over public, factual records. Understanding why we built a browser-based agent instead of an API wrapper requires recognizing this distinction between open web observation and authenticated extraction.
Data Privacy Regulations: GDPR, CCPA, and B2B Prospecting
Data privacy compliance in B2B sales now treats professional identity information with the same regulatory weight as consumer personal data. California's CPRA removed commercial exemptions for business records, while European enforcement penalizes unverified bulk aggregation. Sourcing B2B contacts now requires verifiable provenance and adherence to state data broker registries.
Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the statutory moratorium that previously exempted business-to-business communications expired on January 1, 2023. Business contact information, including corporate email addresses, direct phone numbers, job titles, and professional profile URLs, is legally classified as personal data. California residents possess the statutory right to access their data, demand deletion, and opt out of data sharing and commercial sale.
Enforcement has expanded significantly under the California Delete Act (SB 362). The California Privacy Protection Agency (CPPA) established the Delete Request and Opt-out Platform (DROP), which requires registered data brokers to query the state registry and purge opted-out consumer records every 45 days. The CPPA maintains a public data broker registry and has levied substantial penalties against non-compliant list vendors. In August 2026, the CPPA issued a combined CCPA and Delete Act penalty of $116,490 against LocateSmarter LLC for registration failures and improper opt-out requirements. Similar actions against Cybba, Inc. ($52,400) and S&P Global Inc. ($62,600) establish that commercial list suppliers face direct regulatory scrutiny.
Outside California, multi-state data broker registries enforce strict operational disclosures. The Texas Data Broker Act regulates any business that transfers personal records of more than 50,000 individuals not collected directly, imposing daily fines for failure to maintain active state registration. Under federal authority, the Federal Trade Commission (FTC) enforcement actions have reinforced that downstream buyers of contact lists cannot rely on boilerplate supplier representations regarding data collection consent. In Europe, the German Federal Court of Justice (BGH Nov 2024, VI ZR 10/24) affirmed that scraping personally identifiable data without a demonstrable legal basis under Article 6(1)(f) of the GDPR exposes outbound teams to non-material damages. We covered this operational reality in our guide to GDPR-compliant lead research.
Platform Terms of Service and Account Governance
Platforms enforce anti-scraping rules primarily through automated technical controls and account suspensions rather than court litigation. Commercial anti-bot systems monitor network protocol signatures, JavaScript execution environments, and behavioral entropy. Automated headless scripts trigger security filters before extracting data, putting associated corporate accounts at immediate risk.
Modern anti-bot security suites (including Cloudflare, Akamai Bot Manager, and DataDome) evaluate inbound requests using multi-layered fingerprinting. Rather than checking simple user-agent strings, these systems analyze:
- Cryptographic TLS Handshakes: Inspection using JA4+ suites checks cipher suite sequences, supported elliptic curves, and application-layer protocol negotiation (ALPN) parameters to identify non-browser networking libraries.
- HTTP/2 Frame Serialization: Inspection of binary settings frames and pseudo-header ordering identifies automated scrapers constructed in Python or Go.
- JavaScript Runtime Environment: Client-side verification probes properties such as
navigator.webdriver, checks native function prototype integrity, and spawns isolated web workers to detect script injection hooks. - Hardware Rendering Telemetry: Off-screen WebGL canvas rendering unmasks software rasterizers (like SwiftShader) commonly deployed on headless Linux cloud instances instead of real physical GPUs.
- Behavioral Biometrics: Systems monitor mouse trajectory curvature, keystroke dwell and flight times, and scroll acceleration against statistical models of human movement.
Academic research on headless browser detection benchmarks by Gundelach et al. (arXiv:2606.14525) measured across 10,000 domains found that standard headless Chromium configurations experienced soft block rates up to 15%, with Cloudflare and Akamai blocking 37% and 26% of automated attempts respectively. Crucially, 75% of headless Chromium blocks occurred at the network protocol layer before any JavaScript executed. When growth teams run third-party cloud scrapers using authenticated corporate accounts, platform risk engines correlate these automated signatures with the user's account ID, resulting in immediate rate limits or permanent bans.
The Three Safe Harbors for Sales and GTM Engineering
Sales teams can maintain complete legal compliance and operational safety by structuring prospect research around three safe harbor principles. These principles eliminate exposure under federal hacking statutes, prevent platform terms violations, and satisfy state data privacy mandates.
To ensure prospect research is fully compliant with modern legal standards, outbound teams should enforce three core rules across their data pipeline:
- Direct Public Observation: Only collect data that is publicly visible without bypassing authentication walls, paywalls, CAPTCHAs, or token gating. Sourcing data from open business directories, public company blogs, and news feeds avoids the contractual restrictions associated with logged-in scraping.
- Verifiable Source-URL Provenance: Every record in a prospect database must link directly to the public URL where the information was observed. As discussed in our review of why every lead needs a source URL, explicit attribution satisfies privacy audit requirements and proves the data was sourced from public records.
- Local Device Execution: Execute research within a standard desktop browser environment on the user's local machine rather than routing credentials through central proxy pools. Operating locally preserves the user's native hardware profile, avoids synthetic bot signatures, and keeps sensitive prospect data inside the company's own infrastructure.
Following these three rules allows revenue teams to discover actionable intent signals without building centralized data liability or putting their primary domain reputation at risk.
Compliance Comparison: Static Vendors, Cloud Scrapers, and Local AI Agents
Different prospecting architectures introduce vastly different legal and compliance profiles. Static contact brokers expose revenue teams to downstream data broker liabilities, while cloud enrichment engines often run on shared IP pools that trigger platform bot protections. Local desktop research agents execute directly on the user's device, ensuring verifiable data custody.
The table below summarizes the compliance and technical characteristics of the primary B2B research models available in 2026:
| Architecture | Legal Baseline | Privacy & Data Broker Status | Platform Detection Risk | Data Freshness & Provenance |
|---|---|---|---|---|
| Local AI Desktop Agent (Drevon) | Direct observation of public web pages; no contract bypass. | Zero data broker exposure; data stored locally on device. | Low; runs inside genuine native OS and hardware environment. | Real-time live source extraction with permanent URL receipts. |
| Centralized Data Vendors (Apollo, ZoomInfo) | Aggregated third-party database licensing. | Subject to CCPA/CPRA, Delete Act registries, and DROP audits. | None for the buyer; API queries hit vendor databases. | High data decay rate; no direct underlying source verification. |
| Cloud Scraping Platforms (Clay) | Cloud execution via shared server IP pools. | Enrichment cascades aggregate third-party vendor sources. | Moderate to High; headless worker signatures trigger bot blocks. | Dependent on underlying waterfall data suppliers and web scrapers. |
When evaluating where your prospect data goes across different sales tools, architecture dictates compliance risk. Centralized contact databases purchase bulk lists from external brokers, exposing buyers to downstream opt-out disputes. In contrast, cloud enrichment engines that rely on waterfall enrichment workflows frequently route requests through headless data centers that trigger platform security filters.
Operating a local desktop research agent provides a clean alternative. Understanding why Drevon runs on your desktop rather than in the cloud clarifies this operational advantage: queries run locally using the user's actual system environment, eliminating the synthetic headers and hardware anomalies that anti-bot defenses monitor. Teams looking for a modern alternative to traditional enrichment platforms can transition from unverified bulk lists to verifiable evidence-backed research.
Practical Compliance Checklist for Outbound Sales Teams
Before launching an outbound prospecting campaign in 2026, verify that your data workflows satisfy these legal and technical benchmarks:
- Verify Data Lineage: Confirm that every prospect record links to a live, verifiable source URL rather than an unsourced third-party database export.
- Check State Broker Registries: If purchasing third-party lists, ensure the vendor is registered on the California CPPA and Texas data broker registries.
- Honor Deletion Requests: Ensure your CRM synchronizes with consumer opt-outs and respects California Delete Act requirements.
- Eliminate Headless Cloud Bots on Authenticated Accounts: Never attach critical corporate social accounts to third-party cloud scrapers running on shared proxy networks.
- Audit Data Storage Locations: Adopt desktop-native sales tools to keep prospect records stored in local SQLite databases rather than unvetted third-party cloud silos.
Frequently Asked Questions
Is web scraping legal under the Computer Fraud and Abuse Act?
Yes. Following the Ninth Circuit ruling in hiQ Labs v. LinkedIn and the Supreme Court decision in Van Buren v. United States, extracting publicly accessible information from websites without bypassing authentication mechanisms does not constitute access without authorization under the CFAA.
Can a platform sue our company for scraping public data?
Platforms cannot successfully claim federal computer hacking for public page access, but they can enforce breach of contract claims if the scraping was conducted using an active registered account that agreed to anti-scraping terms. Unauthenticated, logged-out scraping of public facts remains legally protected under recent federal precedents like Meta v. Bright Data.
Does the CCPA apply to B2B contact lists?
Yes. California's statutory B2B exemption expired on January 1, 2023. Business contact details belonging to California residents, including corporate emails, direct phone numbers, and professional profiles, are subject to full CCPA/CPRA rights, including mandatory opt-outs and deletion requirements under the California Delete Act.
Why do anti-bot systems block our outbound scraping tools?
Anti-bot platforms like Cloudflare and Akamai analyze JA4+ cryptographic TLS handshakes, HTTP/2 settings frames, and hardware WebGL rendering parameters. Automated headless scrapers running on cloud servers fail these multi-layer fingerprint checks, resulting in automated IP bans and account restrictions.
How can sales teams prospect safely without legal risk?
Sales teams should focus on observing publicly available web data, collecting source URLs for every prospect claim, and utilizing local desktop tools that operate within genuine browser sessions rather than relying on centralized third-party scrapers or unverified static databases.
To conduct prospect research with verified source attribution and zero compliance exposure, download the free Drevon app for macOS and run evidence-backed workflows on your own device.