Rate Limit, Ban, Letter, Lawsuit: What Actually Happens When a Platform Notices You

The question behind "is scraping legal" is usually more specific and more practical: what will actually happen to me? The honest answer is that almost everything that happens is technical, arrives within minutes, and involves no lawyers at all. The legal end of the ladder is real but rare, and the people who reach it share a recognisable profile.

Here is the ladder, rung by rung, with what is documented and what is folklore. It is the operational companion to what the scraping cases actually held.

This is not legal advice. It describes published cases and our own measurements, from engineers rather than lawyers. What a letter means for you depends on your jurisdiction, your conduct and your contracts. If one arrives, talk to a lawyer before you decide what to do about it.

The ladder

Rung	What it looks like	How fast	How common
1	Silent degradation: thinner payloads, missing fields, stale numbers	Immediately	Constant, and mostly invisible
2	429, Retry-After, throttling	Minutes	The normal state of affairs
3	403, challenge pages, IP or ASN block	Minutes to days	Routine on the harder platforms
4	Account suspension	Days	Only if you have an account
5	Cease-and-desist letter	Weeks to months	Uncommon, and consequential
6	Litigation	Months to years	Rare, and concentrated

Most scraping operations live permanently between rungs 1 and 3 and never see the rest. That is not luck. It is the design of the systems on the other end. Platforms have automated defences that scale and legal teams that do not.

Rung 1 is the one people underestimate. A block announces itself. Degradation does not: you keep getting 200 OK with a payload that is quietly less complete than it was last month. Every data pipeline we have operated has needed a canary that asserts on field presence and plausibility, not just status codes, because the failure that costs you money is the one that looks like success.

What a two-position probe measured

Concrete numbers beat adjectives. Here is a probe run on 2026-08-20 from a residential connection in India with no additional proxy, and re-run ten days later from a datacenter range in France. That second column is load-bearing and most vendors omit it: a residential IP is the position platforms are least hostile to, so a residential-only result says the parsers work and says nothing about the same requests from a hosting range, which is where production runs.

Request	Residential (2026-08-20)	Datacenter (2026-08-30)
YouTube channel, video, channel list, search, transcript	Working, unproxied	Working: byte-identical responses
A single public tweet via the syndication path	Working, unproxied	Working: byte-identical
Twitter profile and user timeline	Rate-limited after ~30 requests	Rate-limited
Instagram profile and user posts	Blocked or rate-limited on every request	Same: 12 blocked, 6 rate-limited
Rumble channel, search, video, comments, transcript	4 of 5 working	All 5 refused, 403
Meta Ad Library, official Graph API	Gated on a token, not on the IP	Same

Three things fall out of that, and the third one is the surprise.

First, the difference between platforms is enormous. YouTube's public surface is genuinely open and Instagram's is closed from anywhere the probe tried, including a residential connection.

Second, a platform that is closed to you is what rung 2 looks like from the inside, and a vendor whose coverage of it is thin should say so rather than average it away.

Third, the datacenter column was much better than the received wisdom predicts. The received wisdom is that hosting ranges get blocked on sight. Across twenty targets the probe found exactly one clean case of it: Rumble, which serves a home connection happily and refuses a Contabo range outright. Everything else either worked from both or failed from both. That result is narrower than it sounds, and the next section explains why it is not grounds to route anything direct.

What that measurement does not prove

Four reasons not to bank a result like that, all of which apply to anyone publishing a success rate.

One cold request is not sustained traffic. Datacenter ranges typically die to rate limiting under volume, not to a first-request block. A single probe per target is precisely blind to the failure mode that matters most, and there is a measured example of it: the Twitter syndication surface answers happily for about thirty requests and then needs more than twelve minutes to recover. Nothing in a one-shot sweep would ever see that.

Geography moved with the network type. The residential position was India and the datacenter position was France, so every row has two candidate explanations and this probe cannot separate them. TikTok is the clearest case (it redirected the Indian IP and served the French one a full page), and that is almost certainly a country ban rather than anything about hosting ranges. A clean experiment holds the country constant, which needs a residential exit in the same country as the server.

One provider is not all providers. Blocklists are maintained per network operator. Contabo may simply be less aggressively listed than the hosts usually named in this discussion. The result does not transfer.

A drift alarm can be a block wearing a costume. Two endpoints reported a changed page shape from the datacenter rather than an error status, which is exactly what a schema-drift detector is built to notice. Run from the wrong position, a block will send someone hunting for a parser change that never happened.

So the right response to a probe like this is to change nothing. An over-cautious routing decision wastes proxy spend; an over-confident one breaks production and misprices the product, and those costs are not symmetric.

Documented versus folklore

Claim you'll hear	Verdict
"Scraping is illegal"	Folklore. There is no statute against it. There are statutes about access, contracts about conduct, and regulations about personal data
"If it's public, you're safe"	Folklore. Public defeats the CFAA argument in the Ninth Circuit. It does nothing for GDPR, and nothing for a contract you agreed to
"robots.txt is legally binding"	Folklore in the US, as a standalone matter: it is a convention, not a contract. But ignoring it reads badly in a complaint, and it now shows up inside circumvention arguments
"A cease-and-desist letter is just a letter"	Half true, and the dangerous half is the other one. See below
"They'll sue you for hitting them too hard"	Folklore. They will block you. Volume alone is a technical problem
"Rotating IPs to get around a block is fine"	Increasingly not. This is the exact conduct the newest claims are built on
"A CFAA claim needs real damages"	Documented. A civil CFAA claim requires at least $5,000 in loss, and proving it is harder than plaintiffs expect

The cease-and-desist letter, and why it is the important rung

A cease-and-desist is not a court order. Nothing happens automatically if you ignore it. What it does is change the facts, and in this area facts about notice are the ones that decide cases.

In Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), Power had user permission to access Facebook accounts on their behalf. Facebook sent a cease-and-desist and blocked its IP addresses. The Ninth Circuit held that continuing after that letter was access "without authorization" under the CFAA. The permission of the users did not survive the platform's revocation. In Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013), the same combination (a letter plus an IP block) was enough for a CFAA claim to survive dismissal, over data that was publicly visible.

Set that against hiQ, where the Ninth Circuit held in 2022 that "without authorization" does not fit public websites at all. LinkedIn had also sent hiQ a letter and blocked it. The two lines of reasoning sit uncomfortably together, and courts have not fully resolved how much a revocation letter can do when the pages are public. The unsettled question is not academic: it is precisely the question of what a letter does to you. Treat the ambiguity as risk, not as permission.

The other thing to know about the letter stage comes from the end of the hiQ docket. The $500,000 stipulated judgment in December 2022 included sanctions against hiQ for spoliation (destroying evidence). Whatever else a letter triggers, it triggers a duty to preserve.

If one arrives, the things worth doing before anything else are unglamorous: stop the specific collection it names while you decide, preserve everything including logs and internal messages, keep engineers from replying directly, and get the letter to a lawyer the same week. Not advice about your situation. Just the sequence that keeps your options open.

Who actually gets sued

Reading across the litigated cases, plaintiffs do not go after scraping. They go after a pattern, and it usually has several of these features at once:

• Commercial resale at scale. Bright Data, hiQ and the data-collection intermediaries in the Reddit case all sold what they collected.
• A competing product. Ryanair objected to Booking.com selling its fares; LinkedIn objected to a product built on its profiles. Platforms sue businesses that eat their lunch, not researchers.
• Authenticated access, or fake accounts. Booking.com's partner used the password-protected myRyanair portal. hiQ's crowd workers created fake profiles. Both facts did enormous damage to their side of the case.
• Ignoring a letter. Power Ventures and 3Taps both kept going after being told to stop.
• Getting past a technical measure. Reddit's October 2025 suit against Perplexity and three collection intermediaries pleads the DMCA's anti-circumvention provision, alleging evasion of rate limits and anti-bot measures, rather than the CFAA. Motions to dismiss were argued on 30 June 2026 and there is no ruling as of August 2026. If that theory works, the defence "the data was public" becomes an incomplete answer, because the claim is about the measures you got past.

Note what is missing from that list: request volume. Nobody has been sued for being fast. They have been blocked for it, which is a different department.

And when litigation does arrive, it is slower and messier than the headlines suggest. Ryanair's jury found a CFAA violation in July 2024 and awarded exactly $5,000, the statutory minimum. In March 2025 the court took the verdict away on judgment as a matter of law, holding Ryanair had not proven $5,000 of qualifying loss. That is now on appeal to the Third Circuit. Eight years of litigation in hiQ ended with a company that no longer trades. Nobody in these dockets got a clean win quickly.

Staying on rung one

The engineering that keeps you off the ladder is mostly about asking for less, not about looking like someone else.

• Don't fetch what you already have. Cache aggressively and re-request on a schedule that matches how fast the data actually changes. Most monitoring systems re-fetch thousands of URLs to discover that almost nothing changed, which is a tax you are paying to be more visible.
• Obey the throttle. A 429 with a Retry-After is the platform telling you the price of continuing. Back off exponentially, cap concurrency per host, and let a sustained failure streak stop the job instead of hammering through it.
• Be identifiable. A descriptive user agent with a contact URL is how you get an email instead of a block. It is also the opposite of what a circumvention complaint describes.
• Prefer sanctioned surfaces. Where a platform publishes an official API, use it. Ad transparency archives are the strongest example, since regulation requires them to exist. There is no defence to evade and nothing to break.
• Know why you need residential IPs before you buy them. Sometimes the answer is that the platform blocks datacenter ranges wholesale. Sometimes the answer is that you are trying to get around a block aimed specifically at you, which is a different activity with a different risk profile. The distinction between those two cases is the first thing worth being honest with yourself about.

The uncomfortable summary: the legal ladder is unsettled at exactly the rung where it would matter to you, and the technical ladder is settled, fast and automated. Design for the second one. Get advice about the first before you need it.