Rate Limit, Ban, Letter, Lawsuit: What Actually Happens When a Platform Notices You

The question behind "is scraping legal" is usually more specific and more practical: what will actually happen to me? The honest answer is that almost everything that happens is technical, arrives within minutes, and involves no lawyers at all. The legal end of the ladder is real but rare, and the people who reach it share a recognisable profile.

Here is the ladder, rung by rung, with what is documented and what is folklore. It is the operational companion to what the scraping cases actually held.

This is not legal advice. It describes published cases and our own measurements, from engineers rather than lawyers. What a letter means for you depends on your jurisdiction, your conduct and your contracts. If one arrives, talk to a lawyer before you decide what to do about it.

The ladder

Rung	What it looks like	How fast	How common
1	Silent degradation — thinner payloads, missing fields, stale numbers	Immediately	Constant, and mostly invisible
2	429, Retry-After, throttling	Minutes	The normal state of affairs
3	403, challenge pages, IP or ASN block	Minutes to days	Routine on the harder platforms
4	Account suspension	Days	Only if you have an account
5	Cease-and-desist letter	Weeks to months	Uncommon, and consequential
6	Litigation	Months to years	Rare, and concentrated

Most scraping operations live permanently between rungs 1 and 3 and never see the rest. That is not luck — it is the design of the systems on the other end. Platforms have automated defences that scale and legal teams that do not.

Rung 1 is the one people underestimate. A block announces itself. Degradation does not: you keep getting 200 OK with a payload that is quietly less complete than it was last month. Every data pipeline we have operated has needed a canary that asserts on field presence and plausibility, not just status codes, because the failure that costs you money is the one that looks like success.

What we measure from our own infrastructure

Concrete numbers beat adjectives, so here are ours, probed on 2026-08-20 from ordinary datacenter IPs with no residential proxies:

What we requested	Result
YouTube channel, video, channel list, search, transcript	Working, unproxied
A single public tweet via the syndication path	Working, unproxied
Twitter profile and user timeline	Rate-limited from a datacenter IP
Instagram profile and user posts	Rate-limited from a datacenter IP
Instagram single post	Untested — we cannot reach it without a residential proxy
Meta Ad Library, official Graph API	Blocked pending an access token, not by any defence

Two things fall out of that. First, the difference between platforms is enormous: YouTube's public surface is genuinely open, and Instagram's is effectively closed to datacenter traffic on the first request. Second, our own Instagram coverage is thinner than our YouTube coverage — that is what rung 2 looks like when it happens to us, and pretending otherwise would be the kind of claim this post exists to argue against.

Documented versus folklore

Claim you'll hear	Verdict
"Scraping is illegal"	Folklore. There is no statute against it. There are statutes about access, contracts about conduct, and regulations about personal data
"If it's public, you're safe"	Folklore. Public defeats the CFAA argument in the Ninth Circuit. It does nothing for GDPR, and nothing for a contract you agreed to
"robots.txt is legally binding"	Folklore in the US, as a standalone matter — it is a convention, not a contract. But ignoring it reads badly in a complaint, and it now shows up inside circumvention arguments
"A cease-and-desist letter is just a letter"	Half true, and the dangerous half is the other one. See below
"They'll sue you for hitting them too hard"	Folklore. They will block you. Volume alone is a technical problem
"Rotating IPs to get around a block is fine"	Increasingly not. This is the exact conduct the newest claims are built on
"A CFAA claim needs real damages"	Documented. A civil CFAA claim requires at least $5,000 in loss, and proving it is harder than plaintiffs expect

The cease-and-desist letter, and why it is the important rung

A cease-and-desist is not a court order. Nothing happens automatically if you ignore it. What it does is change the facts, and in this area facts about notice are the ones that decide cases.

In Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), Power had user permission to access Facebook accounts on their behalf. Facebook sent a cease-and-desist and blocked its IP addresses. The Ninth Circuit held that continuing after that letter was access "without authorization" under the CFAA — the permission of the users did not survive the platform's revocation. In Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013), the same combination — a letter plus an IP block — was enough for a CFAA claim to survive dismissal, over data that was publicly visible.

Set that against hiQ, where the Ninth Circuit held in 2022 that "without authorization" does not fit public websites at all. LinkedIn had also sent hiQ a letter and blocked it. The two lines of reasoning sit uncomfortably together, and courts have not fully resolved how much a revocation letter can do when the pages are public. The unsettled question is not academic: it is precisely the question of what a letter does to you. Treat the ambiguity as risk, not as permission.

The other thing to know about the letter stage comes from the end of the hiQ docket. The $500,000 stipulated judgment in December 2022 included sanctions against hiQ for spoliation — destroying evidence. Whatever else a letter triggers, it triggers a duty to preserve.

If one arrives, the things worth doing before anything else are unglamorous: stop the specific collection it names while you decide, preserve everything including logs and internal messages, keep engineers from replying directly, and get the letter to a lawyer the same week. Not advice about your situation — just the sequence that keeps your options open.

Who actually gets sued

Reading across the litigated cases, plaintiffs do not go after scraping. They go after a pattern, and it usually has several of these features at once:

• Commercial resale at scale. Bright Data, hiQ and the data-collection intermediaries in the Reddit case all sold what they collected.
• A competing product. Ryanair objected to Booking.com selling its fares; LinkedIn objected to a product built on its profiles. Platforms sue businesses that eat their lunch, not researchers.
• Authenticated access, or fake accounts. Booking.com's partner used the password-protected myRyanair portal. hiQ's crowd workers created fake profiles. Both facts did enormous damage to their side of the case.
• Ignoring a letter. Power Ventures and 3Taps both kept going after being told to stop.
• Getting past a technical measure. Reddit's October 2025 suit against Perplexity and three collection intermediaries pleads the DMCA's anti-circumvention provision — alleging evasion of rate limits and anti-bot measures — rather than the CFAA. Motions to dismiss were argued on 30 June 2026 and there is no ruling as of August 2026. If that theory works, the defence "the data was public" becomes an incomplete answer, because the claim is about the measures you got past.

Note what is missing from that list: request volume. Nobody has been sued for being fast. They have been blocked for it, which is a different department.

And when litigation does arrive, it is slower and messier than the headlines suggest. Ryanair's jury found a CFAA violation in July 2024 and awarded exactly $5,000 — the statutory minimum. In March 2025 the court took the verdict away on judgment as a matter of law, holding Ryanair had not proven $5,000 of qualifying loss. That is now on appeal to the Third Circuit. Eight years of litigation in hiQ ended with a company that no longer trades. Nobody in these dockets got a clean win quickly.

Staying on rung one

The engineering that keeps you off the ladder is mostly about asking for less, not about looking like someone else.

• Don't fetch what you already have. Cache aggressively and re-request on a schedule that matches how fast the data actually changes. Most monitoring systems re-fetch thousands of URLs to discover that almost nothing changed, which is a tax you are paying to be more visible.
• Obey the throttle. A 429 with a Retry-After is the platform telling you the price of continuing. Back off exponentially, cap concurrency per host, and let a sustained failure streak stop the job instead of hammering through it.
• Be identifiable. A descriptive user agent with a contact URL is how you get an email instead of a block. It is also the opposite of what a circumvention complaint describes.
• Prefer sanctioned surfaces. Where a platform publishes an official API — ad transparency archives are the strongest example, since regulation requires them to exist — use it. There is no defence to evade and nothing to break.
• Know why you need residential IPs before you buy them. Sometimes the answer is that the platform blocks datacenter ranges wholesale. Sometimes the answer is that you are trying to get around a block aimed specifically at you, which is a different activity with a different risk profile. We probed ten proxy providers as a buyer, and the distinction between those two cases is the first thing worth being honest with yourself about.

The uncomfortable summary: the legal ladder is unsettled at exactly the rung where it would matter to you, and the technical ladder is settled, fast and automated. Design for the second one. Get advice about the first before you need it.