Is scraping Reddit legal? Web scraping law for Reddit and X
Is web scraping legal? What US courts decided from Van Buren to Meta v. Bright Data, what Reddit's and X's terms say today, and how to lower your risk.
Piyushh · October 17, 2026 · 9 min read
Is web scraping legal? In the United States, scraping pages anyone can see without logging in is generally not a federal crime. Two rulings settled most of that: the Supreme Court's Van Buren decision in 2021 and the Ninth Circuit's hiQ v. LinkedIn decision in 2022. That doesn't make scraping safe. It can still break a contract (the site's terms), infringe copyright, or violate privacy law. Reddit and X both ban scraping without written permission in their current terms, and both have sued over it.
This post is not legal advice. It collects the primary sources (court opinions and the platforms' own terms, each checked on October 17, 2026) so you know what to ask a lawyer.
Is web scraping legal? four laws decide it
Scraping lawsuits rarely turn on a single "scraping law". Each one draws on four separate bodies of law, and a project has to clear all four. Internet law professor Eric Goldman put it this way in his October 2026 write-up: a scraping campaign "must survive each and every one of the doctrines" that apply.
| Body of law | The question it asks | Where scrapers usually stand |
|---|---|---|
| Computer access (the US CFAA and state equivalents) | Did you access a computer "without authorization"? | Public pages: mostly safe after Van Buren and hiQ. Logins, fake accounts and getting past blocks: risky |
| Contract (terms of service) | Did you agree to terms that ban scraping, and did breaking them cause harm? | The live battleground. Courts split on when terms bind you |
| Copyright | Did you copy protected expression, and what did you do with it? | Facts aren't protected. Posts and comments can be, and the users who wrote them usually own them |
| Privacy (GDPR, state privacy laws) | Is it personal data, and do you have a lawful basis to process it? | Being public doesn't make data exempt, especially in the EU |
The court cases that shaped scraping law
These are the cases people cite most often on scraping social platforms. Each line links to the opinion or to a law firm's summary of it.
| Case | Year | What happened |
|---|---|---|
| Van Buren v. United States | 2021 | The Supreme Court read the CFAA narrowly: "exceeds authorized access" means entering parts of a system you're not allowed into, not misusing data you can already reach |
| hiQ Labs v. LinkedIn | 2022 | The Ninth Circuit held that scraping public LinkedIn profiles likely wasn't "without authorization" under the CFAA |
| hiQ v. LinkedIn, the ending | 2022 | The same case ended with a $500,000 consent judgment against hiQ and an injunction, after the court found hiQ had breached LinkedIn's user agreement, partly through fake profiles |
| Meta v. Bright Data | 2024 | The court granted Bright Data summary judgment on the contract claim. It held that Meta's terms didn't cover logged-off scraping of public data |
| X Corp. v. Bright Data | 2024 | Judge Alsup dismissed X's claims. He held that copyright law preempted X's attempt to control public posts its users own, and that a contract claim needs actual harm |
| Reddit v. Anthropic | 2025 to 2026 | Reddit sued over AI training data on contract, trespass and unfair competition claims. In March 2026 a federal judge sent the case back to California state court, finding the claims were not preempted by copyright law |
| Reddit v. Perplexity, SerpApi, Oxylabs and AWMProxy | 2025 | Reddit alleges the defendants scraped Reddit content from Google results and got around technical blocks to do it. The defendants deny it, and the case is at the allegation stage |
Two trends run through them. The criminal-hacking theory against scraping public pages has mostly failed. Contract claims have held up, especially where the scraper agreed to the terms by creating an account: hiQ won the headline appeal and still paid LinkedIn $500,000. The Reddit cases go further. They rest on terms, technical safeguards and how the data was obtained. The March 2026 remand order means the copyright preemption defence that worked for Bright Data against X didn't end Reddit's case against Anthropic.
Is scraping Reddit legal?
Reddit's position is clear, even if the law around it is not.
Reddit's User Agreement, effective July 1, 2026 and checked October 17, 2026, says you may not "access, search, or collect data from the Services by any means (automated or otherwise) except as permitted in these Terms or in a separate agreement with Reddit". It grants conditional permission to crawl according to robots.txt, "but scraping the Services without Reddit's prior written consent is prohibited".
The Data API Terms (last revised July 20, 2026) cover the official API, and they are strict too. Commercial use needs "a separate agreement with Reddit". You may not use User Content "to train a machine learning or AI model without the express permission of rightsholders", and you may not "sell, lease, or sublicense the Data APIs".
Reddit is also closing off technical access. On September 30, 2026, it announced it will stop accepting new public API requests on October 31, 2026, and close remaining public access in March 2027. RSS feeds stop on November 13, 2026, and Old Reddit is limited to logged-in mods and recent users. Our Reddit API shutdown timeline covers every date.
What this means for you in practice:
- Scraping Reddit for a personal project almost certainly breaks Reddit's terms. Whether that becomes a legal problem depends on harm and on whether you agreed to the terms (an account counts).
- Scraping Reddit for a commercial product is the scenario Reddit sues over. Both 2025 lawsuits targeted companies that sold or used Reddit data at scale.
- Logging in to scrape, rotating accounts or getting around blocks moves you from contract risk toward computer access claims. Reddit alleges that pattern in the Perplexity case, and it's the one hiQ lost on.
Is scraping Twitter (X) legal?
X's Terms of Service, effective October 9, 2026 and checked October 17, 2026, prohibit accessing the Services by automated means other than its published interfaces. They add: "crawling or scraping the Services in any form, for any purpose without our prior written consent is expressly prohibited".
The terms also include a liquidated damages clause. If you break them, or knowingly help someone else do so, X says you owe "$15,000 USD per 1,000,000 posts" for "requesting, viewing, or accessing more than 1,000,000 posts" in any 24-hour period. No court has tested whether that amount is enforceable. You still agree to it when you sign in.
Scrapers point to the 2024 dismissal in X Corp. v. Bright Data. The court held that X couldn't use contract law to claim control over public posts its users own, and that X hadn't shown harm. That ruling applied an earlier version of the terms to facts specific to Bright Data, so it doesn't give you permission to scrape X today.
The official route is the X API, which is priced pay-per-use. X's pricing page, checked October 17, 2026, lists post reads at $0.005 per post, with no subscription.
Privacy law: public is not the same as fair game
US scraping cases mostly turn on access and contract. In Europe, privacy comes first. Under the GDPR, Reddit usernames, X handles and the opinions attached to them count as personal data, public or not.
The Dutch data protection authority has gone furthest. Its May 2024 guidance warned that scraping personal data is almost always a GDPR violation for private organisations. Morgan Lewis's summary of that guidance notes that it treats "legitimate interests" as the only basis most companies could even attempt. Other regulators are less absolute, but none of them accept "it was public" as a defence by itself.
If your data includes people in the EU or UK, you need to decide your lawful basis, keep only what you need, honour deletion requests and document all of it. That applies however you collect the data.
The case that scraping law favours scrapers anyway
There's a serious argument that all this matters less than the terms suggest. Platforms have a hard time winning scraping cases over public data: Meta lost on contract and X lost on copyright preemption. Terms only bind people who agreed to them, and a scraper that never logs in often hasn't.
Eric Goldman made a version of this argument from the platform's side in an r/WebScrapingInsider thread in October 2026: "Websites that want to thwart scraping should rely primarily on technological efforts, not legal ones." He gave the reason too: "lawsuits are costly, not certain to win, attract unwanted publicity, and time-consuming" (u/ericgoldmanmv, r/WebScrapingInsider).
Part of that holds up. Platforms don't sue every scraper, and the CFAA threat against public scraping has weakened since 2021. Three things cut the other way, though:
- Reddit is suing right now, and the March 2026 remand shows its contract and trespass theories got through the first fight.
- You probably have an account. Most developers who scrape Reddit or X log in at some point, and once you do, the terms bind you.
- Legal risk is only half the picture. As Goldman says, platforms enforce mostly through technology, and Reddit's 2026 changes (no RSS, a login wall on Old Reddit, an API closing to new apps) are that kind of enforcement. A scraper can be legal and still stop working.
A checklist before you scrape Reddit or X
None of this replaces a lawyer, but it covers the questions a lawyer will ask you.
- Read the current terms of every site and note the date you read them, because terms change. Reddit's User Agreement changed effective July 1, 2026, and X's on October 9, 2026.
- Stay logged off unless you have permission. Contract and access claims are strongest against logged-in scraping.
- Never get around a block. That means no rotating accounts after a ban, no fake profiles, and no working around rate limits or technical restrictions.
- Collect only what you need. Skip personal data you won't use, and drop deleted content when you can.
- Don't train AI models on Reddit content without permission. Reddit's Data API Terms forbid it, and both of Reddit's 2025 lawsuits involve AI companies.
- Don't republish user content wholesale. Summaries, counts and links carry less copyright risk than mirrored posts.
- For anything commercial, get a written agreement or use a provider that has done the access work.
Where a hosted API fits
A hosted API doesn't change what you're allowed to do with the data. It changes who does the collection, and it should make that collection's inputs and outputs clear.
ChatterAPI reads public Reddit and X data only. On the Reddit side it is read-only (no posting, voting or messaging). It is also independent, not affiliated with or endorsed by Reddit or X. Decisions about storage, privacy and reuse are still yours.
Here is the post where Reddit announced the dates above, fetched through GET /v1/reddit/posts/{id} on October 17, 2026:
curl "https://api.chatterapi.com/v1/reddit/posts/1wubcvf" \
-H "Authorization: Bearer $CHATTERAPI_KEY"
{
"data": {
"id": "1wubcvf",
"title": "Moving Data API Apps to the Developer Platform: migration dates and next steps",
"author": "boat-botany",
"subreddit": "redditdev",
"score": 11,
"numComments": 130,
"upvoteRatio": 0.64,
"createdAt": "2026-09-30T17:37:11.000Z",
"url": "https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/"
},
"credits": { "charged": 2, "remaining": 62 },
"requestId": "req_01M54ZWST107071FCE73",
"cached": false
}
That response is live, trimmed to the post fields (the full body text comes back too), and it cost 2 credits. The free Reddit scraper tool runs the same call in a browser.
Before you write the scraper
Start with the terms, not the code. Read Reddit's User Agreement and X's Terms of Service as they stand today, decide whether your use is personal or commercial, and take the commercial case to a lawyer. For the technical side, our guide to how to scrape Reddit compares the five routes that still work, and Reddit API vs scraping weighs the official API against scraping and hosted APIs.
If you want to test a hosted API, sign up with Google for 100 free credits without entering a card. That covers 50 Reddit post lookups or searches.