On September 9, a unanimous panel of the Ninth Circuit affirmed Judge Chen’s interpretation of the CFAA. According to the panel, it is inaccurate to call a scraper’s “access” to a website “unauthorized” simply because the scraper was told by the website operator not to visit: “Where the default is free access without authorization, in ordinary parlance one would characterize selective denial of access as a ban, not as a lack of ‘authorization.’" hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783, slip op. at 26 (9th Cir. Sept. 9, 2019).
The Ninth Circuit found that the legislative history of the CFAA supported its interpretation of the text. Id. at 26-29. The 1984 House report, for example, noted that the passage of the CFAA would prohibit conduct akin to “breaking and entering,” and the panel took the view that visiting a public site, even when explicitly prohibited by its owner, was not analogous to entering a building to commit a burglary. Id. at 28-29.
This dispute arose on a request for a preliminary injunction, so the court was merely required to decide whether hiQ had raised a “serious question” as to the strength of LinkedIn’s CFAA claim. But the Ninth Circuit’s statutory interpretation, in which it identified each factor as supporting its conclusion, leaves little doubt about its view that the CFAA has no application to public websites. A site operator seeking to protect information with the CFAA will likely need to shield it behind some technical barrier, such as a password authentication.
Website operators still have legal tools to deploy against web scrapers, as the Ninth Circuit noted, including a claim for trespass to chattels, breach of contract and copyright infringement. These claims may have their own challenges in the web scraping context, however. For example, damages may be difficult to establish on a trespass or breach of contract claim. See, for example, Intel v. Hamidi, 30 Cal. 4th 1342 (Cal. 2003). And the information that scrapers often compile may not be subject to copyright protection. Ticketmaster v. Tickets.com, No. CV997654, 2003 WL 21406289 (C.D. Cal. March 7, 2003).
Another potential alternative to the CFAA may be California’s state-law corollary, the California Comprehensive Computer Data Access and Fraud Act (CDAFA), codified at California Penal Code § 502. Like the CFAA, the CDAFA has long been invoked against web scrapers, and the Ninth Circuit has previously said that it sweeps more broadly than the CFAA in ways that may have yielded a different result under the Ninth Circuit’s analysis in hiQ. See, for example, United States v. Christensen, 828 F.3d 763, 789 (9th Cir. 2016). However, Judge Chen indicated that he would have reached the same conclusion under the CDAFA, and other courts have said that it too requires a visitor to a public website to overcome some technical barrier. See, for example, Enki Corp. v. Freedman, No. 13–cv–2201–PSG, 2014 WL 261798, at *3 (N.D. Cal. Jan. 23, 2014).
