You are in a legal review for a new pipeline. The plan is to crawl public profile pages on a large platform, parse them, and ship the aggregate to customers. Someone says the thing that gets said in every one of these meetings: "hiQ v. LinkedIn settled this, scraping public data is legal."
Counsel goes quiet, then asks what happened to hiQ.
What happened to hiQ is that it paid LinkedIn $500,000, stipulated to liability for trespass to chattels and misappropriation under California law, agreed to a permanent injunction against scraping LinkedIn, and deleted the data and algorithms it had built.
The Ninth Circuit rulings are real and they matter. They just do not say what the summary says.
The Actual Timeline
hiQ Labs was a small analytics company. It scraped public LinkedIn profiles and sold two products to employers: "Keeper," which flagged employees at risk of leaving, and "Skill Mapper," which summarised a workforce's skills.
- May 2017. LinkedIn sent a cease-and-desist letter asserting violations of the Computer Fraud and Abuse Act, the DMCA, California Penal Code § 502(c), and California common-law trespass, and said it had implemented technical measures to detect, monitor, and block hiQ's scraping.
- June 2017. hiQ sued in the Northern District of California, seeking a declaration that LinkedIn could not lawfully invoke any of those theories, plus state-law claims including tortious interference with contract.
- August 14, 2017. Judge Edward Chen granted a preliminary injunction (273 F. Supp. 3d 1099), ordering LinkedIn to withdraw the letter, remove existing technical barriers to hiQ's access to public profiles, and refrain from new ones.
- September 9, 2019. The Ninth Circuit affirmed that injunction (938 F.3d 985).
- June 2021. The Supreme Court granted LinkedIn's petition, vacated the judgment, and remanded for reconsideration in light of Van Buren v. United States.
- April 18, 2022. On remand, the Ninth Circuit affirmed again in an opinion by Judge Berzon (31 F.4th 1180), concluding that Van Buren reinforced its reading.
- August 2022. The injunction was dissolved, after LinkedIn showed hiQ had effectively ceased operating — no business left to protect.
- November 4, 2022. On summary judgment, the district court held hiQ had breached LinkedIn's User Agreement.
- December 8, 2022. Consent judgment and permanent injunction entered: $500,000 against hiQ, all other monetary relief waived.
Three Questions, Not One
Almost every misreading of hiQ collapses three separate legal questions into one. The courts kept them apart. So should your design doc.
1. The access question (CFAA). Did hiQ access a computer "without authorization" under 18 U.S.C. § 1030? The Ninth Circuit said probably not, because the pages were open to anyone with a browser: applying the gates metaphor "to a computer hosting publicly available webpages, that computer has erected no gates to lift or lower in the first place." It favoured a narrow reading so as not to turn a criminal hacking statute into what it had earlier called, in Nosal, a "sweeping Internet-policing mandate."
2. The contract question (terms of service). Did hiQ break a promise it had made? Entirely separate from access. A public door does not cancel an agreement you signed. hiQ lost this one.
3. The property question (trespass to chattels). Did hiQ interfere with LinkedIn's servers? This is state common law and it turns on harm, not permission. The Ninth Circuit flagged it as a live route for site owners even where the CFAA fails, collecting cases on both sides: eBay v. Bidder's Edge (N.D. Cal. 2000) found a likelihood of success against an auction aggregator even though eBay's site was public, while Intel v. Hamidi (Cal. 2003) held the tort is not actionable without actual or threatened injury.
Only question 1 went hiQ's way. And it went hiQ's way provisionally.
What "Winning" Actually Meant
Two procedural details do most of the work here, and neither survives a summary.
First, both Ninth Circuit rulings were about a preliminary injunction, not the merits. On that court's sliding scale a plaintiff can qualify by raising "serious questions" going to the merits with the hardships tipping sharply its way, and that is the 2022 opinion's language: hiQ "raised serious questions" about whether LinkedIn could invoke the CFAA. That is a finding about the strength of an argument at an early stage, not a judgment that scraping public data is lawful.
Second, the CFAA question arrived as a defence, not as a claim. hiQ's live theory was tortious interference with its own customer contracts; LinkedIn's answer was that the CFAA made hiQ's conduct unlawful and justified the block. The Ninth Circuit was deciding whether that defence could defeat a state-law claim, not issuing a general licence.
The case never reached a merits ruling on the CFAA. When hiQ moved for summary judgment on its own CFAA claim in 2022, the court refused, because discovery had turned up something the earlier record did not show: hiQ had hired crowdsourced workers to create fake LinkedIn accounts and pull data from behind the login. Once credentials were in the picture, the "no gates" analysis stopped fitting.
The Part Nobody Cites
The November 2022 summary judgment ruling is where the case actually resolved, and it is a loss for hiQ on the question most scrapers care about.
The court held hiQ breached the User Agreement in two ways: automated scraping of profiles, and hiring contractors to create fake accounts to reach logged-in data. hiQ had assented when it created its corporate account. It argued the terms were ambiguous, because LinkedIn tells members their public data may be seen, copied, and used. The court rejected that: telling members their data may be copied "does not contradict the prohibition against scraping."
hiQ's unfair competition and tortious interference claims were knocked out on California's litigation privilege; its waiver and estoppel defences survived to trial; LinkedIn won partial spoliation sanctions.
Then the parties settled. The December 2022 consent judgment entered $500,000 against hiQ, permanently barred it from scraping LinkedIn or creating fake accounts, and required deletion of the data and algorithms. hiQ stipulated that LinkedIn had established liability for trespass to chattels and misappropriation under California law, and that it could establish liability under the federal CFAA and its California counterpart based on the fake accounts reaching password-protected pages.
What hiQ Does Not Say
- It does not say scraping public data is legal. It says a scraper raised serious questions, at the preliminary injunction stage, about whether one clause of one federal statute reaches public pages. There was no trial, the injunction was dissolved, and the case ended with the scraper enjoined.
- It does not bind courts outside the Ninth Circuit. Other circuits have read "without authorization" more broadly, and the Supreme Court has never resolved that clause.
- It does not immunise you from terms of service. hiQ lost on exactly that. Contract liability does not care whether the door was open.
- It does not make cease-and-desist letters meaningless. On public pages, in the Ninth Circuit, a letter alone probably does not create CFAA exposure. It is still evidence for contract, trespass, and state-law claims, and it changes what a court thinks you knew.
- It says nothing about copyright, database rights, or personal data. The 2022 opinion lists copyright infringement, misappropriation, unjust enrichment, conversion, breach of contract, and breach of privacy as theories still open to site owners.
- It does not cover authenticated access. The Ninth Circuit distinguished Facebook v. Power Ventures and Nosal II precisely because those involved password-protected data, where the gate is down.
What a Scraper Should Take Away
None of this is legal advice, and your facts and jurisdiction matter more than any blog post. But the engineering implications are concrete.
Do not create an account on your target. Assent is what turns a page of terms into a contract that binds you, hiQ's corporate account is why the User Agreement applied to it at all.
Keep the crawler logged out, and enforce it in code. The moment a session carries credentials you have left the "no gates" analysis and entered the one that produced liability in Power Ventures and Nosal II. A cheap guardrail:
AUTH_HINTS = ("session", "auth", "token", "sid", "login", "sso")
def carries_credentials(headers, cookies) -> bool:
"""Warn before a public-data crawler sends anything that looks like auth."""
if any(k.lower() in ("authorization", "cookie") for k in headers):
return True
return any(hint in name.lower() for name in cookies for hint in AUTH_HINTS)Log loudly when that returns True on a job you told yourself was logged-out only.
Your contractors are you. hiQ was liable for what its crowdsourced workers did. Outsourcing the account creation did not outsource the exposure.
Rate limits are a legal argument, not just courtesy. Trespass to chattels turns on interference with the server, and both Hamidi and Ticketmaster refused to find the tort without harm. A crawler that provably stays under a small share of a site's traffic gives you a factual defence that a crawler running flat out does not.
Read the terms for who they bind and when. In Meta Platforms v. Bright Data (N.D. Cal., January 2024), the same Judge Chen granted the scraper summary judgment on Meta's contract claim: the terms bound users while logged in, did not reach logged-out scraping of public data, and a survival clause purporting to bind former users forever was unenforceable. The contract question is winnable, it is just a different question.
Wrapping Up
hiQ v. LinkedIn is a narrow, provisional CFAA ruling in one circuit, attached to a case the scraper ultimately lost and paid for. Take the split from it: whether the door was open governs the CFAA question, whether you promised not to walk through it governs the contract question, and whether you damaged the building governs the trespass question. Winning the first tells you nothing about the other two. Two rules are worth encoding today — never register an account on a target you intend to crawl, and never let a "public data" crawler carry credentials.