Google's Anti-Scraping Wall Failed the Copyright Test. Read the Element That Killed It

On 20 July 2026, Chief Judge Yvonne Gonzalez Rogers dismissed both of Google's claims against the scraping company SerpApi in Google LLC v. SerpApi, LLC, No. 4:25-cv-10826-YGR (N.D. Cal.), order opened 27 July 2026. If you run a site and you assumed a bot wall gives you a copyright claim against scrapers, the specific holding matters: a technological measure only counts under the Digital Millennium Copyright Act if it protects material that is actually copyrighted, and if it was deployed with the authority of the copyright owner. Google pleaded neither for its SearchGuard system. The first defect was dismissed without leave to amend because it fails as a matter of law. The second was dismissed with leave to amend, and Google has twenty-one days from the order to try again.

The headline version of this ruling ("judge says you can scrape Google") is wrong in both directions. The court did not bless scraping, and it did not narrow the DMCA as far as the coverage suggests. It is worth reading what actually survived.

What Google won inside the loss

SerpApi argued Google had no business suing under the DMCA at all, because Google does not own the copyrighted material that occasionally appears in its own search results. The court rejected that. Section 1203(a) says "[a]ny person injured by a violation of section 1201 or 1202 may bring a civil action," and the judge read that broad language literally, backed by the 1998 House and Senate reports. So a platform can sue over circumvention of a wall it built around someone else's copyrighted content. That is a useful precedent for anyone hosting licensed material.

Google also won on circumvention itself. SerpApi allegedly masked its automated queries to look like human traffic by misrepresenting device, software and location, and syndicated a solved SearchGuard JavaScript challenge to other browsers that had never solved one. The court held that this is circumvention within the meaning of section 1201(a)(3)(A), analogising to RealNetworks v. Streambox and Epic Games v. Araujo. If you are building a scraper and your plan involves passing around solved challenge tokens, a court has now said that behaviour looks like bypassing a technological measure, not like ordinary browsing.

SerpApi leaned hard on hiQ Labs v. LinkedIn, 31 F.4th 1180 (9th Cir. 2022), the case everyone cites for "public data is fair game." The judge set it aside in one line: hiQ construes the Computer Fraud and Abuse Act, not the DMCA. The same footnote dismissed X Corp. v. Bright Data and Meta Platforms v. Bright Data as contract cases. Three different statutes, three different questions.

The clause that decided it

Here is the language, from 17 U.S.C. section 1201(a)(3)(B) (opened 27 July 2026): a measure "effectively controls access to a work" if it "requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work."

Google's complaint said search results sometimes carry a Knowledge Panel containing images it licenses from third parties. The court's problem was that Google never pleaded any facts about what those licences say. Having permission to display someone's photograph is not the same as having permission to deploy an access control around it and sue in your own name when someone gets past it. Google asked the court to infer authority from the existence of the licences. The judge declined, distinguishing a pre-Iqbal case, EchoStar v. Viewtech, where the defendant had bought distribution rights outright.

The other half of the dismissal is structural and permanent. Search results are mostly a compilation of publicly available information. Where a result contains no copyrighted content at all, SearchGuard cannot be controlling access to a "work protected under this title," so section 1201 cannot reach it. That part was dismissed with amendment declared futile.

Which theory actually covers you

The practical output of this order is a sorting exercise. The table below lists the four theories that appear in scraping disputes, the element each one turns on, and what this order did to it. The elements are taken from the statutes and cases the court itself recited; the third column is our reading of the order, not a quote from it.

Notice what the strongest column is. Google's own complaint said the harm was a "deadweight loss" from serving billions of queries it earns nothing on. That is a cost story, and cost stories live in contract and trespass, not in copyright.

Four changes for a site owner this week

1. Make your terms enforceable, not decorative. A contract claim needs assent. A link in your footer that nobody clicks is a weaker record than an account signup that requires a checkbox, timestamps it, and stores the version of the terms accepted. If your data is worth defending, put the valuable endpoints behind a login.
2. Write an automated-access clause that says what you actually mean. Name the prohibited behaviour: automated querying, headless browsers, distributing session tokens, reselling responses. Vague "you may not misuse the service" wording gives a court nothing to enforce.
3. If you licence third-party content, ask for protection rights in the licence. This is the exact hole Google fell into. One sentence granting you authority to apply technological protection measures to the licensed material, and to enforce against circumvention, converts a dead claim into a live one.
4. Log the load. Rate limits, per-token request counts and served-bytes by user agent are what turn "bots are annoying" into a quantified injury. Our piece on Cloudflare's split of AI bots into search, agent and training covers the control side; this is the evidence side.

What a scraper still carries

If you sell scraped data, this order removed one risk and left three. Copyright-based circumvention claims over uncopyrightable page content are gone in this district. Contract claims are not, and a breach claim needs no copyright at all. CFAA exposure remains for anything behind authentication. And the circumvention holding cuts against you: the court accepted that masking traffic and sharing solved challenges is circumvention, so if the page you scrape does contain protected material and the site owner does hold protection rights, the DMCA claim can be pleaded properly on a second try.

The damages arithmetic is worth doing before you assume a fixed statutory exposure is trivial. Section 1203(c)(3)(A) (opened 27 July 2026) sets statutory damages at "not less than $200 or more than $2,500 per act of circumvention." A court's view of what counts as one act is unsettled, and that is the whole risk: our own calculation, at the low $200 end, puts 10,000 circumventions at $2 million and one million at $200 million. Nobody scraping at commercial volume should treat a per-act statute as small. Section 1203(b) also allows injunctions, which for a data business is the outcome that actually ends it.

The date to watch is Google's amended complaint, due three weeks after the 20 July order. If Google can plead the licence terms that authorise SearchGuard, the copyrighted-component half of this case comes back and the question becomes whether a wall around a page that is 95 percent public and 5 percent licensed is a copyright control at all. Until then, the working rule for anyone who depends on either side of a scraping relationship is simple: the DMCA protects copyrighted works, your terms of service protect your service, and only one of those is something you can write yourself this afternoon. If you have not scored how much of your business rides on a single platform's tolerance, our platform dependency audit is the companion exercise, and what Google's scaled content abuse policy actually prohibits covers the other direction of the same relationship.