The US District Court in the Northern District of California recently dismissed X Corp. v Bright Data Ltd. (order, article).
I'm most interested in the second part, the claims based on scraping and selling of data, which begins on page 18, line 4.
Page 20, lines 1 through 11 outline why X Corp. cannot take ownership of or require an exclusive license to user-submitted content. Mainly, if they were to do so, they would lose Section 230 protections for publishing third-party content. This is why the X terms of service grant a non-exclusive license.
On page 19, lines 17 through 22 outline the relevant parts of the X terms of service, which prohibit users from scraping the services without prior written consent.
When addressing the access to systems claims, it is acknowledged that X Corp. can take steps to restrict access to and protect their systems. For example, on page 10, lines 22 - 25, it's acknowledged that technical measures, including requiring authentication or IP rate limiting or other anomaly detection tools, can be put into place. However, because these claims failed to demonstrate how these technical measures were bypassed or how damage was done to the systems, these claims were dismissed.
On page 23, lines 11 through 15 make it clear that users submitted their content to X to make it available to not only X but the rest of the world. The X terms of service explicitly state that users are authorizing X to make the content "available to the rest of the world and let others do the same."
The scraping and selling claims were dismissed because X Corp. was trying to assert control over the reproduction, adaptation, and distribution of their work, which is something that the copyright owner has exclusive rights to.
The way that I'm interpreting it is as follows:
- A content host may implement technical measures to control access and protect their infrastructure/services. Technical measures include requiring authentication, CAPTCHAs, IP rate limiting, and more.
- The trespass and fraud claims require a demonstration that technical measures were bypassed, that damage was done, or that users misrepresented themselves when agreeing to the terms of service.
- Claims regarding third-party content - whether based on copyright or contract law - can only be made by the copyright owner.
Terms of service cannot prohibit the scraping of data that the host does not own the copyright to. This is compounded when the terms are explicitly designed to facilitate the sharing of the content.As Jen points out, the focus is on using copyright laws to prohibit scraping. The commentary alludes to other mechanisms, such as using the terms of service as a contract, to prevent scraping.
Two questions arise:
- Am I correctly interpreting this as saying that a content host cannot prohibit people from scraping third-party content from their platform, assuming it doesn't bypass technical measures or cause damage?
- Since this was in an order to dismiss rather than a decision, what impact will this have on future cases, such as if someone decides to bring a case against a content host that prohibits the scraping of content?