Scraping a user's data with their permission and credentials

Question

Many websites have user-specific data tied to their account which the user can view by logging in. For example, Amazon tracks a user's purchase history, Netflix tracks a user's watch history, etc. Typically that user can view this data if they login to their own account.

Sometimes one service provider (ex: Google) provides a specific secure way for a user to grant access to his data to other sites (ex: via an OAUTH API). So, a user could allow a separate website to read his Gmail contact list.

Not all websites have a built-in way to do this. I have seen some websites which work around this by asking for the username/password to the separate website and they do scraping behind the scenes on behalf of the user to get their data.

Obviously the user is putting themselves at a higher security risk by choosing to do this, but they might not care about the security implications & might like the convenience of having their data auto-imported into the 2nd website.

In USA, is this legal if the user has given their username & password to the website #2 & specifically granted them the right to scrape their user data from website #1 on their behalf? Or would it fall under the PrivacyPolicy/TermsOfUse of website #1?

I know the CFAA talks about "unauthorized" access, but it seems confusing whether the user can grant you access or if you also need permission from the website owner.

Many PrivacyPolicy/TermsOfUse warn the user that it's dangerous to share their password, but maybe that's be the users' choice/risk?

I'm assuming something like an order history wouldn't have any Copyright implications. So, I'm not worried about that. I know when a user submits content like messages/posts the website usually gains copyright of it, however I'm not thinking about scraping this type of data.

Assuming the PrivacyPolicy/TermsOfUse specifically prohibits scraping (or password sharing), what are the potential consequences of ignoring this and doing it anyways?

Is there a legal way to work around this without getting specific permission from the website owner?

Answer 1

Many ToS ban scraping by an automated process: only manual login is allowed. Therefore any scraping is unauthorized and therefore illegal.

Answer 2

Is scraping authorized or unauthorized

The user may be allowed to access the machine, but this is still within the limits placed on them by the owner of the system. If the ToS bans scraping then this limit will apply.

The closest case to this I could find was United States v. David Nosal, where:

David Nosal, an ex-employee of the Korn/Ferry executive recruiting firm, was charged with violating the CFAA on the theory that he induced current company employees to use their legitimate credentials to access the company's proprietary database and provide him with information in violation of the company’s computer-use policy.

Source

This would seem to set the rule that even if a party has authorized access, they cannot them allow a third party access, under their authorization.

Similar laws abroad (Europe)

Under the GDPR there is no need to scrape the site for the data, as the company has to:

The right to data portability gives individuals the right to receive personal data they have provided to a controller in a structured, commonly used and machine readable format. It also gives them the right to request that a controller transmits this data directly to another controller.

Source

Some sites have taken the approach to allow users worldwide this ability, even ones who would not be covered under the GDPR.