Many websites have user-specific data tied to their account which the user can view by logging in. For example, Amazon tracks a user's purchase history, Netflix tracks a user's watch history, etc. Typically that user can view this data if they login to their own account.
Sometimes one service provider (ex: Google) provides a specific secure way for a user to grant access to his data to other sites (ex: via an OAUTH API). So, a user could allow a separate website to read his Gmail contact list.
Not all websites have a built-in way to do this. I have seen some websites which work around this by asking for the username/password to the separate website and they do scraping behind the scenes on behalf of the user to get their data.
Obviously the user is putting themselves at a higher security risk by choosing to do this, but they might not care about the security implications & might like the convenience of having their data auto-imported into the 2nd website.
In USA, is this legal if the user has given their username & password to the website #2 & specifically granted them the right to scrape their user data from website #1 on their behalf? Or would it fall under the PrivacyPolicy/TermsOfUse of website #1?
I know the CFAA talks about "unauthorized" access, but it seems confusing whether the user can grant you access or if you also need permission from the website owner.
Many PrivacyPolicy/TermsOfUse warn the user that it's dangerous to share their password, but maybe that's be the users' choice/risk?
I'm assuming something like an order history wouldn't have any Copyright implications. So, I'm not worried about that. I know when a user submits content like messages/posts the website usually gains copyright of it, however I'm not thinking about scraping this type of data.
Assuming the PrivacyPolicy/TermsOfUse specifically prohibits scraping (or password sharing), what are the potential consequences of ignoring this and doing it anyways?
Is there a legal way to work around this without getting specific permission from the website owner?