Legal

SerpApi says Google is the pot calling the kettle black when it comes to scraping

'The DMCA was not designed to create walled gardens for tech giants'

SerpApi, a Texas-based web scraping company, has asked a California court to dismiss Google's claim that that it bypassed digital locks to gather copyrighted content in Google Search results.

"Google is the largest scraper in the world," the company said in a blog post on Friday. "Google's entire business began with a web crawler that visited every publicly accessible page on the internet, copied the content, indexed it, and served it back to users. It did this without distinguishing between copyrighted and non-copyrighted material, and it did this without asking permission. Now Google is in federal court claiming that our scraping is illegal."

Google in December 2025 sued SerpApi [PDF], alleging that its web scraping circumvents the security measures Google put in place to protect copyrighted material surfaced in search results. This was two months after Reddit filed a similar lawsuit against Oxylabs UAB, AWM Proxy, and SerpApi claiming the defendants had violated its own controls and Google's defenses.

Google did so alleging violations of the US Digital Millennium Copyright Act (DMCA), specifically Circumvention of Technological Measures (17 U.S.C. § 1201(a)(1)(A)) and Trafficking in Technology Designed for Circumvention of Technological Measures (17 U.S.C. § 1201(a)(2)).

"SerpApi deceptively takes content that Google licenses from others (like images that appear in Knowledge Panels, real-time data in Search features and much more), and then resells it for a fee," said Google general counsel Halimah DeLaine Prado when the lawsuit was announced. "In doing so, it willfully disregards the rights and directives of websites and providers whose content appears in Search."

Invited to comment, a Google spokesperson pointed to Prado's post.

The question is whether the mechanism Google employs to prevent scraping qualifies as a technological protection measure under the law, and whether SerpApi's crawling system unlawfully circumvents that protection. 

It's a question that has become hugely important in light of increasing efforts to harvest data from websites and to deploy counter-measures, both technical and legal.

Google in its complaint refers to its anti-scraping technology as SearchGuard and claims that SerpApi found a way around it.

"With the automated queries it submits, SerpApi engages in a wide variety of misrepresentations and evasions in order to bypass the technological protections Google deployed," Google's complaint explains. "But each time it employs these artifices, SerpApi violates federal law."

SerpApi disagrees, insisting that Google's legal broadside is simply an attempt to protect its business interests.

The DMCA's definition of a technical protection measure is specific. And according to SerpApi, SearchGuard doesn't meet that definition.

"The DMCA defines circumvention precisely: it means 'to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure," the company says. "Read that carefully. Descramble. Decrypt. Impair."

SerpApi maintains it does none of those things, asserting that it accesses publicly visible web pages, without breaking encryption, disabling authentication systems, or accessing private data.

To support its argument, the company cites hiQ Labs, Inc. v. LinkedIn Corp. and Impression Products, Inc. v. Lexmark International, cases that have affirmed the lawfulness of scraping public data and denied the applicability of DMCA anti-circumvention provisions to otherwise public works.

SerpApi's motion to dismiss [PDF] argues that its web scraping is not circumvention under the DMCA, just as Google's own web scraping isn't circumvention.

"The DMCA prevents hacking: the 'electronic equivalent of breaking into a locked room,'" the company's motion states. "...But Google does not allege unscrambling or decryption of any work, or the impairment, deactivation, or removal of any access system. It only alleges that SerpApi 'solved' JavaScript challenges or CAPTCHAs or otherwise mimicked a human-controlled browser in ways that 'misled' Google into providing search results. But that is not the equivalent of breaking a lock or drilling through a wall to obtain a copy of a book. Mimicry is not a violation."

In January, SerpApi made a similar argument against Reddit in its Memorandum of Law [PDF] that accompanies its motion to dismiss Reddit's complaint. Reddit's first amended complaint [PDF], filed earlier this month, continues to rely on DMCA violation claims.

Tori Noble, staff attorney at the Electronic Frontier Foundation told The Register in an email that scraping public information is essential for the functioning of the internet.

"The right to scrape publicly available information keeps the Internet free and open," she said. "The DMCA undermines web freedom by chilling lawful scraping for research, expression, innovation, and more. When companies like Google attempt to rely on overly expansive interpretations of DMCA to protect their business models, everyone suffers."

Noble added, "SerpApi is an EFF donor. However, EFF takes its independence seriously and donors never guide any of our work, including commentary on legal cases that fall within our issue areas."

With regard to recent litigation involving AI data gathering, courts have been reluctant to limit web scraping. In December, US District Judge Sidney Stein rejected [PDF] Ziff Davis's bid to have the court treat OpenAI's flouting of robots.txt directives during its web scraping as circumvention under the DMCA.

Given the financial stakes involved, the inapplicability of copyright rules to halt competitive scraping seems likely to invigorate efforts to separate human visitors from bots. But with AI bots getting better at autonomous and human-delegated activity online, it's difficult to see sites will be able to keep the bots away with anything less iron-clad contractual agreements or the sort of full-blown authentication envisioned by the DMCA. ®