Is Scraping Twitter (X) Legal?

I work on X data extraction for a living, and the first question anyone sends me before a project is some version of “is Twitter scraping legal, or are we going to get sued?” It is the right question to ask first, and the honest answer has three parts that get blurred together constantly: what the courts have said, what X’s contract says, and what privacy law says. They do not all point the same way.

This is my read of where the line sits in 2026, grounded in the actual rulings and the actual Terms of Service. I am an engineer writing about engineering risk. I am not a lawyer, so treat this as a map of the terrain and get real legal advice before you run anything at scale.

Is Twitter scraping legal in the US?

Scraping publicly visible Twitter/X data is generally treated as legal in the United States, and two federal cases are the reason. Neither one makes scraping a blanket right, and both turn on the same distinction: data that anyone can see without logging in sits on different footing than data behind a login.

The anchor case is hiQ Labs v. LinkedIn. The Ninth Circuit held in April 2022 that scraping data a website makes publicly available likely does not count as accessing a computer “without authorization” under the Computer Fraud and Abuse Act (CFAA). The court’s logic was that when a network “generally permits public access to its data,” collecting that public data is not the kind of unauthorized break-in the CFAA was written to punish. That ruling is binding in the Ninth Circuit, which covers California, where most of these platforms are headquartered.

The case that matters most for X specifically is X Corp v. Bright Data. In May 2024, Judge William Alsup of the Northern District of California dismissed X’s claims that Bright Data violated its terms by scraping and selling public X data. He found that X had not stated a claim over access to its public site, and that the claim based on copying public posts was preempted by the Copyright Act. Alsup warned that letting platforms fully control public data they do not own “risks the possible creation of information monopolies that would disserve the public interest.” The two sides later reached a settlement in principle, and Bright Data’s antitrust counterclaims largely survived X’s motion to dismiss in April 2025, so the case did not produce a clean appellate reversal of the public-data principle.

Put together, the US position on whether scraping Twitter is legal is that scraping public X data is defensible, and a platform suing over it has lost on those facts. The “scraping Twitter legal” question, for public data, has two federal rulings behind a yes. The CFAA risk attaches when you cross into data that is not public, which the next section gets into.

When does scraping Twitter become illegal?

Scraping Twitter becomes legally risky the moment you stop reading public pages and start defeating an access control. The single clearest line in US scraping law runs between public data and gated data, and the Supreme Court reinforced it in Van Buren v. United States.

In June 2021, the Court read the CFAA narrowly: you “exceed authorized access” only when you reach areas of a system that are off-limits to you, like files behind a permission gate. Reading information you were allowed to reach, even for a purpose the operator dislikes, is not a CFAA violation on its own. For scraping, the practical translation is direct. Pulling public tweets is fine under the statute. Creating accounts to get behind the login, sharing or buying credentials, or bypassing a rate limit or CAPTCHA to reach protected timelines moves you toward “without authorization” territory, because you are accessing data that was gated against you.

A few specific actions raise the risk sharply:

• Logging in to scrape. Once you authenticate, you have accepted the Terms of Service and you are reading data X chose to gate. Both the contract claim and the CFAA argument get stronger.
• Scraping private or protected accounts. Protected tweets and DMs are not public data. Collecting them is the clearest path to a real claim.
• Credential stuffing or fake accounts at scale. This adds potential claims beyond scraping, including fraud and unauthorized access.
• Causing server harm. Aggressive request volume can support a “trespass to chattels” claim. That claim turns on the load you put on the system, and it can apply even to public data.

So the act of scraping is rarely the illegal part. Hammering a login wall or lifting non-public data is. That distinction is also why X’s own contract matters even when the law is on the scraper’s side, which is the next piece.

Does Twitter allow scraping under its Terms of Service?

No. X does not allow scraping under its Terms of Service, and the question “does Twitter allow web scraping” has a flat answer in the contract even when the act is lawful. This is the part people miss when they read a headline saying scraping is legal. Legality under the CFAA and permission under the contract are two different gates, and X slams the contract gate shut.

X’s Terms of Service, in the section on using the Services, prohibit accessing or searching the Services by any automated means other than the published interfaces, and prohibit scraping the Services without X’s prior written consent. The terms became effective September 29, 2023. As TechCrunch reported at the time, the previous version allowed crawling in accordance with robots.txt, and that carve-out was removed. The current terms ban any form of crawling or scraping without written consent.

X backed the policy change with technical signals. It rewrote its robots.txt to disallow most crawlers, and as Search Engine Roundtable documented, it went as far as blocking Bing’s crawler. So both the contract and the robots file point the same way: automated access is not authorized.

Here is how the legal status and the ToS status line up, because the combination is what actually governs your risk.

The takeaway is that a ToS breach is a contract matter, and the realistic consequence is account suspension or a blocked IP. X can still sue, and it has, but its track record on public-data claims is the Bright Data loss. The bigger exposure for most teams is not X at all. It is privacy law, which applies no matter what X’s contract says.

What are the GDPR and privacy risks of scraping Twitter data?

The GDPR and privacy risks of scraping Twitter data come from the personal data inside tweets, and “the data was public” is not a defense that EU regulators accept. This is the Twitter scraping legal issue that catches US teams off guard, because it does not depend on any US ruling.

Under the EU’s General Data Protection Regulation, a tweet author’s name, handle, photo, and posts are personal data. Processing the personal data of people in the EU needs a lawful basis under Article 6, and being publicly visible does not supply one. The clearest warning is the Clearview AI enforcement. The Dutch Data Protection Authority fined Clearview 30.5 million euros in September 2024 for building a facial-recognition database from billions of scraped public images, and regulators across the UK, France, Italy, Greece, and Spain issued their own fines on the same theory. The consistent regulator position is that public availability is not a lawful basis, and a “legitimate interest” argument failed in every jurisdiction for that use.

For a US-only project scraping only public, non-EU data, GDPR may not reach you. California’s CCPA also carves out information a consumer has lawfully made public. The risk scales with three things: whether your targets include EU residents, how much identifiable personal data you keep, and what you do with it. Aggregate analytics of public posts is a lighter footprint than building profiles of named individuals.

If your use touches EU residents, a few practices reduce exposure:

• Collect only what you need. Data minimization is a core GDPR principle with legal weight. Skip fields you will not use.
• Avoid sensitive categories. Health, politics, religion, and biometric inferences carry far higher bars under Article 9.
• Have a documented lawful basis. If you rely on legitimate interest, run and record the balancing test before you collect.
• Honor deletion. Be able to remove an individual’s data on request.

The pattern across CFAA, the ToS, and GDPR is the same: scope your collection to genuinely public, non-personal-where-possible data, and most of the risk falls away. The cleanest way to hold that line technically is to never log in, which is what the official API and a public-page scraper API both do.

How can you scrape Twitter data legally and stay compliant?

You scrape Twitter data with the least legal risk by reading only public pages and never bypassing a login, which you can do two ways: the official X API or a scraper API that pulls public profiles and tweets for you. Both keep you on the defensible side of every line above, because neither touches gated data.

The official X API is authorized access by definition, so the ToS scraping ban does not apply to it. The catch is cost. X discontinued the old free tier for new developers and moved to pay-per-use pricing, on top of legacy fixed tiers that pricing trackers put at $200/month for Basic and $5,000/month for Pro, with enterprise far higher. For many read-heavy use cases the API is either expensive or rate-limited below what the project needs, and that gap is why public-page scraping exists as an alternative.

A scraper API sits in the middle. It reads the same public pages a logged-out visitor sees, handles the rotation and parsing, and returns structured JSON, without you operating accounts or defeating a login. In my own runs against ChocoData’s X endpoints, a single request returns a public profile as clean JSON. The call is a plain GET with the username and your API key:

curl "https://chocodata.com/api/v1/twitter/profile?username=nasa&api_key=$CHOCO_API_KEY"

The Python shape is the same, which makes it easy to keep collection scoped to public fields only:

import requests

resp = requests.get(
    "https://chocodata.com/api/v1/twitter/profile",
    params={"username": "nasa", "api_key": "YOUR_CHOCO_API_KEY"},
    timeout=30,
)
profile = resp.json()
print(profile["username"], profile.get("followers_count"))

Because this route reads only public profile and tweet data and never authenticates as a user, it stays inside the public-data lane that hiQ and Bright Data protect, and it sidesteps the credential-and-login actions that create CFAA exposure. You still owe the GDPR analysis if your targets are EU residents, and you still hold the ToS question that applies to all non-API scraping. You can get an API key on the ChocoData sign-up page and point it at the tweet or search and hashtag endpoints the same way.

If you want the policy detail in one place, I keep a running breakdown in my Twitter/X Terms of Service and scraping policy explainer, and the practical engineering side, the blocks and rate limits, lives in how to scrape Twitter without an API or getting blocked.