Scraping Google search results just became a court case

What the court actually said about scraping Google search results#

A fox does not fight fences. It finds the gap beneath one, learns which post was mended last, and returns when the wind sits right. That patient prowl is the posture worth borrowing here, because the argument running through a California courtroom this summer was never really about scraping Google search results. It was about who owns the words printed on the page.

On 11 August 2026, MediaPost reported that Google had filed an amended complaint alleging SerpApi bypassed its technological safeguards. Google says it receives "hundreds of millions of artificial search requests each day" from the company, and that it built a system called SearchGuard to stop bot scraping. Large numbers, small specific accusation, and the size of the numbers is doing a lot of the persuading.

Three weeks before that filing, the case ran the other way. US District Judge Yvonne Gonzalez Rogers, sitting in the Northern District of California, dismissed Google's original complaint and ruled that Google could proceed only on claims about content it licensed from third parties. As MediaPost summarised the reasoning, the judge indicated Google would have to show that the owner of that content had permitted Google to use technological measures aimed at preventing scraping.

The defendant's own account of the dismissal#

SerpApi published its version days later. In a post dated 21 July 2026, describing a court order made on 20 July, SerpApi wrote that "the court rejected Google's attempts to expand the DMCA to assert control over access to public pages". That is the winning defendant describing its own win, so read it as advocacy rather than analysis. The framing still matches what MediaPost reported separately.

Then the complaint quietly moved to licensing#

The amended complaint did not re-run the losing argument. It moved the ground. Per MediaPost, Google alleges that Reddit, a licensing partner, directed it not to let third parties extract and independently commercialise the licensed content, and that licensing partners expressly asked Google to block access to licensed material by parties they had not permitted.

That pivot is the part marketers should mark. A claim about a public results page is weak. A claim about a signed contract with Reddit is not. The scent now runs through licensing agreements you will never see, signed by parties you do not deal with, covering content you did not commission.

It is worth sitting with that last bullet. The sharpest public read of a case that underpins the entire measurement industry arrived on 12 August 2026 and has been sitting there since, largely unremarked. Quiet quarry, and nobody hunting it.

So is web scraping legal, or only unsettled?#

Clients ask the blunt version first: is web scraping legal, and can our agency be sued for buying rank data? The honest answer in August 2026 is that one judge in one district has issued one ruling, and the party that lost has already filed again. Anyone selling certainty about scraping Google search results is selling a feeling, not a finding.

The distinction the court drew is the one worth carrying into that client meeting. A position in a results list is a fact about a page, not a possession. Facts have always been free to observe, count and report, which is why nobody needs permission to note that it rained on Tuesday. Licensed content is different, because somebody signed something, and signatures survive summaries.

That is the bridge the amended complaint is trying to build. If a results page carries licensed excerpts, then scraping Google search results stops being plain fact-gathering and starts brushing against another party's contract. Per MediaPost, the Reddit allegation is precisely that bridge, built in public.

What changes for an agency this quarter#

Very little today, and that is the point. No injunction stops a rank tracker. No ruling makes a dashboard illegal. What changed is the shape of the risk, which moved from whether anyone may look at a results page to whose content is inside the thing they looked at. That is a supplier question rather than a legal one, and suppliers can be asked questions.

So the sensible reading of is web scraping legal is that it is the wrong question for a marketing team to be arguing about. The right question is narrower, cheaper and answerable in an afternoon: which numbers in our reporting could we not reproduce if one supplier went dark tomorrow morning?

Write the answer down before the next board deck. A brand that can name its data sources survives a supplier outage as a footnote. A brand that cannot name them survives it as a glaring gap in the graph, and gaps get read as decline by people who were never told otherwise.

Most agencies already run this discipline over media spend and never think to run it over measurement. Nobody signs off a paid budget without knowing which platform holds the money, yet the same team will paste a visibility index into a quarterly review without knowing which company generated it, from which country, or on which day.

There is precedent for the platform changing the ground without a warning shot. Google removed a targeting control marketers had planned around, which folkfox covered when it shut the gate on manual language targeting. Reporting infrastructure gets the same treatment, only more slowly and with lawyers.

Your measurement stack is the exposed part, not your rankings#

Here is the uncomfortable inventory. Every rank report your team ships, every share-of-voice chart in a quarterly deck, and every AI-visibility product sold as a GEO dashboard depends on somebody, somewhere, scraping Google search results at scale. Nobody in your building built that layer. You rent it, usually without knowing the landlord's name.

Most teams cannot name it either. Ask a delivery lead which rank tracker api sits behind the client dashboard and the answer is a brand, not a data source, because the brand is the last link in a chain of three or four. The rank tracker api your reporting depends on may itself be reselling a provider that resells another one.

That reply is the sharpest sentence anybody wrote about this case, and it came from a stranger in a thread five days ago. If courts decide who may reach licensed content, they decide what the models see. What the models see decides who gets cited, and citation is the currency that SEO and GEO work now trades in. Scraping Google search results is simply the meter that measures the trade.

It is the same shift folkfox traced through healthcare, where the win is a citation rather than a click, and where being absent from an answer is a statement made on your behalf.

The automated client is the argument everywhere this month#

Security is having the identical fight in different clothes. An anonymous practitioner account posted to r/cybersecurity on 17 August 2026 describes an internal ticket-triage agent that opened a wiki, followed a link dropped into a page, and pulled down a config file holding a live API key, while running as a service account a departed colleague had set up for a nightly export. Treat it as testimony, not as a verified incident report.

The line that travels is this one: "The login rules we are so proud of do not even touch it." Swap login rules for licensing terms and you have the SerpApi case in nine words. Both are arguments about a non-human client that nobody wrote the rules for, doing something at three in the morning that a person would never do at all.

Regulation is arriving at the same junction from a third direction. The EU AI Act implementation timeline records that on 2 August 2026 the remainder of the Act started to apply, except Article 6(1), which follows on 2 August 2027. AI systems inside the large-scale IT systems listed in Annex X have until 31 December 2030. A dashboard that markets itself as AI is now describing itself to a regulator as well as to a buyer.

None of those five risks is legal. All five are operational, all five are cheap to close, and all five become expensive the week a supplier changes its terms without telling anyone downstream.

What the keyword data says about scraping Google search results#

On 17 August 2026, folkfox pulled its own numbers on this cluster through DataForSEO at United States scope, on the principle that an argument about measurement ought to arrive with a measurement attached. The picture is the one you would expect from a market that has been sold to for a decade and questioned for about a month.

Read those bars the way a fox reads a hedgerow. The head of the cluster, where every tool vendor already dens down, sits between 62 and 75. The edge, where people are asking what the tooling actually does and whether they are allowed to use it, sits between 27 and 37. The vendors bought the middle of the field and left the boundary bare.

The two variants make the point plainly. The query serp scraping measures 210 searches a month at difficulty 37, and the narrower google serp scraping measures 90 searches at difficulty 32. Both are small. Both are also the exact language a technical buyer types when they have stopped shopping and started worrying.

One point sits alone on the left of that plot. The query rank tracker api draws 880 searches a month at difficulty 1, the lowest figure in the set by a long stretch, and it is the term that names the plumbing rather than the product. That is not a gap in the market. It is a gap in the market's attention: vendors write endlessly about tracking, and almost nobody writes about the pipe the tracking runs through.

Trend direction carries the other half of the story. On the same folkfox pull, interest in scraping Google search results is up 366.7%, google serp scraping is up 300%, rank tracker api is up 178.2%, serp scraping is up 98% and is web scraping legal is up 78.1%. Rising interest in a question is what a market looks like shortly before it starts buying answers.

Note which two are climbing fastest. The two steepest risers are the terms that name the practice rather than the product, and that ordering is the whole thesis of this piece in two data points. Buyers stopped asking which tracker to buy and started asking how tracking works.

For a content team the implication is direct, and it is the sort of thing content marketing services should be catching automatically: the cheap ground in any mature category is the ground where the practice gets questioned, not the ground where the product gets compared.

August's other paper trails#

Step back for a paragraph, because this case is not an isolated oddity. August 2026 produced a run of documents in which somebody outside marketing wrote down, publicly and in detail, how the machinery beneath a marketing team actually works. Scraping Google search results is one entry on that list, and not the largest one.

A United States banking regulator read a challenger bank's marketing plan and put a price on it. Reporting the decision letter, Banking Dive quotes the Office of the Comptroller of the Currency finding that the applicant "failed to consider and plan for expenses that would likely be necessary to compete effectively in the market given its lack of name recognition".

The Paypers dates the letter to 4 August 2026 and reports that the application did not clearly explain how the bank would be capitalised in the United States. The decision is published as Corporate Decision #1384 by the OCC. On X, Harsha Goli read the outcome bluntly: "in the end, the regulator failed them on 4 out of 6 charter factors."

Brand awareness stopped being a soft metric the moment a regulator costed it. That is a brand strategy argument you can now make with a citation instead of an anecdote, and it lands hardest in regulated categories such as fintech marketing, where the licence and the launch plan are read by the same reviewer.

A dated obligation is a content calendar in disguise#

The European Commission records that from 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements: an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available. The obligation sits in Regulation (EU) 2024/2847.

ENISA describes the Single Reporting Platform that will carry those reports in the future tense, and says it has been taking the necessary steps through 2025 and 2026 to support the platform. A fixed date on one side, preparation described on the other, and a diarised moment in between that any vendor with a calendar can plan around.

On X on 17 August 2026, the account @SBOMFlow compressed the whole obligation into seven words: "You cannot report what you cannot inventory." That post is hours old rather than days, and it is the SerpApi argument wearing different clothing. Nobody can defend a number whose origin they cannot trace.

The picture an industry sells is usually the wrong one#

Dragos counted 1,140 ransomware incidents affecting industrial organisations worldwide in the second quarter of 2026, a 12% rise on the 1,020 recorded in the first, and reported that no operator in the quarter reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system. Help Net Security, covering the same analysis, puts the United States alone at 431 incidents, 38% of the worldwide total, with Europe at 316.

The relevance is not the ransomware. It is the pattern in the thicket. The dramatic picture a market sells itself, a hacked turbine or a rogue scraper farm prowling the undergrowth, is rarely the thing doing the damage. The damage runs through ordinary infrastructure nobody ever put on a slide: enterprise IT in one case, a quietly resold rank tracker api in the other.

The same lesson turned up in publishing this month, where licensed content became the product rather than the packaging. folkfox read three sets of filings and found only one publisher had actually rebuilt the revenue, which is worth holding in mind while Google argues about who may reach its partners' words.

Five moves that make your reporting defensible#

None of this needs a replatform, a legal opinion or a new vendor. It needs a fortnight of unglamorous housekeeping, and it holds whichever way the case goes, because every move is about provenance rather than prediction. Scraping Google search results may well be settled law by 2027. Your reporting has to survive the rest of 2026.

The third step is the one teams skip, and it is the one that saves the budget conversation. A graph with no source stamped beneath it is an opinion wearing axes, and an opinion cannot defend itself in the meeting where the spend gets decided.

The fifth step is the one that turns this article into work. Most tracked keyword sets contain results that carry licensed material, from forum threads to review snippets, and nobody has ever marked which. Marking them takes an afternoon and tells you, precisely, how much of your reporting sits on the contested side of the fence.

Expect the exercise to be duller than it sounds and more revealing than it looks. Teams that run it properly tend to surface two suppliers nobody remembered signing, one chart nobody can source at all, and a trend line that turns out to have changed method quietly halfway through last year.

Run the same discipline across the rest of the reporting: content performance, paid search, and the AI-visibility work that SEO and GEO services now lead with. Every one of those disciplines quotes at least one number that somebody, somewhere, scraped from a results page this morning.

A fox that survives the season is not the fastest animal in the field. It is the one that knows which hedge holds a hole and which does not, and it learned that by walking the same trail until it stopped being a guess. Knowing where your numbers come from is that skill, applied to a den made of dashboards.

Do the fortnight. Then, when a client forwards a headline about scraping Google search results and asks whether the reporting still stands, the answer is a spreadsheet rather than a shrug.

Frequently asked questions#