## Facts

- hiQ Labs, Inc. sold analytics products that relied on collecting data from LinkedIn members’ publicly viewable profiles.
- hiQ used automated tools to scrape information from profiles accessible without logging in.
- LinkedIn sent hiQ a cease-and-desist letter asserting that scraping violated LinkedIn’s User Agreement and multiple laws, and LinkedIn implemented technical measures (including IP blocking) to prevent hiQ’s access.
- hiQ sued in federal district court seeking injunctive relief and a declaration that LinkedIn could not lawfully use the CFAA and other doctrines to block access to public profiles.
- The district court granted a preliminary injunction requiring LinkedIn to withdraw the cease-and-desist letter, remove technical barriers, and refrain from blocking hiQ’s access to public profiles.
- The Ninth Circuit affirmed in 2019; the Supreme Court vacated and remanded for reconsideration in light of Van Buren v. United States.
- On remand in 2022, the Ninth Circuit again affirmed the preliminary injunction.
- In later merits proceedings, the district court granted LinkedIn partial summary judgment on breach of contract and imposed sanctions for spoliation; the parties then entered a consent judgment and permanent injunction ending the case.

## Issues

1. Whether accessing and scraping data from publicly available LinkedIn profiles after a cease-and-desist letter is “access[ing] a computer without authorization” under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2)(C).
2. Whether hiQ showed sufficient likelihood of success on state-law claims (including intentional interference with contract) challenging LinkedIn’s blocking conduct.
3. Whether hiQ satisfied the requirements for preliminary injunctive relief, including irreparable harm, balance of hardships, and public interest.

## Decision

- The Ninth Circuit affirmed the preliminary injunction on remand.
- The court held hiQ raised serious questions that scraping publicly accessible profiles is not “without authorization” under the CFAA, even after receipt of a cease-and-desist letter.
- The court agreed hiQ showed likely irreparable harm because its business depended on continued access to public profile data.
- The court upheld the district court’s assessment that the balance of hardships favored hiQ at the preliminary stage.
- The court agreed the public interest supported interim relief favoring access to publicly available information, while noting potential limits and alternative remedies outside the CFAA.

## Legal Principles

- For CFAA § 1030(a)(2), “without authorization” is generally tied to circumvention of access restrictions such as authentication requirements (e.g., passwords or similar permission gates), not merely violation of a website owner’s stated preferences.
- Accessing information made available to the general public on the open internet is unlikely to qualify as access “without authorization” under the CFAA, even if the website owner objects after the fact.
- Under the Ninth Circuit’s preliminary-injunction framework, a plaintiff may obtain relief by showing serious questions on the merits and a balance of hardships sharply favoring the plaintiff, along with irreparable harm and consistency with the public interest.
- Limits on CFAA coverage do not preclude website operators from regulating scraping through other doctrines, including contract-based restrictions in enforceable user agreements.

## Conclusion

The Ninth Circuit upheld a preliminary injunction preventing LinkedIn from blocking hiQ’s access to publicly viewable profiles, reasoning that the CFAA’s “without authorization” concept likely does not reach scraping of public webpages absent a technical access barrier; later merits rulings, however, indicated that contract remedies could still restrict scraping conduct.


hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022)