Google tried to make bypassing a bot wall a copyright crime. The SerpApi ruling said no.

Google has spent most of the last decade watching the Computer Fraud and Abuse Act lose its grip on scrapers. So when it sued SerpApi, it reached for a different statute. Its December 2025 complaint did not lead with unauthorized access. It led with DMCA anti-circumvention, the part of copyright law written to stop people from cracking DVD encryption, and pointed it at a web scraper. If bypassing a bot defense counts as "circumvention," then the tools half of a collection stack depends on start to look like circumvention devices, so this was the case to watch.

On July 20, 2026, the argument mostly fell apart. Chief U.S. District Judge Yvonne Gonzalez Rogers granted SerpApi's motion to dismiss and threw out the core of Google's DMCA claim with prejudice, in Google LLC v. SerpApi, LLC, No. 4:25-cv-10826 in the Northern District of California.

The ruling is worth reading closely. It does not say bypassing bot defenses is fine. It says something narrower about when copyright law reaches a scraper at all.

Is bypassing an anti-bot system a DMCA violation? Not on its own. Under the SerpApi ruling, DMCA Section 1201 only reaches a technological measure that controls access to an actual copyrighted work. A general anti-bot gate sitting in front of public facts, like URLs and search snippets, guards nothing the statute protects, so getting past it is not circumvention in the DMCA's sense.

What Google actually argued

Google filed on December 19, 2025. Its theory was that SerpApi runs billions of automated queries that bypass "SearchGuard," Google's anti-bot and anti-scraping system, to lift search results and resell them as structured data. Instead of calling that trespass, Google called SearchGuard a technological protection measure under 17 U.S.C. Section 1201 and called SerpApi's scraping a circumvention of it.

The money followed from that framing. DMCA anti-circumvention carries statutory damages of $200 to $2,500 per act of circumvention, and Google asked for that plus an injunction. At the volume Google alleged, per-act damages stop being a rounding error, which is the whole appeal of the theory. Google's complaint tied the copyrighted material to licensed content that shows up in features like Knowledge Panels, Google Shopping, and Google Maps, not to the plain blue links.

Why platforms reached for the DMCA

This case did not come from nowhere. For years the standard weapon against scraping public pages was the CFAA, and hiQ Labs v. LinkedIn drained most of it. Scraping data that anyone can see without logging in is a poor fit for an anti-hacking statute built around access "without authorization." That is a different line of reasoning from the CFAA argument that freed Perplexity earlier this year, but it runs the same direction, away from computer-crime theories for public data.

DMCA Section 1201 looked like a way around that ceiling. It does not require proving anyone infringed a specific work. A plaintiff only has to show a technological measure controlled access to a copyrighted work and that the defendant got past it. Damages attach per act, with no need to prove a single copy was made. For a platform sitting behind a bot wall, recasting that wall as a copyright access control turns every scraped request into a countable violation. Google was not the first to try this. It was the highest-profile test of whether it works.

What the court held

It did not work, and the reason is specific. Judge Gonzalez Rogers split Google's claim in two and handled each part on its own.

The first part covered everything resting on search results with no copyrighted content, and she dismissed it with prejudice. Section 1201 protects access controls that guard a copyrighted work. URLs, snippets, and the factual index data on a results page are public facts, not copyrighted works, so there was nothing there for SearchGuard to be controlling access to. Her reading of what SearchGuard does carries the decision: it regulates automated access in general rather than guarding any particular copyrighted work. A gate that keeps out bots is not, by that fact alone, a lock on a copyrighted book.

The second part was the narrow claim about copyrighted Knowledge Panel images, and she dismissed that too, but with leave to amend within 21 days. The problem there was authorization. Section 1201(a)(3)(B) treats a measure as controlling access to a work only when it operates "with the authority of the copyright owner." Google does not own the licensed images in its Knowledge Panels, and it never pleaded facts showing those copyright owners had authorized Google to run SearchGuard on their behalf. Without that, even the images claim had a hole in it. SerpApi welcomed the ruling as a rejection of Google's attempt to stretch the DMCA into control over access to public pages. The full docket sits on CourtListener, and IPWatchdog covered the original complaint back in December.

The rule that matters for your crawler

Strip the case down and you get a two-part test you can apply to your own targets. For a DMCA anti-circumvention claim to reach a scraper, the measure it got past has to guard a specific copyrighted work, and that measure has to operate with the copyright owner's authority. Miss either half and the claim has nothing to stand on.

One analyst put the logic as the lock having to be on the book, not on the building. That is a paraphrase and not the court's words, but it captures the mechanics. A bot defense in front of a whole site is a lock on the building. It stops automated traffic without caring what any given page contains, which is not the same as a measure attached to a protected work by or for the person who owns it.

That is why a general anti-bot system is not automatically a DMCA access control. Cloudflare, Akamai, DataDome, and Google's own SearchGuard exist to sort humans from machines, and most of what they sit in front of is not copyrighted at all. The reasons scrapers get blocked have to do with traffic shape, fingerprints, and IP reputation, not with protecting a specific author's work. The SerpApi ruling lines the copyright question up with that reality instead of collapsing the two into one.

Where this leaves a collection team

The practical read is narrower than the headlines, and it splits along the type of content rather than the presence of a wall.

Public, factual data behind a general bot defense is where this ruling helps most. If your pipeline collects prices, listings, availability, URLs, and similar facts, the SerpApi reasoning says the DMCA does not turn getting past the bot check into circumvention, because there is no copyrighted work behind the check for the statute to protect. When you evaluate a web data provider or scope a new target, that distinction is worth writing down: what exactly are we collecting, and is any of it a copyrighted work rather than a fact.

Copyrighted media is the other side of the line, and it is where the theory can still survive. Images, articles, and other creative works have an owner, and where an access measure genuinely guards those with that owner's authority, the SerpApi analysis leaves room for a Section 1201 claim to go forward. Google has its 21 days to try exactly that on the Knowledge Panel images.

None of this is a green light. The ruling only speaks to DMCA anti-circumvention. Terms of service still bind, real copyright in the creative works you copy still applies, and privacy and data-protection law are untouched by any of it. The same week's news that robots.txt is turning into a machine-readable license is a reminder that publishers keep opening new fronts even as this one narrows. Winning the copyright argument does not win the contract one.

The theory did not die, it got a precondition

The useful way to file this ruling is not "scraping won." It is "the DMCA now has a gate in front of it." Platforms can still bring anti-circumvention claims, but only where a real copyrighted work sits behind the measure and the measure runs with that owner's authority. A bare anti-bot wall over public facts does not clear that bar.

That keeps two questions apart that were briefly threatening to merge. Getting past the wall is a technical problem, settled by fingerprints, proxies, and success rates. What sits behind the wall is a copyright question, settled by whether the thing you took was a protected work. SerpApi kept those separate, and the teams that keep them separate in their own risk models will read the next case like this one far more clearly than the teams that treat every bot defense as a copyright lock.

This is analysis, not legal advice. Talk to a lawyer about your specific collection program.