You can read about the case here.
Imagine you build a high-tech library. You put a security guard at the front door to check ID cards, and you lock the rare books in a glass cabinet. Now imagine a company sets up a service that rents out fake IDs and specialized lock-picking tools so anyone can sneak in, photocopy the rare books, and sell the copies. When you catch them, they say, “But the library is open to the public!”
This is the core of Google LLC v SerpApi, LLC (ND Cal, 19 December 2025).1 A lawsuit filed in the Northern District of California that targets the “picks and shovels” of the web scraping industry. Unlike previous battles over who scrapes, this case attacks the methods used to bypass modern anti-scraping defences.
What is an API wrapper for scraping? Scraping modern websites is hard. You have to manage:
SerpApi sells this complexity as a service. A developer simply sends a clean HTTP request to SerpApi, and SerpApi handles the messy work of bypassing Google’s defences to return structured JSON data.
Google recently deployed a new anti-automation system called “SearchGuard”. They allege that SerpApi didn’t just scrape public data, but actively reverse-engineered this security layer. This includes using “cloaking” (showing one thing to Google and another to users) and sophisticated bot networks that mimic human behaviour to slide past the gates.
The lawsuit hinges on a specific US law that turns technical circumvention into a legal crime.
While often associated with pirated movies, the DMCA has a powerful section: 17 USC § 1201.2 This provision makes it illegal to “circumvent a technological measure that effectively controls access” to a copyrighted work.
Think of it like digital breaking-and-entering. Even if you have a right to look at the data inside (fair use), picking the digital lock to get there is a separate crime. Google argues that “SearchGuard” is the lock, and SerpApi is selling the lockpicks.
This relies on Google’s Terms of Service (ToS), which explicitly forbid scraping, accessing the services via automated means, or bypassing restrictions. Google argues that by creating accounts to test their scrapers, SerpApi agreed to these terms and then immediately broke them.
Legal argument
Technical argument
From Google’s complaint
“SerpApi has built a business on the unauthorised exploitation of Google’s resources… systematically evading the technological barriers Google has erected.”
Legal argument
Philosophical argument If Google is the gateway to the web’s information, banning APIs like SerpApi consolidates their monopoly. Developers need programmatic access to search data to build tools that compete with Google.
If Google wins on the DMCA claim, it creates a dangerous precedent: companies could legally ban scraping simply by putting up any technical hurdle (even a weak one) and calling it a “technological measure”. This would weaponise copyright law to kill the open web.
Many businesses rely on third-party scrapers because building in-house infrastructure is too expensive. A ruling against SerpApi could bankrupt the middleware layer of the data economy, forcing startups to either pay Google’s exorbitant official API prices or shut down.
From an engineering perspective, this case shifts the risk profile:
Technical:
robots.txt where possible.Business: