The First Question Every Project Gets Asked

"Can we legally scrape Zillow?" is usually the first thing a compliance reviewer asks when a real estate data project reaches their desk, and the honest answer is more nuanced than either the optimists or the pessimists want. Web scraping is not illegal in the United States. It is also not unconditionally legal. Legality turns on what you collect, how you access it, and what you do with it afterward. Three separate questions, constantly blurred together.

Real estate sits in an odd position on this map. Property facts — addresses, prices, square footage, tax assessments — are among the most clearly public categories of data anywhere, much of it originating in government records. And yet the same industry contains some genuinely dangerous terrain: copyrighted listing photos, MLS licensing regimes, and CoStar, the most litigation-prone data company in America. Knowing which parts of the landscape are open ground and which are minefields is the whole game.

One thing before we start. This article is not legal advice. It's a practitioner's map, written so your conversation with actual counsel is shorter and better-informed. If you're building a business on scraped real estate data, have that conversation.

Public vs. Gated: The Distinction That Decides Everything

Nearly every legal question in scraping resolves differently depending on one fact: was the data publicly accessible, or behind an access barrier?

Public data means pages anyone can view without an account. Listing search results, property detail pages, county assessor records, sheriff-sale notices. Scraping this category has the strongest legal footing, by a wide margin.

Gated data means anything behind a login, a paywall, or a license: MLS member systems, CoStar subscriptions, agent-only portals. Accessing these by automation, especially with borrowed or purchased credentials, is breach-of-contract territory at minimum and potentially federal computer-crime territory. Credentialed systems also make you agree to terms on the way in, which converts a weak terms-of-service claim into a real contract claim against you.

If you take one rule from this article: scrape only what a logged-out visitor can see. Market analytics, investment screening, price tracking: the legitimate use cases can be built almost entirely from that layer.

hiQ v. LinkedIn and the CFAA

The Computer Fraud and Abuse Act is the federal statute scrapers worry about. It criminalizes accessing a computer "without authorization," and for years the open question was whether scraping a public website against the owner's wishes counted.

The hiQ Labs v. LinkedIn litigation substantially answered it. hiQ scraped public LinkedIn profiles; LinkedIn sent a cease-and-desist and blocked them; hiQ sued and won a preliminary injunction. The Ninth Circuit held, twice, including after a remand from the Supreme Court in light of Van Buren v. United States (2021), that scraping publicly accessible data does not violate the CFAA, because a page with no access gate has no authorization to exceed. Van Buren's "gates-up-or-down" framing reinforced the logic: the CFAA is about bypassing access barriers, not breaking use rules on open data.

Now the caveats, which get lost in the celebratory summaries. The big one: hiQ still lost the war. After the CFAA rulings the case proceeded on other theories, and hiQ ultimately settled after the court found it liable for breach of contract, because it had scraped while bound by LinkedIn's user agreement (its own personnel had accounts). The CFAA is not the only claim a plaintiff can bring, and in practice it's usually not the strongest one. The rulings also protect public data only; the moment credentials are involved, the CFAA is back on the table. And circuit courts aren't uniform, so platforms keep litigating under contract, copyright, and state-law theories. The trend line favors public-data scraping. It is not immunity.

For the cross-industry picture, see our general guide: is web scraping legal?

Terms of Service: The Everyday Risk

Every major real estate platform's terms prohibit automated access. How much that prohibition weighs depends on how you encountered it. Browsewrap, the terms linked in a footer that nobody ever agreed to, gets skepticism from courts; it's weak, though not nothing. Clickwrap, where you created an account and clicked "I agree," is a real contract, and scraping in violation of it is the exact theory that finally caught hiQ.

Litigation is the rare case, though. The normal escalation path is technical: IP blocks, fingerprint bans, then maybe a demand letter. A cease-and-desist changes your legal position, because continuing after receiving one strengthens every claim against you. Treat one as a decision point that involves counsel, not an annoyance to route around.

The posture that holds up: no accounts, request rates modest enough that you're not degrading anyone's service, no circumventing explicit access controls, and collection limited to data you have a real analytical use for.

Photos: The Sharpest Teeth in the Room

The genuinely dangerous claim in real estate scraping isn't the CFAA. It's copyright, and specifically listing photographs.

The doctrinal line is clean. Under Feist v. Rural Telephone (1991), facts are not copyrightable. Prices, addresses, bed counts, square footage, sale dates: free to collect and republish as facts. Creative expression is protected, and in a listing that means two things. The photos, which are copyrighted the moment they're taken, with rights sitting with the photographer, agent, brokerage, or MLS by assignment. And the listing description, which is the agent's marketing prose; extracting facts from it is fine, republishing the paragraphs is not.

The industry actively enforces on photos. CoStar has built a well-earned reputation suing over photo misappropriation, and MLSs and photographers file infringement claims routinely. Statutory damages for registered works run up to $30,000 per work, more for willful infringement. Multiply by a scraped photo library and the number stops being a legal risk and becomes an extinction event.

So the operating rule is simple: collect facts, not photos. Store the structured fields, skip the images and the prose. In our experience this costs clients almost nothing, because virtually every analytics, investment, and market-intelligence use case runs entirely on the facts anyway. If your product genuinely needs images, license them. There is no scraping shortcut here that survives contact with a motivated plaintiff. The risk peaks in commercial real estate, where CoStar's litigation posture deserves its own briefing; see our commercial real estate scraping guide.

MLS Data: A Licensing Regime, Not a Website

Multiple Listing Services get their own category because MLS data is licensed, not public. Brokers and agents receive access under participation agreements with strict redistribution rules; IDX and VOW policies govern exactly how listings may be displayed, attributed, and refreshed. Scraping an MLS system directly, or scraping the IDX-powered search on a brokerage's site, means taking data that exists on that page under a license you're not party to. MLSs police this actively.

The practical read is short. Zillow, Redfin, and Realtor.com display listings under their own syndication arrangements, and their public pages are where scrapers operate. The MLS backend, agent portals, and anything requiring a real estate license to access are off the menu. Not gray-area off the menu. Off the menu.

People in the Data

Real estate pages are full of people: listing agents with names, phones, and emails, owner names in county records, occupancy hints in foreclosure filings. The US has no GDPR, but it's not a vacuum. California's CCPA/CPRA and a growing list of state privacy laws create obligations around personal information collected at scale, including publicly available data in some configurations; business-contact info generally gets lighter treatment, but "generally" is doing real work in that sentence.

The use side is where the statutes actually bite. Scraping an agent's phone number is one thing; auto-dialing it triggers the TCPA, unsolicited email triggers CAN-SPAM, and outreach to distressed homeowners is further restricted by state foreclosure-solicitation laws. Whatever the collection posture, the hygiene is the same: collect personal fields only when the use case requires them, minimize retention, honor removal requests.

The Do / Don't List

Reasonable ground, with counsel's blessing:

• Scrape public, logged-out listing pages for facts: prices, addresses, attributes, statuses, dates
• Scrape government records: assessor data, recorded deeds, foreclosure filings, permits
• Keep request rates polite; never degrade a site's service
• Track price and inventory trends — aggregate analytics is the most defensible use posture
• Keep records of what you collect, from where, and under what logic
• Stop and call a lawyer when a cease-and-desist arrives

Don't:

• Don't scrape behind logins, or create accounts to scrape (that's how hiQ actually lost)
• Don't store or republish listing photos, and don't copy listing descriptions
• Don't touch MLS systems, IDX feeds, or license-gated portals
• Don't scrape CoStar or any subscription database, ever
• Don't resell scraped data as a raw feed that substitutes for the source platform; market substitution is the fact pattern courts punish
• Don't use scraped contact data for mass outreach without a TCPA/CAN-SPAM review
• Don't ignore a demand letter and hope

Where We Stand

Compliance posture varies a lot between scraping vendors, and it's worth interrogating anyone you hire on it. Our defaults for real estate work: public, logged-out surfaces only, no credentialed access, no license-gated systems. Deliveries contain structured facts, never harvested photos or descriptive prose. Collection runs distributed and rate-managed so it doesn't burden source sites. And when a request crosses into territory we consider unsound (MLS data, subscription databases, photo libraries), we say no and propose the compliant alternative, which usually serves the underlying business need anyway.

Combined with the engineering side (normalization, dedup, delivery as CSV, JSON, API, or database writes), the result is a pipeline your legal team can review once and sign off on, instead of a gray-zone script running under someone's desk. For what that pipeline typically collects, start with our real estate scraping overview.

Build on Solid Ground

The realistic summary: scraping public real estate facts, politely, for analytics, sits on strong and improving legal ground in the US. The genuine dangers are specific and avoidable: logins, photos, MLS feeds, subscription databases, mass outreach. Projects get into trouble by wandering into those zones casually, not by tracking prices from public pages.

Planning a real estate data project and want it compliant from day one? Talk to our team. Describe the data you need and we'll scope a public-source, facts-only pipeline, with a working sample within days.