Every developer who needs Zillow data eventually asks the same question: is scraping Zillow actually legal? The honest answer is more nuanced than either the "public data is fair game" crowd or the "you'll get sued instantly" crowd suggests.
The short answer
Three things are simultaneously true in 2026:
- US courts have generally declined to treat scraping publicly accessible pages as criminal "hacking." The landmark fight was hiQ Labs v. LinkedIn, where the Ninth Circuit held — twice — that accessing data available to any browser without a login likely does not violate the Computer Fraud and Abuse Act (CFAA). The Supreme Court's Van Buren decision (2021) pointed the same direction, reading the CFAA narrowly around "gates" — authentication barriers — rather than terms-of-use violations.
- Zillow's terms of use prohibit scraping anyway. Like most large sites, Zillow expressly forbids automated queries, bots, and scrapers. Violating a site's terms is not a crime, but it can support civil claims — breach of contract most directly. Notably, the hiQ case itself ended in 2022 with a settlement after the court found hiQ had breached LinkedIn's user agreement — the CFAA win didn't erase the contract problem.
- What you do with the data matters as much as how you got it. Republishing Zillow's photos or its proprietary Zestimate wholesale raises copyright and misappropriation issues that plain facts (an address, a sale price from county records) do not. Facts aren't copyrightable; curated presentations and images can be.
So "is it legal?" decomposes into: criminal risk (low for public pages, per current case law), contract risk (real, especially at commercial scale), and IP/use risk (depends entirely on what you republish).
What Zillow actually does about scrapers
Whatever the courts say, Zillow votes with its infrastructure. The site runs PerimeterX (HUMAN Security) bot detection with browser fingerprinting, behavioral analysis, CAPTCHA challenges (the "Press & Hold" screen), and aggressive IP-reputation blocking. Residential proxies get burned within hours. We wrote up the whole arms race in Zillow Scraper: Why It's So Hard — the summary is that keeping a Zillow scraper alive is a part-time job, and the failure mode is silent data gaps, not error messages.
That technical enforcement is also the practical answer to a common question: "if scraping public data isn't criminal, why doesn't everyone just do it?" Because between the ToS exposure, the engineering cost of the cat-and-mouse game, and the reliability problem, DIY scraping at any real scale is usually the worst of the three options.
The risk ladder, practically
| Scenario | Practical risk profile |
|---|---|
| Personal project, a few hundred lookups | Mostly technical friction (blocks, CAPTCHAs). Legal attention is unlikely, though ToS still prohibit it. |
| Internal business tooling at moderate scale | Contract-claim exposure grows with scale and detectability; IP issues if photos/Zestimates are stored and redistributed internally at volume. |
| Commercial product republishing scraped Zillow content | Highest exposure: breach of contract, copyright on images, potential unfair-competition claims. This is the scenario that generates cease-and-desist letters. |
| Consuming a property data API under a commercial agreement | Normal vendor relationship: defined terms, support, and no bot-evasion arms race on your side. |
Where an API changes the picture
Using a data provider like APIllow doesn't make legal questions vanish — nothing does — but it changes your position in three concrete ways:
- You're not the one running automation against Zillow. The scraping-adjacent operational risk — bot detection, blocks, ToS friction — sits with the provider, whose business is managing it. You consume JSON under a normal commercial agreement with defined terms.
- You get facts, structured. Addresses, prices, beds, baths, tax records, sale history — the factual layer that valuation and analytics products are built on, without wholesale copying of Zillow's presentation.
- Reliability becomes a contract, not a hope. When Zillow rotates its bot detection (it does, regularly), that's the provider's 3 a.m. problem, not yours.
The pattern is the same one that played out with search data, social data, and financial data: an ecosystem of API providers absorbs the messy acquisition layer, and application developers build on top. Our comparison of Zillow data providers covers the current options.
Questions developers actually ask
"But the data is public — how can accessing it be wrong?"
Public visibility answers the CFAA question (per hiQ and Van Buren, no "gate," no unauthorized access). It does not answer the contract question — courts have repeatedly allowed breach-of-ToS claims to proceed against commercial scrapers — and it says nothing about republishing copyrighted photos.
"Zillow doesn't own home facts, right?"
Right. A sale price or square footage is a fact, and facts are not copyrightable (Feist v. Rural Telephone is the classic case). But Zillow's photos are copyrighted (usually by brokers/photographers, licensed to Zillow), and the Zestimate is Zillow's proprietary model output. Treating "facts are free" as a blanket license to mirror listing pages is how people get in trouble.
"What about robots.txt?"
robots.txt is a convention, not a law. Ignoring it doesn't create criminal liability by itself, but it undercuts any "we acted in good faith" narrative and is exactly the kind of detail that shows up in demand letters.
The bottom line
Scraping publicly accessible Zillow pages is unlikely to be criminal under current US case law — but it violates Zillow's terms, it carries civil exposure that scales with your commercial footprint, and it commits you to an unwinnable maintenance war against a first-rate bot-detection stack. For anything beyond a weekend experiment, the boring answer is also the right one: get the data from an API under terms that let you build on it.
Skip the legal gray zone and the proxy bills
50+ property data fields per address, clean JSON, free tier to start. No scraping required on your side.
Get API Key