Every developer who needs Zillow data eventually asks the same question: is scraping Zillow actually legal? The honest answer is more nuanced than either the "public data is fair game" crowd or the "you'll get sued instantly" crowd suggests.
The short answer
Three things are simultaneously true in 2026:
- US courts have generally declined to treat scraping publicly accessible pages as criminal "hacking." The landmark fight was hiQ Labs v. LinkedIn, where the Ninth Circuit held — twice — that accessing data available to any browser without a login likely does not violate the Computer Fraud and Abuse Act (CFAA). The Supreme Court's Van Buren decision (2021) pointed the same direction, reading the CFAA narrowly around "gates" — authentication barriers — rather than terms-of-use violations.
- Zillow's terms of use prohibit scraping anyway. Like most large sites, Zillow expressly forbids automated queries, bots, and scrapers. Violating a site's terms is not a crime, but it can support civil claims — breach of contract most directly. Notably, the hiQ case itself ended in 2022 with a settlement after the court found hiQ had breached LinkedIn's user agreement — the CFAA win didn't erase the contract problem.
- What you do with the data matters as much as how you got it. Republishing Zillow's photos or its proprietary Zestimate wholesale raises copyright and misappropriation issues that plain facts (an address, a sale price from county records) do not. Facts aren't copyrightable; curated presentations and images can be.
So "is it legal?" decomposes into: criminal risk (low for public pages, per current case law), contract risk (real, especially at commercial scale), and IP/use risk (depends entirely on what you republish).
What Zillow actually does about scrapers
Whatever the courts say, Zillow votes with its infrastructure. The site runs PerimeterX (HUMAN Security) bot detection with browser fingerprinting, behavioral analysis, CAPTCHA challenges (the "Press & Hold" screen), and aggressive IP-reputation blocking. Residential proxies get burned within hours. The summary is that keeping a Zillow scraper alive is a part-time job, and the failure mode is silent data gaps, not error messages. The section below on why an API beats your own scraper walks through it.
That technical enforcement is also the practical answer to a common question: "if scraping public data isn't criminal, why doesn't everyone just do it?" Because between the ToS exposure, the engineering cost of the cat-and-mouse game, and the reliability problem, DIY scraping at any real scale is usually the worst of the three options.
Why an API beats running your own scraper
Maintenance: the scraper is never finished
A scraper that fetches Zillow reliably needs a TLS-impersonating client, rotating residential or mobile proxies, several browser profiles, retries, a parser for the page's embedded JSON, and monitoring. Zillow changes the pieces independently. We run that stack for APIllow, and on August 10, 2026 a fingerprint change on the bot-detection side knocked out both of our primary browser profiles for about seven hours; a team without a fallback and an alert finds out from a customer. The failure is also quiet: a blocked fetch often looks like a missing record, not an exception.
Blocking: you are in an arms race by design
Bypassing "captcha" or similar precautions is named in the Terms of Use, quoted next, so the work you do to stay unblocked is itself the conduct the terms describe.
Legal exposure: what the terms and robots.txt actually say
Zillow's Terms of Use (the version showing a date of October 28, 2025 when we read it on October 21, 2026) list this among prohibited conduct:
"conduct automated queries (including screen and database scraping, spiders, robots, crawlers, bypassing "captcha" or similar precautions, or any other automated activity with the purpose of obtaining information from the Services) on the Services;"
The same terms say "you may copy information from the Services without the aid of any automated processes and only as necessary for your personal use or Pro Use." Read together: manual copying for your own use is permitted, automated collection is not. That is a contract term, not a criminal statute, which is why the hiQ analysis above and this paragraph can both be true.
robots.txt is a different instrument, and people misread it in both directions. When we fetched zillow.com/robots.txt on October 21, 2026:
- The
User-agent: *group disallows/api/and/homes/(search and listing-result pages), withAllowexceptions for a set of canonical list pages such as/homes/for_sale/$, and also disallows/*?searchQueryState=*. - Property detail pages under
/homedetails/are not blanket-disallowed. Only a few patterns are, such as*view=ownerand*/rental-manager/resources/. - About 18 named crawlers have their own groups. Some get a short list of content paths with
Crawl-delay: 1; four (ActiveComplyBot, CriteoBot, GumGumBot, TaraGroup Intelligent Bot) are disallowed entirely.
That the detail pages are not blanket-disallowed is a statement about crawler etiquette, not permission. The Terms of Use prohibit automated queries on the Services whether or not robots.txt mentions the path, and robots.txt says nothing that overrides them. We do not treat any Allow line as a license.
What changes when you use an API
Calling a data provider moves the automated queries off your infrastructure, so you are no longer the party bypassing "captcha" or running crawlers against Zillow, and the blocking and fingerprint work becomes the provider's problem. It does not remove every question: the data's origin, what the provider's own terms let you store and redistribute, and the copyright on listing photos still apply. Consume structured facts; do not mirror Zillow's pages or gallery. The alternatives guide compares the options and the pricing comparison shows what they cost.
The risk ladder, practically
| Scenario | Practical risk profile |
|---|---|
| Personal project, a few hundred lookups | Mostly technical friction (blocks, CAPTCHAs). Legal attention is unlikely, though ToS still prohibit it. |
| Internal business tooling at moderate scale | Contract-claim exposure grows with scale and detectability; IP issues if photos/Zestimates are stored and redistributed internally at volume. |
| Commercial product republishing scraped Zillow content | Highest exposure: breach of contract, copyright on images, potential unfair-competition claims. This is the scenario that generates cease-and-desist letters. |
| Consuming a property data API under a commercial agreement | Normal vendor relationship: defined terms, support, and no bot-evasion arms race on your side. |
Where an API changes the picture
Using a data provider like APIllow doesn't make legal questions vanish — nothing does — but it changes your position in three concrete ways:
- You're not the one running automation against Zillow. The scraping-adjacent operational risk — bot detection, blocks, ToS friction — sits with the provider, whose business is managing it. You consume JSON under a normal commercial agreement with defined terms.
- You get facts, structured. Addresses, prices, beds, baths, price and sale history — the factual layer that valuation and analytics products are built on, without wholesale copying of Zillow's presentation.
- Reliability becomes a contract, not a hope. When Zillow rotates its bot detection (it does, regularly), that's the provider's 3 a.m. problem, not yours.
The pattern is the same one that played out with search data, social data, and financial data: an ecosystem of API providers absorbs the messy acquisition layer, and application developers build on top. Our comparison of Zillow data providers covers the current options.
Questions developers actually ask
"But the data is public — how can accessing it be wrong?"
Public visibility answers the CFAA question (per hiQ and Van Buren, no "gate," no unauthorized access). It does not answer the contract question — courts have repeatedly allowed breach-of-ToS claims to proceed against commercial scrapers — and it says nothing about republishing copyrighted photos.
"Zillow doesn't own home facts, right?"
Right. A sale price or square footage is a fact, and facts are not copyrightable (Feist v. Rural Telephone is the classic case). But Zillow's photos are copyrighted (usually by brokers/photographers, licensed to Zillow), and the Zestimate is Zillow's proprietary model output. Treating "facts are free" as a blanket license to mirror listing pages is how people get in trouble.
Is scraping Zillow illegal?
Scraping publicly accessible web data has generally not been treated as criminal hacking by US courts — the hiQ v. LinkedIn litigation is the best-known example. But Zillow's terms of use expressly prohibit automated access, so scraping Zillow can still create civil risk (breach of contract, and other claims depending on how the data is used). Legality depends on jurisdiction, method, and use — this is general information, not legal advice.
Does Zillow allow scraping?
No. Zillow's terms of use prohibit automated queries, scrapers, and bots, and Zillow enforces this technically with PerimeterX bot detection, CAPTCHAs, and IP blocking.
Does Zillow's robots.txt allow scraping?
Partly, and that is not the same as permission. On October 21, 2026 the * group disallowed /homes/ search pages (with exceptions for canonical list pages) and left /homedetails/ property pages without a blanket disallow, while named AI and ad crawlers sit in separate groups. robots.txt is a convention, not a law, and it does not override the Terms of Use, which prohibit automated queries. Ignoring it doesn't create criminal liability by itself, but it undercuts any "we acted in good faith" narrative and shows up in demand letters.
Is using a Zillow API instead of a scraper legal?
Using a provider is the lower-risk position, not a legal clean bill. You are no longer the one running automated queries against Zillow, and you consume JSON under a commercial agreement. You still have to respect the provider's terms on storage and redistribution, and listing photos remain their owners' copyrighted works. This is general information, not legal advice.
What is the safer alternative to scraping Zillow?
Most teams use a third-party property data API instead of scraping themselves. The provider handles data collection and its associated operational and compliance burden, and the developer consumes a clean JSON API under a normal commercial agreement.
Zillow API rules and regulations: what actually governs you
Developers often search for "Zillow API rules and regulations" expecting a compliance document. There isn't one to find, because there is no public Zillow API left to regulate — the program closed in 2021. What actually governs Zillow data access in 2026 is a stack of four things:
- Zillow's terms of use — the contract layer covered above: no scraping, no republishing listing content.
- Bridge Interactive's program — partner-gated, by application; terms not public, so there is no public rulebook to quote.
- US case law — hiQ, Van Buren, and the ToS-breach cases that define the civil and criminal boundaries for everyone else.
- Your provider's terms — if you use a third-party API, the terms that matter day-to-day are your provider's: what you may store, redistribute, and display. Whoever you pick, the constant is that listing photos remain their owners' copyrighted works — build on the data, don't republish the gallery.
The bottom line
Scraping publicly accessible Zillow pages is unlikely to be criminal under current US case law — but it violates Zillow's terms, it carries civil exposure that scales with your commercial footprint, and it commits you to an unwinnable maintenance war against a first-rate bot-detection stack. For anything beyond a weekend experiment, the boring answer is also the right one: get the data from an API under terms that let you build on it.
Skip the legal gray zone and the proxy bills
50+ property data fields per address, clean JSON, free tier to start. No scraping required on your side.
Get API Key