Reddit v. SerpApi: circumvention, not CFAA
On July 31, 2026, the federal district court for the Southern District of New York largely denied SerpApi’s and Perplexity’s motion to dismiss Reddit’s suit. The dispute is brought not under the Computer Fraud and Abuse Act (CFAA), as in Amazon v. Perplexity, but under Section 1201 of the DMCA - the ban on circumventing technological protection measures. For those building agents and collecting data for AI, this is the second signal this summer about where courts draw the line, and it runs in a different place.
What the case is
The plaintiff is Reddit, Inc. The defendants are SerpApi LLC, related scraping providers, and Perplexity. Case No. 1:25-cv-08736 is before the federal district court for the Southern District of New York, Judge Paul Engelmayer. The decision of July 31, 2026 was issued on the defendants’ motion to dismiss, that is, at the Rule 12(b)(6) stage.
What the accusation is
As Reddit alleges, SerpApi and related providers circumvented Google SearchGuard, CAPTCHA and bot-detection systems, extracted Reddit content from Google search results, and Perplexity purchased or used that data. Reddit brought claims under the DMCA and under state law.
What the court decided
| Claim | Outcome |
|---|---|
| DMCA § 1201(a)(1)(A), circumvention of an access control, against SerpApi and Perplexity | Survives |
| DMCA § 1201(a)(2), trafficking in circumvention tools, against SerpApi | Survives |
| Civil conspiracy | Survives |
| DMCA § 1201(b), circumvention of copy-protection measures | Dismissed |
| Unjust enrichment and unfair competition under state law | Dismissed |
The key distinction in the decision: SearchGuard can be an access control measure even if a person sees the same content in a browser. But it is not necessarily a measure that controls subsequent copying, so the § 1201(b) claim did not survive.
How this differs from Amazon v. Perplexity
In the Amazon dispute with Perplexity, the courts examined who accesses the platform’s servers under the CFAA: the user, the agent, or the agent’s provider. In the Reddit case the question is framed differently: were technical measures restricting access to content circumvented, and who took part in that circumvention. To answer under § 1201 there is no need to prove unauthorized entry into a computer system in the CFAA sense. It is enough to show circumvention of a protection measure and participation in a common scheme.
Hence the second difference. In the CFAA dispute, liability was sought from whoever performed the actions. Under the DMCA the risk also arises for the buyer of the data if it knew about the circumvention and participated in the scheme. Perplexity did not scrape in the Reddit case itself, but the claim against it survives.
What the decision means and what it does not
| Question | Answer from the text of the decision |
|---|---|
| Did the court find that circumvention occurred? | No. At the 12(b)(6) stage the facts in the complaint are taken as true; circumvention and liability on the merits have not been established |
| Was Perplexity found to be an infringer? | No. The court only held that the claims against it are pleaded sufficiently for the case to continue |
| Are CAPTCHA and bot detection access control measures under the DMCA? | The court allowed that characterization for SearchGuard at this stage; there is no final conclusion |
| Is the buyer of data always liable? | No. The claim survived on the allegation that the buyer knew about the circumvention and participated in the scheme |
| Is the case over? | No. It continues; a decision on dismissal is not a final judgment |
What this means for agent developers and data collectors
The architectural argument from the CFAA disputes - the actions are performed by the user’s local client and the cloud only advises - does not work on its own under the DMCA. If a CAPTCHA, bot detection or another access-restricting measure stands in the way of the content, circumventing it may be a violation regardless of whose hands did it. Three practical consequences:
- inventory which technical measures stand on the data sources and record that the agent does not circumvent them;
- when buying data from third parties, check how it was obtained and fix that in the contract, because knowledge of circumvention shifts the risk to the buyer;
- distinguish access control measures from copy control measures: the court treated them differently, and that distinction will work in the next cases.
For Lexometrica the conclusion is the same as after the Amazon case: data sources for court analytics must have a documented and reproducible path of acquisition without circumventing anyone’s restrictions. The difference is that now one must check not only the question of access but also the question of circumvention.
Sources
- Opinion & Order of July 31, 2026: text
- S.D.N.Y. rulings of special interest: court website
- Analysis of the decision: Loeb & Loeb, Law360
- Journal entry on the CFAA dispute: Amazon v. Perplexity: agent architecture and CFAA