Post on AI Companies and "Hacking" Hits 205 Points and 164 Comments on Hacker News

Mortoray's post "Why aren't AI companies being charged for hacking?" collected 205 points and 164 comments on Hacker News. The question in the title is simple. A person who bypasses the protections on someone else's server risks criminal charges. Companies whose bots have spent years pulling content from websites against their wishes raise investor money without trouble. A caveat: our feed contains only the headline, the link, and the discussion metrics, so we do not summarize the author's arguments. Below is the legal and practical context for the question itself.

Why the hacking statute doesn't apply

The main US tool here, the Computer Fraud and Abuse Act of 1986, has long been narrowed by case law. In Van Buren v. United States (2021), the Supreme Court limited the concept of "exceeding authorized access" and effectively adopted a "gates up or down" logic. If a page is available to any visitor without a password, it is hard to treat retrieving it as hacking. The Ninth Circuit confirmed the same line in hiQ v. LinkedIn: scraping public profiles is unlikely to violate the CFAA. hiQ still lost later, but on contract grounds, for violating the terms of service.

robots.txt is even weaker. The Robots Exclusion Protocol was standardized as RFC 9309 in 2022, but it remains an understanding among well-behaved participants. The file itself has no legal force. A bot that ignores it breaks etiquette, not a statute.

Where the disputes actually are

Tellingly, lawsuits against AI companies are built on other grounds:

• New York Times v. OpenAI and Microsoft (December 2023): copyright.
• Bartz v. Anthropic: a $1.5 billion settlement in 2025; the claim concerned pirated copies of books.
• Reddit v. Anthropic (June 2025): violation of terms of use, not hacking.
• In August 2025, Cloudflare accused Perplexity of evading bans by changing its user-agent. Perplexity denied it.
• Since July 2025, Cloudflare has blocked AI crawlers by default for new domains and is testing a pay-per-crawl model.

It turns out that lawyers steer clear of the CFAA. Copyright and contracts give more predictable outcomes, while on the question "is this hacking?" the courts have so far not ruled in plaintiffs' favor. That is the community's central complaint: the technical reality, where a site explicitly said "no" and the bot came back anyway, does not match the legal one.

What site owners can do right now

Waiting for the laws to change is pointless; today's defense is technical and documentary.

1. Keep request logs and track bot behavior: request frequency, IP ranges and ASNs, and mismatches between the declared user-agent and actual traffic. 2. Enable rate limiting and WAF rules at the CDN level. Many providers offer ready-made lists of known AI crawlers. 3. Prohibit automated data collection in your terms of use. Successful lawsuits are built on exactly this kind of contract violation, as in the hiQ case. 4. Keep robots.txt up to date, but don't count on it as protection. For content that has a price, use authentication or paid access. 5. Preserve evidence of ban evasion, in particular header changes and address rotation. If the case reaches court, this is the foundation of your position.

This article is not legal advice, and case law differs between jurisdictions. Still, the Hacker News discussion shows that the problem has long outgrown a spat between bloggers and is being discussed in the industry at a level where it can no longer be ignored.