Not an expert but there was a court ruling in the US I think last year where circumventing login protection through bot operated accounts when the login is inte

Not an expert but there was a court ruling in the US I think last year where circumventing login protection through bot operated accounts when the login is intended for human use was ruled as violation of CFAA. The current state of litigation in the US seems to be that scraping public facing data/websites has been considered as permissible by the courts but data behind a login intended for humans is not. I think there's still a split between the circuits, so this will go through some years of appeal yet.