Google sues SerpApi over search scraping in copyright lawsuit

Google filed a federal lawsuit on December 19, 2025, against Texas-based SerpApi LLC for systematically circumventing technological protections to scrape copyrighted content from Google Search results. The complaint alleges violations of the Digital Millennium Copyright Act through billions of automated queries that bypass security measures designed to protect licensed material appearing in search features like Knowledge Panels, Google Shopping, and Google Maps.

The 13-page complaint filed in the United States District Court for the Northern District of California names SerpApi as defendant in case number 25-10826. Google seeks statutory damages ranging from $200 to $2,500 for each circumvention act, along with injunctive relief to halt the scraping operations. Given that SerpApi processes hundreds of millions of automated search requests daily, the potential liability extends into astronomical territory relative to the company's reported annual revenue of a few million dollars.

Central to the lawsuit is Google's SearchGuard technology, a protection measure that launched in January 2025 after "tens of thousands of person hours and millions of dollars of investment." SearchGuard sends JavaScript challenges to search queries from unrecognized sources, requiring browsers to transmit specific information proving requests originate from human users rather than automated systems. While legitimate users' browsers solve these challenges seamlessly, automated scraping tools typically cannot access search results and the copyrighted works within them.

SerpApi founder Julien Khaleghy established the Austin-based company in 2017 after concluding that "scraping images from Google was an intensive process." The business model centers on appropriating output from services that invested substantially to generate it, then delivering that content to third parties for a fee through paid subscription tiers. SerpApi advertises its "Google Search API" as a way to "Scrape Google," offering specialized services targeting Knowledge Graph blocks, Google Shopping listings, and Google Maps data.

The complaint describes how SerpApi developed circumvention methods immediately after SearchGuard's January 2025 deployment effectively blocked the company's access to Google's search results. Khaleghy recently characterized the process as "creating fake browsers using a multitude of IP addresses that Google sees as normal users." These techniques involve misrepresenting device information, software details, or location data when responding to SearchGuard challenges, or syndicating legitimate authorizations across unauthorized machines worldwide to enable automated queries appearing as authorized traffic.

Google licenses copyrighted content specifically to enhance search results and strengthen competitive positioning. Knowledge Panels display high-resolution images obtained through copyright licenses, as illustrated in the complaint with a Willie Mays photograph. Google Shopping features merchant-supplied product images and descriptions, while Google Maps incorporates various terrestrial pictures, business-supplied imagery, and user-generated reviews. The complaint emphasizes that SerpApi takes this licensed content without permission or compensation to rights holders, disrupting Google's content partnerships and threatening relationships with licensors.

SerpApi's scraping operations impose both fixed and marginal costs on Google's infrastructure to process queries that generate no revenue offset. The Terms of Service Agreement expressly forbids automated access to search content "in violation of the machine-readable instructions on our web pages (for example, robots.txt files that disallow crawling, training, or other activities)." Google's robots.txt instructions clearly indicate that Search results should not be crawled by automated systems.

The technical sophistication of SerpApi's circumvention appears in the company's own marketing materials. A recent blog post explained that SearchGuard had made web scraping "more difficult," but claimed the company was "fortunate to be minimally impacted" because services had "already pre-solved Google's JavaScript challenge." When Google subsequently increased SearchGuard difficulty, SerpApi acknowledged brief interruptions but "thanks to the dedicated efforts of our engineers we were quickly able to resolve the problem." The company promised continued circumvention regardless of future protections: "It's hard to say what Google might do going forward. However, at SerpApi we're confident in our ability to handle any new variations to these changes Google might introduce."

The complaint alleges SerpApi's circumvention violates Section 1201(a)(1)(A) of the Copyright Act, which prohibits circumventing technological measures controlling access to copyrighted material. Each circumvention act carries statutory damages between $200 and $2,500. Additionally, Section 1201(a)(2) violations stem from manufacturing, offering, providing, or trafficking in services designed to circumvent technological measures. SerpApi boldly markets these capabilities, promising customers they "don't need to care about … captcha, IP address, bots detection, maintaining user-agent, HTML headers, [or] being blocked by Google" because the company uses "advanced algorithms to bypass CAPTCHAs and other anti-bot mechanisms, ensuring uninterrupted and efficient data extraction."

Google estimates SerpApi's query volume has increased as much as 25,000 percent over the past two years, now reaching hundreds of millions of automated search requests daily. This massive scale amplifies both the direct infrastructure costs Google bears and the broader competitive harm from making licensed content available to services that need not incur similar licensing expenses.

The lawsuit represents the second major legal action against SerpApi this year. Reddit sued SerpApi on October 22, 2025, along with Oxylabs, AWMProxy, and Perplexity AI, for circumventing both Reddit's anti-scraping measures and Google's SearchGuard system to scrape Reddit content from Google search results pages. That 41-page complaint described defendants as "similar to would-be bank robbers, who, knowing they cannot get into the bank vault, break into the armored truck carrying the cash instead."

The scraping controversy unfolds amid broader industry tensions over content access and AI training data. Penske Media Corporation filed an antitrust lawsuit against Google on September 12, 2025, alleging the search giant coerces publishers into providing content for AI systems without compensation while reducing website traffic. That complaint examined how Google's AI products—including Bard, Gemini, Search Generative Experience, AI Overviews, and AI Mode—rely on large language models trained on massive text corpuses scraped from publisher websites.

Publishers rallied against unauthorized AI scraping at an IAB Tech Lab summit in July 2025, with over 80 media executives gathering in New York to address what many consider an existential threat to digital publishing. The meeting included representatives from Google and Meta alongside industry leaders confronting AI companies that scrape publisher content without consent or compensation. Research data presented showed over 35 percent of top websites now block OpenAI's GPTBot, while HUMAN Security documented 107 percent year-over-year increases in scraping attacks.

Google's legal strategy against SerpApi differs from previous scraping disputes by emphasizing copyright protection rather than contract violations or terms of service breaches. The DMCA framework provides statutory damages that could theoretically exceed SerpApi's ability to pay given the massive number of alleged violations. The complaint acknowledges this reality, stating that "SerpApi will be unable to pay" the statutory damages award despite "orders of magnitude higher" liability that grows with hundreds of millions of additional violations daily.

Halimah DeLaine Prado, General Counsel at Google, emphasized the company's commitment to protecting content partners in the December 19 announcement: "We fled a suit today against the scraping company SerpApi for circumventing security measures protecting others' copyrighted content that appears in Google search results. We did this to ask a court to stop SerpApi's bots and their malicious scraping, which violates the choices of websites and rightsholders about who should have access to their content."

The complaint describes SearchGuard as working primarily through JavaScript challenges that validate queries originate from real users rather than automated software. For human users, browsers run the JavaScript code and send required information seamlessly without disrupting experience. Automated systems submitting queries at massive scale typically cannot solve the SearchGuard challenge, resulting in denied access to Google's search results and copyrighted works within them.

SerpApi operates through multiple deceptive techniques according to the complaint. When submitting automated queries and receiving SearchGuard challenges, the company may misrepresent the device, software, or location from which queries are sent to solve challenges and obtain authorization. Alternatively, SerpApi may solve challenges with legitimate requests then syndicate resulting authorizations, sharing them with unauthorized machines globally to enable fake browsers generating automated queries appearing authorized to Google. The company also uses automated means to bypass CAPTCHAs, another SearchGuard component testing users to ensure they are humans rather than machines.

The lawsuit seeks multiple forms of relief beyond monetary damages. Google requests the court to enjoin SerpApi from violating Section 1201 by circumventing technological measures or by designing, manufacturing, marketing, selling, or trafficking in any technology designed to circumvent such measures. The complaint also seeks to compel destruction of any technology, device, or product involved in Section 1201 violations, along with costs, attorneys' fees, prejudgment and post-judgment interest.

Google's investment in SearchGuard reflects broader platform security priorities amid escalating automated threats. The company has implemented similar protective measures across its ecosystem, though each faces circumvention attempts from sophisticated actors. The platform updated crawler verification processes in March 2025 to provide daily IP range refreshes rather than weekly updates, addressing feedback from large network operators concerned about potential Googlebot impersonation.

The case presents technical questions about how courts will interpret DMCA protections when applied to search engine security measures. Traditional Section 1201 cases often involve circumventing access controls for entertainment media like DVDs or video games. Applying the same framework to protect dynamically generated search results containing third-party copyrighted content represents a novel legal approach that could establish precedent for platform protection measures.

SerpApi's business operations extend beyond Google scraping to encompass multiple search engines and platforms. The company advertises APIs for Amazon, Bing, DuckDuckGo, eBay, Walmart, Yelp, YouTube, and numerous other services. This diversified portfolio suggests potential vulnerability to similar legal challenges from other platforms investing in anti-scraping technologies to protect copyrighted content and commercial relationships.

Industry observers note the lawsuit's timing coincides with intensifying regulatory scrutiny of data scraping practices. Amazon blocked AI bots from major tech companies in August 2025, updating its robots.txt file to prohibit crawlers from Meta, Google, Huawei, Mistral, and other technology firms. The e-commerce giant maintains a $56 billion advertising business built around shoppers browsing its marketplace, with third-party AI tools that bypass Amazon's storefront potentially undermining both website traffic and advertising revenue streams.

Google's complaint emphasizes harm extending beyond direct infrastructure costs to include undermining investment in licensed copyrighted content, threatening relationships with content licensors who expect protection against misappropriation, and forcing substantial expenditures developing and enhancing technological measures protecting against unauthorized scraping. These multifaceted damages arguments support both actual damages recovery and statutory damages election under DMCA provisions.

The legal theory rests on SearchGuard qualifying as a technological measure that "effectively controls access" to copyrighted works within the meaning of Section 1201. The statute requires that technological measures, in their ordinary course of operation, necessitate application of information to gain access to protected works. Google argues SearchGuard meets this standard by requiring authorized information transmission to access search results and copyrighted content they contain.

SerpApi's marketing materials provide extensive evidence supporting Google's claims. The company explicitly advertises circumvention capabilities as its core service offering, distinguishing itself from competitors through superior ability to bypass platform protections. This brazen approach may strengthen Google's case by demonstrating that SerpApi designed and marketed services with knowledge they would circumvent technological measures, satisfying Section 1201(a)(2) requirements.

The complaint notes that at least one Google content partner, Reddit, already sued SerpApi for misconduct related to unauthorized content access. Reddit's October lawsuit described how defendants bypassed two security layers—Reddit's anti-scraping measures and Google's SearchGuard system—to access and scrape Reddit content from search results. That parallel litigation establishes pattern of conduct demonstrating SerpApi's systematic approach to circumventing platform protections across multiple targets.

Timeline

• 2017: SerpApi founded by Julien Khaleghy after concluding "scraping images from Google was an intensive process"
• January 2025: Google deploys SearchGuard technology to protect search results from automated scraping
• January 2025: SerpApi begins developing circumvention methods after SearchGuard blocks access to Google search results
• September 2025: Penske Media files antitrust lawsuit against Google over AI content coercion
• October 22, 2025: Reddit sues SerpApi, Oxylabs, AWMProxy, and Perplexity AI for circumventing security measures
• December 19, 2025: Google files lawsuit against SerpApi in Northern District of California

Summary

Who: Google LLC filed the lawsuit against SerpApi LLC, a Texas-based company founded by Julien Khaleghy in 2017 that provides automated web scraping services through API subscriptions. The complaint was filed by Google General Counsel Halimah DeLaine Prado through Wilson Sonsini Goodrich & Rosati attorneys.

What: The lawsuit alleges SerpApi violated the Digital Millennium Copyright Act by circumventing Google's SearchGuard technological protection measures to scrape copyrighted content from search results pages. SerpApi allegedly processes hundreds of millions of automated queries daily, misrepresenting device information and syndicating authorizations to bypass security challenges designed to distinguish human users from automated bots.

When: The complaint was filed December 19, 2025, in federal court, following SearchGuard's January 2025 deployment and SerpApi's immediate development of circumvention techniques. Google estimates SerpApi's scraping volume increased as much as 25,000 percent over the past two years.

Where: The case was filed in the United States District Court for the Northern District of California as case number 25-10826, targeting SerpApi's operations from its Austin, Texas headquarters that affect Google's Mountain View, California operations and content licensing relationships.

Why: Google seeks to protect copyrighted content licensed from third parties that appears in Knowledge Panels, Google Shopping, and Google Maps features. The lawsuit aims to stop unauthorized appropriation of licensed material, preserve content partner relationships, recover infrastructure costs from processing automated queries, and establish legal precedent for platform protection measures under DMCA provisions.