Reddit v. SerpApi: The DMCA Ruling That Reached a Scraper's Customer
On July 31, 2026 a New York federal judge let Reddit's DMCA anti-circumvention claims against SerpApi and Perplexity go forward, treating Google's SearchGuard as an access control. What survived, what didn't, and why Google's own suit over the same lock went the other way.
Reddit doesn't own the lock in this case. It doesn't run the search results page that SerpApi is accused of reading, and it doesn't own most of the words on that page either: its users do. On July 31, 2026 a federal judge let it sue under the DMCA anyway, and let it sue the AI company at the end of the chain as well as the scraping service in the middle.
The case is Reddit, Inc. v. SerpApi LLC, Oxylabs UAB, AWMProxy and Perplexity AI, Inc., No. 25 Civ. 8736 in the Southern District of New York, before Judge Paul A. Engelmayer. This post works from the 63-page opinion and order itself; page numbers below ("Op. 47") point into it. It's the sequel to our post on Google's own suit against SerpApi, which is about the same anti-bot system, SearchGuard, and which went the other way eleven days earlier. Everything below describes what the parties allege and what a court decided on a motion to dismiss, where the judge has to accept the complaint's facts as true. None of it is a finding that anyone did anything, and none of it is legal advice.
What Survived on July 31, and Against Whom
Reddit's First Amended Complaint pleads three DMCA claims and three New York common-law claims. Only two defendants, SerpApi and Perplexity, moved to dismiss in this round, and the court ruled claim by claim. In the opinion's words, it "predominantly denies the motions" (Op. 2, 62). Pick a defendant below to see where each stands.
5 survived · 5 dismissed · 2 not ruled on
- §1201(a)(1)(A)Circumventing an access control · SerpApiSurvived
Snippets plausibly copyrightable, SearchGuard plausibly an authorized access control, and proxies, rotating IPs and fake user agents plausibly 'avoid' or 'bypass' it. [Op. 33–50]
- §1201(a)(2)Trafficking in an access-control bypass · SerpApiSurvived
With the work and the access control found, only the 'designed or marketed' element was left, and SerpApi did not dispute it. [Op. 50–51]
- §1201(b)(1)Trafficking in a copy-control bypass · SerpApiDismissed
SearchGuard blocks automated access but, as pled, does not control what a user does once in, so it is not a copy-control measure. [Op. 51–53]
- Unjust enrichmentNew York common law · SerpApiDismissed
Preempted: at bottom it aims to stop bulk copying, a right the Copyright Act already covers; circumvention is only the means. [Op. 54–57]
- Unfair competitionNew York common law · SerpApiDismissed
Preempted: its core is misappropriation of copyrighted content, and alleged bad faith is not an 'extra element'. [Op. 57–59]
- Civil conspiracyNew York common law · SerpApiSurvived
The DMCA violation is the underlying tort, and an agreement to circumvent is an extra element copyright law doesn't have. [Op. 59–62]
- §1201(a)(1)(A)Circumventing an access control · PerplexitySurvived
As pled, Perplexity set the circumvention parameters and ran the queries itself: 'more than a bystander' to SerpApi's circumvention. [Op. 47–50]
- Unjust enrichmentNew York common law · PerplexityDismissed
Preempted by the Copyright Act, for the same reasons as against SerpApi. [Op. 54–57]
- Unfair competitionNew York common law · PerplexityDismissed
Preempted by the Copyright Act, for the same reasons as against SerpApi. [Op. 57–59]
- Civil conspiracyNew York common law · PerplexitySurvived
Plausibly pled: an advertised SerpApi customer that paid for and used the tool, and kept going after Reddit's cease-and-desist letter. [Op. 60–62]
- Claims against OxylabsNot part of the July 31 motions · OxylabsNo ruling yet
Only SerpApi and Perplexity moved in this round. At an October 1 conference the judge reportedly said he was unlikely to grant Oxylabs' own motion to dismiss. [Inner City Press]
- Claims against AWMProxyNot part of the July 31 motions · AWMProxyNo ruling yet
The opinion makes no ruling on AWMProxy, and we found no public report of its position in the case. [Op. 2]
Two things stand out before the details. First, the survivors are the federal anti-circumvention claims and a conspiracy claim built on them; everything that looked like a copyright claim in state-law clothing was dismissed as preempted (Op. 53–59). Second, the AI company didn't escape as a mere buyer of data. The court held that, as pleaded, Perplexity "is thus more than a bystander to, or a downstream beneficiary of, SerpApi's circumvention" (Op. 47).
The threshold fights went Reddit's way too. SerpApi argued Reddit had no standing because it isn't the copyright owner of user posts and doesn't operate SearchGuard. The court found concrete injury in Reddit's copyright in posts it wrote itself, in reputational harm (deleted posts that, it alleges, live on through scraping) and in lost licensing revenue (Op. 12–25). And it read the DMCA's "any person injured" language to cover Reddit, not only copyright owners (Op. 25–32), much as the Google order had done for Google.
The Chain Reddit Describes
Perplexity's first motion to dismiss drew Reddit's theory as a chain running from Reddit users to Reddit, then Google, then the other co-defendants, and only then Perplexity (Perplexity's memorandum, p. 4). Step through it below. Every step is an allegation in the amended complaint as the opinion recounts it, not a fact a court has found.
- Reddit licensed Google programmatic access to its content in a February 2024 partnership. Brief snippets of posts, up to a few sentences, appear in Google's results (Op. 5–7).
- Since January 2025, SearchGuard sends unrecognized sources a JavaScript challenge or CAPTCHA that automated systems can't solve in the ordinary course. SerpApi's tool allegedly gets past it 'using a proxy and the latest technologies to mimic human behavior' (Op. 7, 9).
- Customers set location, language and filters, and get the results back as structured fields: titles, links and snippet text. SerpApi lists Perplexity as a customer (Op. 8–10).
- Perplexity allegedly runs the queries itself and puts the results into a retrieval database that feeds its answers, including Reddit posts (Op. 10).
- Reddit says it planted a post with an uncommon hexadecimal string, served it to Google only, and Perplexity returned its contents within hours (Op. 11).
5 steps. Press Play to walk through them, or click any part of the diagram.
Two more allegations sit behind that chain. Reddit says that after a 2024 cease-and-desist letter, Perplexity's citations to Reddit rose 40-fold, and that in a two-week period in July 2025 SerpApi accessed more than one billion Google results pages containing Reddit data (Op. 11, 18). Those numbers are Reddit's, from its complaint, and nothing has tested them yet.
Three Rules Packed Into Section 1201
Most of the opinion turns on three neighbouring provisions of 17 U.S.C. § 1201, and they're easy to blur. In plain terms:
- §1201(a)(1)(A), using a bypass. "No person shall circumvent a technological measure that effectively controls access" to a copyrighted work. This one targets the person who goes around the lock.
- §1201(a)(2), selling or supplying a bypass for an access lock. Nobody may "manufacture, import, offer to the public, provide, or otherwise traffic in" a technology, product or service that is primarily designed for, has little other commercial use than, or is marketed for circumventing an access control.
- §1201(b)(1), selling or supplying a bypass for a copy lock. The same trafficking ban, but for measures that protect a copyright owner's rights, such as copying, after someone already has access.
The Second Circuit's summary, which the court quotes, draws the line: (a)(2) is about technologies "designed to prevent access to a work," and (b)(1) is about technologies "designed to permit access to a work but prevent copying" (Op. 52, quoting Corley). Step through how the opinion sorted the defendants into those boxes.
- SearchGuard is a 'process' required to gain access: it 'erects a gate' that human users open seamlessly and automated users can't (Op. 37).
- SerpApi made the tool and, as pleaded, used it too: rotating IP addresses, fake user-agent strings and a 'server-swarm' avoid or bypass the gate. That supports (a)(1)(A) and, undisputed on design and marketing, (a)(2) (Op. 44–51).
- Perplexity allegedly set the operational inputs and ran the queries itself, so it is pleaded as a direct circumventor under (a)(1)(A), not just a buyer of the output (Op. 47–48).
- Reddit pleaded nothing about SearchGuard limiting what a user does after access. If blocking access were enough, every access control would also be a copy control, which the statute's structure rules out (Op. 51–53).
4 steps. Press Play to walk through them, or click any part of the diagram.
The Perplexity holding is the one with reach. Perplexity argued that the DMCA has no secondary liability and that it was at most a downstream recipient. The court didn't reach the secondary-liability question, because it read the complaint as pleading direct circumvention: "SerpApi made the circumvention tool, and Perplexity used it to circumvent" (Op. 47). It also noted that if a customer in Perplexity's position couldn't be liable under (a)(1)(A), it was unclear who could be, apart from those already covered by (a)(2) (Op. 47–48).
The Trafficking Claim, Element by Element
The (a)(2) claim is the one aimed squarely at a scraping vendor's business, so it's worth seeing how little was left to argue about by the time the court reached it. The court built the elements while deciding (a)(1)(A): a protected work, a measure that effectively controls access (which itself needs a process and the copyright owner's authority), then circumvention. For (a)(2) it carried the first two over and asked only whether the tool was designed or marketed for circumvention (Op. 33, 50–51). Switch an element off to see where the claim would have failed.
The trafficking claim survives the motion to dismiss. Every element is plausibly pleaded, so the claim goes to discovery. That is not a finding of liability.
- A work protected by copyrighthandled
Fails if: The scraped snippets aren't copyrightable, as in Google's case for results with no copyrighted content. What the court found: at least some Reddit snippets, often several sentences, plausibly clear the low originality bar; the short-phrases rule covers one to four words (Op. 33–36).
- Access control: a processhandled
Fails if: The measure leaves the work freely readable, like the printer code in Lexmark. What the court found: SearchGuard's challenge is a process that admits humans and blocks bots, like facial recognition that opens a door for residents only (Op. 36–40).
- Access control: the owner's authorityhandled
Fails if: No facts show the copyright owner authorized the measure, the gap in Google's complaint. What the court found: users authorized Reddit to protect their content, and Reddit plausibly authorized Google to protect it, even without naming SearchGuard (Op. 40–44).
- Designed or marketed to circumventhandled
Fails if: The tool has real uses other than circumvention and isn't sold for it. What the court found: SerpApi did not dispute this element (Op. 50–51).
The authority layer carries the most weight, and one detail from oral argument shows why. Perplexity's counsel pointed out that SearchGuard didn't exist until January 2025, almost a year after the Reddit–Google deal, so the contract couldn't have required it. The court answered that §1201 doesn't require the copyright owner to authorize the specific measure: requiring fresh permission for each new CAPTCHA or encryption scheme would be "unrealistic in a rapidly evolving technological landscape" (Op. 42–43, n.21). A broad authorization to protect the content was enough at this stage.
The same footnote lists "CAPTCHA challenges, encryption, passwords, and robot.txt files" as measures companies invent to control access and prevent scraping. That's a passing description, not a holding, and it sits awkwardly beside the Ziff Davis v. OpenAI ruling from the same courthouse, which held that robots.txt is not a measure that effectively controls access. Read it as dicta, not as a change in the law.
Same Lock, Different Plaintiff
The obvious question is how SearchGuard can support Reddit's claims in New York when Google's claims over the same system were dismissed in California eleven days earlier. The answer isn't that the courts disagreed about SearchGuard. Both treated it as the kind of process that controls access, and both found circumvention plausibly alleged (Op. 37, 45, citing the Google decision). They split on what sat behind the lock and who had authorized it.
- Dismissed; without leave to amend for results with no copyrighted content, with leave for results with a copyrighted component
- Claims under 1201(a)(1)(A) and (a)(2), brought by the company that runs SearchGuard
- Results with no copyrighted content: not a protected work, so the claims fail as a matter of law
- Knowledge Panel images: no facts showing the copyright owners authorized SearchGuard
- (a)(1)(A) and (a)(2) survive; conspiracy survives
- (b) dismissed: SearchGuard pleaded only as an access control
- Claims under 1201(a)(1)(A), (a)(2) and (b), brought by the platform whose posts appear in the results
- Snippets of user and Reddit posts: plausibly copyrightable
- Reddit's user agreement and Google deal: plausible authority to protect the content
Verdict: Same lock, different keys to the case: Reddit pleaded the copyrighted work and the owner's authority that Google's complaint lacked.
Judge Engelmayer drew the contrast himself. Google's complaint relied on a bare allegation that it "licenses copyrighted works," with no facts about the licence terms; Reddit's amended complaint alleged that its agreement with Google limits Google's own use of Reddit data and requires protection against unauthorized third-party access (Op. 43–44). That's a pleading difference, and it's why the two outcomes can sit side by side. It's also why neither is a ruling that scraping search results is lawful or unlawful: both are decisions about whether a complaint said enough to proceed. Our Google v. SerpApi post follows that case, where Google amended its complaint in August.
Why the Proxy Companies Are in the Caption
Two of the four defendants are proxy providers: Oxylabs UAB and AWMProxy. The opinion says very little about them. It reports Reddit's allegation that Perplexity or its agents contracted with "one or more of SerpApi, Oxylabs UAB, and AWMProxy to circumvent SearchGuard and other TPMs" (Op. 11), and it decides nothing for either, because neither was part of these motions. So any claim that the ruling makes proxy networks liable goes beyond what the court has said.
What the opinion does show is where IP rotation sits in the analysis. The conduct the court counted as circumvention, as pleaded against SerpApi, is largely the toolkit proxy networks sell. Here is that request path as the complaint describes it; the payloads are placeholders, because the court record we read shows none.
5 messages. Press Play, or pick one, to see exactly what is sent.
Three things follow from the record, and no more. First, the court held that circumvention doesn't require decrypting anything: the statute's "avoid, bypass, remove, deactivate, or impair" covers a tool that mimics human traffic, as pleaded (Op. 45). Second, §1201(a)(2) reaches anyone who will "provide, or otherwise traffic in any technology, product, service" that meets one of its three tests, and whether a general-purpose proxy network meets them is a question no court in this case has answered. The opinion's (a)(2) holding is about SerpApi's tool, and it turned on SerpApi not disputing that element. Third, the remaining layers are live: at an October 1 conference, according to Inner City Press, Oxylabs argued points ranging from the EU's GDPR to the DMCA's reach, and the judge said he was unlikely to grant its motion to dismiss. That's a reported remark from the bench, not a ruling. We found no public report of AWMProxy's position.
From Pleadings to Discovery
The case has moved since the opinion. SerpApi answered on August 28 and filed antitrust counterclaims, monopolization and attempted monopolization counts under Section 2 of the Sherman Act, alleging that from July 1, 2024 Reddit served Google a robots.txt that allowed crawling and served other crawlers one that didn't (PYMNTS, PPC Land). At the October 1 conference, Inner City Press reported, discovery was set to proceed into Reddit's agreement with Google and how Perplexity scrapes, and discovery into the antitrust claims was not stayed.
- Oct 22, 2025Reddit files suit
DMCA and New York law claims against SerpApi, Oxylabs, AWMProxy and Perplexity.
Complaint - Jan 2, 2026First motions to dismiss
SerpApi argues standing and that SearchGuard isn't an access control; Perplexity argues it circumvented nothing.
SerpApi memo - Feb 6 – Mar 13, 2026Amended complaint and new motions
Reddit files its First Amended Complaint; SerpApi and Perplexity move to dismiss it.
Opinion - Jul 20, 2026Google v. SerpApi dismissed in California
A separate court dismisses Google's SearchGuard claims for want of a protected work or pleaded authorization.
Order - Jul 31, 2026Motions predominantly denied
1201(a)(1)(A), 1201(a)(2) and civil conspiracy survive; 1201(b), unjust enrichment and unfair competition dismissed.
Opinion - Aug 28, 2026SerpApi counterclaims
An answer plus Sherman Act Section 2 counterclaims over Reddit's Google-only crawler access.
PYMNTS - Oct 1, 2026Conference on discovery
Discovery proceeds, antitrust discovery isn't stayed, and the judge signals Oxylabs is likely staying in.
Inner City Press - Next · pendingOxylabs' motion, the counterclaims, discovery
Inner City Press also listed a conference date of April 5, 2027. A motion-to-dismiss ruling decides nothing about liability, damages or an injunction, and the judge, by that report, expected this case to be harder to settle than backward-looking disputes.
Check Your Reading
Q1Why did the court dismiss Reddit's Section 1201(b) claim against SerpApi?
Q2Both courts treated SearchGuard as an access-control process. What did Reddit plead that Google's complaint lacked?
Q3On the pleadings, what made Perplexity a direct circumventor rather than a downstream buyer?
What survived
- 1201(a)(1)(A) circumvention against SerpApi and Perplexity.
- 1201(a)(2) trafficking against SerpApi; it didn't dispute the designed-or-marketed element.
- Civil conspiracy against both, with the DMCA as the underlying tort.
What fell
- 1201(b): SearchGuard was pleaded as an access control, not a copy control.
- Unjust enrichment and unfair competition: preempted by the Copyright Act.
The three rules
- (a)(1)(A): don't go around an access control.
- (a)(2): don't make, offer or supply a tool built or sold to go around one.
- (b)(1): the same supply ban for measures that protect copying and other rights after access.
Versus Google v. SerpApi
- Both courts treated SearchGuard as controlling access and circumvention as plausibly alleged.
- Google lacked a protected work or pleaded authority; Reddit pleaded both.
For scraping teams
- Rotating IPs and fake user agents were treated as plausibly bypassing an access control, as pleaded.
- A customer that sets parameters and runs queries can be pleaded as a direct circumventor.
- Proxy providers are named but nothing has been decided about them yet.
