A scraper is republishing your listings: what actually stops it, and what doesn't
The listing that comes back under someone else's name
An advertiser writes in confused, sometimes angry: their photo and phone number are live on a site they never signed up for, dressed up in someone else's layout and branding. A customer calls support asking why "your other site" charges differently. A search for one of your own city pages turns up a copy, sometimes ranking above the original. None of this starts with a security breach. It starts with a script that reads your public pages the same way a browser does, at a scale no human visitor ever would, and saves what it finds.
Classifieds directories are an easy target for this because the content is already structured for it. Every listing sits in a predictable place: city, category, price, photo, phone number, a short block of text. A scraper does not need to understand what it is reading, only where to look, and a site organized by city and category hands that structure over for free. The same organization that makes a directory easy for a customer to browse makes it easy for a script to harvest.
The motive on the other end is rarely admiration. Some operators running a copy want the traffic your pages already earn, republishing your listings under a near-identical layout so a search result points to them instead of you. Others are building a lead database to resell phone numbers and photos to a third party with no relationship to the person in either. A smaller number are running something closer to a scam: a mirror page that looks like a real listing but routes contact or payment somewhere else entirely, using a real advertiser's name and photo to lend the page credibility it hasn't earned.
Whatever the motive, the harm lands in two different places at once, and they call for different fixes. One is the search ranking and traffic a copy can siphon away from the original page. The other is what happens to the advertiser whose photo and number are now sitting on a site they never agreed to appear on, with none of the moderation or takedown process you built for your own platform. Treating this only as an SEO nuisance misses the second half of the problem, and it is usually the half that generates the angrier email.
The lever that doesn't work anymore
The instinct many operators reach for first is to treat scraping as a break-in: the scraper accessed a computer system it had no right to touch, so this must be a matter for hacking law. In the United States that law is the Computer Fraud and Abuse Act, and for about a decade a 2013 ruling against the aggregator 3Taps seemed to support that instinct. A federal court found that Craigslist's cease-and-desist letter combined with an IP block against 3Taps had turned otherwise public access into access "without authorization," opening the door to a CFAA claim.
That reading did not hold up nationwide. In 2021 the Supreme Court decided Van Buren v. United States, narrowing the CFAA to a "gates up or gates down" test: either a person has access to a given area of a system or they don't, and what they do with that access once inside does not change whether they exceeded it. The Ninth Circuit, the court covering California and much of the US tech industry, applied that logic to scraping the next year, ruling for a second time in hiQ Labs v. LinkedIn that pulling data from pages that require no login is not access "without authorization" under the CFAA, even after the scraped site had sent a cease-and-desist letter demanding it stop. That ruling came at the preliminary stage, and the case itself ended in a settlement months later rather than a full trial, but its reasoning on the CFAA question has not been overturned and is still what courts in that circuit follow.
The line that still holds is the one between a public page and anything behind a login. A separate Ninth Circuit case, Facebook v. Power Ventures, found that a cease-and-desist letter combined with an IP block did create CFAA liability for a scraper who kept going, but only because the data sat behind a password, not on a page anyone could load without an account. A classifieds listing meant to be found by search engines sits on the public side of that line; an advertiser's private dashboard does not, and a scraper that found its way into the second kind of page is in different legal territory than one copying the first.
For an adult classifieds directory this matters directly, because the listings a scraper wants are almost always the public-facing ones. That rules out the shortcut operators most often reach for first, at least for the pages visible to any visitor. It does not mean nothing can be done; it means the next two sections, not a hacking complaint, are where the real options sit.
What actually works in the United States: copyright does the heavy lifting
The clearest US precedent on what a scraping dispute is actually worth in court came out of two Craigslist cases from 2017, and the detail that matters is not the headline number, it is the breakdown behind it. Craigslist won a $60.5 million default judgment against the real-estate site RadPad after RadPad went insolvent and stopped contesting the case: roughly $20.4 million of that was for copyright infringement, $40 million came from CAN-SPAM violations tied to about 400,000 unsolicited emails sent to scraped users, and only $160,000, a sliver of the total, was for breach of contract over the terms of service RadPad had agreed to by using the site. A separate case the same year, against the car-listings site Instamotor, settled for a $31 million stipulated judgment plus an order to destroy every scraped record and stop scraping for good.
Two things follow from that breakdown. First, both of these were effectively uncontested wins against companies that were already failing, not proof that a working business can expect to collect a comparable sum from a live competitor who intends to keep fighting; treat the dollar figures as a measure of what a court will award on paper, not a realistic recovery plan for a small directory. Second, and more useful, is what did the actual work inside that judgment: copyright over the listing photos and text, not the terms-of-service claim and not any theory about unauthorized computer access.
That makes copyright the lever worth using. If your platform's terms assign or license the content advertisers post to the operator, rather than leaving all rights with the advertiser alone, you can send a takedown notice to the scraper's hosting provider demanding the copied pages come down, and a separate removal request to the search engines indexing them, without needing to prove anything about how the scraper obtained the material. Hosts that ignore a properly filed notice risk losing their own legal protection for hosting infringing content, which is usually enough to get a response even from a host with no interest in cooperating otherwise. This is the mirror image of a false copyright claim pulling your own listing out of search results: there you are defending against someone else's notice, here you are the one filing it, and the same process runs in both directions.
A breach-of-contract claim over your terms of service is worth having in reserve, mainly because a documented notice naming specific pages creates a paper trail that strengthens any later action, but do not expect it to carry a case on its own. It was worth a few hundred thousand dollars inside a multimillion-dollar judgment built mostly on copyright, which is a fair reflection of how much weight it can carry by itself.
Europe's different route, and the privacy problem hiding underneath
Outside the US, several European jurisdictions protect something copyright does not reach directly: the database itself. Under EU law, a systematically compiled database that represents a substantial investment, which a classifieds directory with thousands of structured listings clearly is, can carry its own protection separate from whether any individual listing is creative enough to qualify for copyright on its own. A scraper who extracts and reuses a substantial part of that database can be liable regardless of whether any single page it copied would pass a copyright test by itself.
A French property-listings case shows what that looks like in practice, in a different sector but under the same legal theory a classifieds directory could use. The aggregator app Jinka was ordered to pay the site SeLoger 60,000 euros in December 2025 over automated extraction of its listings, then ordered to pay leboncoin 200,000 euros in April 2026 for reusing its listings without authorization, with the court treating both platforms' listings as a protected database. A third ruling in July 2026 went further, finding Jinka's own advertising slogan, which claimed to cover every listing site in one app, a misleading commercial practice. None of this required proving the scraper broke into anything; the claim turns on what was taken and reused, and on what the scraper's own marketing claimed, not on how the data was accessed.
The piece that gets lost if you treat this purely as a ranking problem is what a copied listing actually does to the person in it. An advertiser chose your site, under your moderation rules, your verification process and your own removal path if they change their mind. None of that exists on a mirror they never agreed to appear on, and finding out their photo is sitting on an unfamiliar site, possibly attached to a scam booking page using their name, is a different kind of harm than a dip in search traffic. The same duty that applies when a photo ends up online without the person in it agreeing to it does not stop applying just because a scraper did the posting instead of an ex-partner or a stranger; the advertiser did not consent to this placement any more than to that one.
What to do, in order
Start by making copying provable before you need to prove it. A unique tracking number on each listing's contact path, or a small variation in phrasing between otherwise similar ads, turns "this looks similar" into a comparison a host or a court can check in minutes.
Triage before you chase anything. A mirror with no traffic and no complaints is not worth staff time; one that outranks your own page, or one your advertisers are calling about, is. Decide which category a report falls into before deciding what to do about it.
For the ones worth acting on, lead with copyright. Confirm your own terms actually give the platform standing to send a takedown over advertiser-posted content, then send the notice to the host, not just the scraper's visible contact address, and file a separate removal request with the search engines indexing the copy. This moves faster and costs less than any lawsuit.
Keep a cease-and-desist and a technical block, such as a basic rate limit or a blocked IP range, as a documented second step rather than the whole plan. It will not win a hacking claim on its own anymore, but the record it creates supports whatever comes next, and it slows down a scraper who ignores the takedown.
Finally, tell the advertiser as soon as you find their listing mirrored elsewhere, before they find it themselves. Offer to help them get it removed, log what you found and what you did about it, and fold that log into the same record-keeping you already maintain for verification and deletion requests. A scraper you cannot fully stop is still a problem you can show you took seriously, and that difference is what an advertiser, and eventually a regulator, will actually remember.
