No scraping of login-walled content without ToS authorization

Authenticating as a user on platforms that prohibit scraping in their ToS — LinkedIn, Facebook, Twitter — bypasses access controls those platforms have implemented specifically to protect user data. This is not a legal gray area: GDPR Art. 6 requires a lawful basis for processing, and simulated session access provides none. CWE-284 (Improper Access Control) and OWASP A01 (Broken Access Control) both apply. Courts have found CFAA violations in cases involving credential-based scraping of platforms with clear no-scraping ToS. CCPA §1798.100 adds parallel liability for collecting personal information without a valid basis.

Remove all stored session cookies, login credentials, and authentication flows targeting scraping-prohibited platforms. Replace with official API integrations where available.

// Remove this pattern entirely from the codebase:
// const cookies = JSON.parse(fs.readFileSync('config/linkedin-cookies.json', 'utf8'))
// await page.setCookie(...cookies)

// Use the official API instead:
import { LinkedInAPI } from '@linkedin/api-client'
const client = new LinkedInAPI({ apiKey: process.env.LINKEDIN_API_KEY })
const results = await client.search({ keywords: query })

For platforms with no official API, restrict scraping to unauthenticated public pages that are not excluded by robots.txt. Document the legal basis in a data processing register before any scraping begins. Consult legal counsel on each platform's ToS before implementation.