Is It Legal to Scrape Starbucks? Store Locator and App Data in the US

Can you legally scrape Starbucks store locations and menu prices? What the CFAA, hiQ v. LinkedIn, terms of use and app licences mean for US store and app data.

Starbucks runs close to 17,000 stores in the United States, and it publishes the details of every one of them: address, opening hours, drive-thru, which stores take mobile orders. Its app shows the menu and the price each store charges. Rival chains, site-selection teams and analysts want that data in a spreadsheet, not a map. The question they ask first is whether collecting it is legal.

The short answer: collecting public, logged-out facts such as store locations, hours and prices carries low legal risk in the US, and the leading appellate ruling, the Ninth Circuit's in hiQ v. LinkedIn, indicates that the main federal hacking statute likely does not cover it. Some risk remains: Starbucks' terms of use forbid automated access, the app comes with its own licence, and how you collect matters as much as what you collect. This guide walks through each layer.

This article explains the US legal landscape in general terms. It is not legal advice; talk to a lawyer about your own project.

Two sources, two different questions

Starbucks data comes from two places, and they raise different issues.

Store records are the easier case. Menus and prices are where most of the commercial value sits, because prices differ by store, and that is also where the app's licence comes in.

The CFAA: public data is not "without authorization"

The Computer Fraud and Abuse Act makes it a crime to access a computer "without authorization" or to "exceed authorized access". For years companies argued that scraping against their wishes did both. Two decisions narrowed that reading.

In Van Buren v. United States (2021), the Supreme Court read "exceeds authorized access" as a gates-up-or-down question: are you entering a part of the system you are not allowed into? Misusing information you are otherwise allowed to see is not enough.

In hiQ Labs v. LinkedIn (9th Cir., 2022), the Ninth Circuit applied that logic to scraping. LinkedIn profiles that anyone can view without logging in have no gate to go up or down, so scraping them is likely not access "without authorization" under the CFAA, even after the site sends a cease-and-desist letter.

For Starbucks, the store locator and the logged-out menu are exactly that kind of public data. No password, no account, nothing anyone has to get past. On the CFAA alone, collecting them carries little risk. The risk returns if a scraper logs in, uses someone else's account, or gets around a technical block.

Terms of use: a contract, not a crime

After losing the CFAA argument, websites turned to contract law.

Starbucks' terms of use ban "any automated system", naming robots and spiders, from accessing its sites and content. The terms are governed by Washington State law and send most disputes to individual arbitration. Breaching them is not a crime, but it can be a breach of contract.

Whether those terms bind a scraper depends on whether the scraper ever agreed to them. Courts treat two kinds of terms differently:

• Clickwrap: you clicked "I agree", for example when creating an account. Courts usually enforce these.
• Browsewrap: the terms sit behind a link in the footer and nobody clicks anything. Courts often refuse to enforce these against someone who never saw them.

Two cases show where this lands for logged-out scraping. After the Ninth Circuit ruling, hiQ still lost on contract grounds in the district court, because hiQ had agreed to LinkedIn's user agreement through accounts it operated. In Meta v. Bright Data (N.D. Cal., 2024), the court went the other way: Meta's terms covered people using Facebook and Instagram as users, and did not stop Bright Data from collecting public data while logged out. Meta dropped its remaining claims weeks later.

Collect logged out, never through an account that accepted the terms, and the contract argument gets much weaker. Log in, and you are likely bound.

Store data is not personal data

US privacy laws, led by California's CCPA, regulate personal information about consumers. A store's address, phone line and opening hours describe a business, not a person. Starbucks store data contains no customer information, no reviews tied to named users and no employee details.

That keeps store and menu collection outside the privacy rules that make scraping social networks or review sites far harder. If a source does mix in personal data, such as reviewer names or staff listings, leave those fields out.

Facts are free, creative text is not

Copyright protects creative expression, not facts. The Supreme Court settled that for compilations in Feist v. Rural Telephone (1991): a phone directory's names and numbers are facts anyone may copy. Store addresses, hours, prices and calorie counts are facts in the same sense.

Some of what Starbucks publishes is creative work, though: product photos, marketing descriptions, the brand itself. A dataset of prices per store is fine. Republishing Starbucks' menu photography or copying its product copy wholesale is a different matter, and so is using the Starbucks name or logo in a way that suggests endorsement.

What changes with the mobile app

Per-store menus and prices live in the app, and the app brings issues the website does not.

Installing it means accepting its licence, which makes a contract claim easier to argue than one based on a website footer. Collecting through an account that accepted those terms carries the clickwrap risk described above.

Apps also tend to protect their traffic. Breaking encryption or defeating a technical protection measure can raise issues under the DMCA's anti-circumvention rules, separate from anything in the terms. Reading the requests the app makes in normal use involves no lock at all.

Then there is load. An app's backend is sized for phones, and a scraper that floods it can turn a contract dispute into a claim for harm to the servers, so rate and timing matter more here than anywhere else.

We cover how app collection works in practice in how mobile app scraping works.

A practical checklist

If you collect Starbucks store or menu data yourself, these habits keep the risk low:

1. Stay logged out and collect only what anyone can see without an account.
2. Never get around a block: no bypassing CAPTCHAs, IP bans or encryption.
3. Keep the load low by spreading requests out and avoiding peak hours.
4. Take facts such as locations, hours, prices and calories. Leave photos and marketing copy alone.
5. Leave personal data out. None should be there; if some appears, drop it.
6. Do not imply endorsement: no Starbucks logo, no "official" wording.
7. If Starbucks objects to your collection, get legal advice before you continue.

Or skip the scraper

Most teams do not want to maintain a scraper against a store locator and an app that change without notice. Our Starbucks data scraping service delivers every US store as a clean dataset, with a free 500-store sample, and collects per-store menus and prices from the app through our mobile app scraping infrastructure, following the practices above.