The New York legislature has passed a bill requiring anonymous crawlers to identify themselves, and the EFF warns that the text harms researchers, journalists and security professionals far more than the AI systems it claims to target.
The Electronic Frontier Foundation published on 20 July 2026 a critical analysis of the NY Stealth Crawler Protection Act, the bill passed by the New York state legislature and now on the desk of Governor Hochul. The proposal would make it illegal to operate an anonymous crawler on news sites without disclosing the operator’s identity and all possible future uses of the data collected, and would allow websites to obtain court orders to unmask anyone using unidentified tools, even in the absence of evidence of any legal violation.
According to the EFF, the core problem is the definition of “stealth crawler” itself: the label sounds alarming, but it simply describes automated tools that access public data without declaring the identity of whoever operates them. These tools power some of the most publicly valuable activities that the open web makes possible. The Markup, a non-profit outlet, used anonymous crawlers to document potentially anticompetitive practices by Amazon, identifying itself to servers as ordinary Firefox browsers to replicate the experience of a typical user. ProPublica used a similar automated tool to reveal that Amazon was directing shoppers toward more expensive products over cheaper alternatives. Cybersecurity professionals use anonymous scraping to monitor the web for threats. Privacy tools, including the EFF’s own Privacy Badger, run anonymous scans to identify trackers without exposing users.
The technical point raised by the EFF is direct: the problem the law claims to address is not anonymity but excessively aggressive crawling that overloads servers. Those two things are not the same. Unmasking a crawler does not reduce the traffic it generates; technical measures targeting harmful conduct would be more proportionate instruments. The New York bill, instead, grants publishers the power to block not only malicious actors but also researchers, journalists, activists and anyone who has not paid a licence fee to read public text. Facebook has already demonstrated how that power is exercised: in 2021 the platform shut down the accounts of researchers studying disinformation with automated tools and sought removal of their published findings.
The dynamic reflects a recurring pattern in digital surveillance policy: legislation designed to constrain large technology actors ends up hitting those with the fewest resources to resist. The same mechanism appeared in the European debate over the scanning of encrypted communications, where measures framed as protecting vulnerable users risked dismantling the protections those same users rely on anonymous tools to obtain.
The EFF expects similar proposals in other states and, potentially, at the federal level. The text of the NY Stealth Crawler Protection Act remains on Governor Hochul‘s desk awaiting signature or veto.
