Effectively it forces scrapers to become a party to the terms of service, which usually contains the "no programmatic access (other than via paid API)" or specifically prohibits automated scraping.
If it's auth-gated, it needs to be, well, authenticated.
The person who provides that, and the subsequent automated scraping, is the party, and would be the recipient of a civil suit.
AFAIK, there isn't an single auth scheme on earth that guarantee human intervention[1]. Anyone can set-up a robot creating new users on a whim using single-use email addresses and even phone numbers. In fact, we know that OpenAI's agent have been doing exactly that when attacking Rubygem. And all AI labs are likely doing it for scrapping social media as well.
Who are you gonna sue then?
[1] the closest thing is Altman iris scanning venture, but without a broad adoption it's remains functionally useless.
> No different from "if I roll a car down a hill and it hits something at the bottom, how can you hold the car liable?"
That's the difference between criminal and civil justice. You don't need to sign a law for it to bind you, but for contracts you do.
But terms of service are contracts which you sign by agreeing.
Courts have looked somewhat favorably on "I didn't read that" defenses, but accepting the agreement is a legal contract between you and the service provider.
The authentication mechanisms used by websites don't have a specific legal power, it's just a POST request among other GET requests sent during scraping. And we have jurisprudence saying scrapping is legal no matter what the ToS of the website says, because the scraping entity never signed up the contract.
The only protection against scrapping that auth is giving you isn't a legal one, it's a technical one (you can detect and ban the scraping user account).
Patently false: https://en.wikipedia.org/wiki/Implied-in-fact_contract
> Who are you gonna sue then?
The person who set up the robot.
If that was true, then all scraping of a website with a ToS would be illegal, yet it's established by jurisprudence that it's not. And “authentication” doesn't change the picture here in Amy way, because it's not actually authentication.
Because terms of service require both parties to accept!
If I hold a contract outside your window and scream "you accept this contract" it doesn't bind you simply by looking out the window.