Ask for Permission Later: The Unspoken Industry Rule No Web Scraping Engineer Dares to Write About

Recently, I was browsing through Tencent’s SkillHub out of curiosity.

I didn’t expect to find what I discovered—numerous skills and tools selling access to scraped data. You’ll find everything from Xiaohongshu (Little Red Book) trending post queries, WeChat Official Account popular article searches, to Douyin (TikTok China) hot topic data collection. While these tools claim to use third-party APIs, anyone with basic technical knowledge knows that WeChat Official Accounts have never provided public search APIs, Xiaohongshu hasn’t granted data authorization, and neither has Douyin.

So where does this data actually come from?

There’s only one explanation: it’s scraped by third parties who have reverse-engineered the platforms’ private APIs.

Notice how most of these skill developers don’t even leave contact information—just anonymous email addresses. These are clearly independent developers packaging reverse-engineered platform APIs into monetizable skills on SkillHub.

Technically speaking, the tools themselves are neutral.

Legally speaking, they exist in a gray area.

But here’s the surprising part: SkillHub allows them to be listed. Not only are they listed, but many have good ratings and high rankings.

Tencent certainly understands the nature of these tools—they know exactly what’s happening.

So why do they permit it?

Because SkillHub needs content. A newly launched platform needs to demonstrate utility to users. What’s most useful? Data analytics tools. WeChat content creators want to analyze trending posts, Xiaohongshu influencers want competitor insights—these are genuine market demands. When official APIs aren’t available, third parties fill the gap.

List the skills first, build the platform, and worry about compliance later.

Ask for permission after you’ve already boarded the train.

This approach isn’t unique to China’s internet ecosystem—it’s a global pattern. You implement the solution first and deal with potential issues afterward. If no problems arise, you never need to seek formal permission. If issues do emerge, you can negotiate retroactively.

Tencent itself operates this way. In March this year, they were publicly called out by the original author of OpenClaw for scraping ClawHub data. After four days of controversy, they resolved it by providing sponsorship funding. Yet shortly after this incident settled, their own platform openly featured these same data-selling skills.

Same logic, different context.

But you’re probably wondering: are these practices actually legal?

The honest answer is: it’s extremely ambiguous.

Web scraping occupies a legal gray zone in China. Who owns publicly accessible data? Does scraping publicly available website information constitute infringement? These questions lack clear legal answers in China, making it difficult to establish boundaries purely from a technical perspective. The determination often depends more on social impact than legal precedent.

However, U.S. case law provides clearer guidance: if you scrape data that requires authentication to access, you’ve crossed the line.

Which category do SkillHub’s tools fall into? Some scrape publicly available content, but many target authenticated content. Much of Xiaohongshu’s content requires login to view completely, and WeChat Official Account articles have access restrictions. This means these tools have already crossed the legal boundary.

So why isn’t anyone taking action?

It’s not because these practices are legal—it’s because the economics don’t justify enforcement.

Consider this scenario: Xiaohongshu discovers someone selling tools that access their data. Should they sue? Technically, yes. But let’s calculate the costs: legal fees, court expenses, time investment—potentially hundreds of thousands of dollars. Meanwhile, an independent developer selling skills earns minimal revenue. Even if you win the lawsuit, the financial recovery would be negligible compared to your legal expenses.

So as long as you stay small, nobody pays attention.

But what happens when you scale up?

When your user base grows, revenue increases, and your profile becomes prominent—you become a target. At that point, a cease-and-desist letter from the platform will arrive, and you won’t be able to withstand it. Unlike Tencent, you don’t have an in-house legal team or millions to spend on litigation. When they sue you, you can’t even afford to mount a defense.

There’s an even more critical issue: even if you somehow win the legal battle, you lose the war against time. Litigation drags on for a year or more, by which point your business has already collapsed.

This explains why these gray-market tools share a common characteristic: they never scale significantly, and they’re afraid to grow.

There’s a saying in China’s startup ecosystem: “Web scraping businesses can’t scale.” You can quietly earn some money, but you can’t build it into a legitimate, sustainable business. The moment you transition from “a single skill” to “a company,” or from “earning a few thousand monthly” to “earning tens of thousands monthly,” you’ll inevitably attract unwanted attention.

Tencent can scrape ClawHub data and resolve it with sponsorship money because they generate $600 billion in annual revenue. But as a small company or independent developer, you simply can’t afford that luxury.

This is the reality of operating in the gray area of web scraping.

The reason you’re not being targeted isn’t because you’re compliant—it’s because you’re too small to matter. The moment you grow, someone will be ready to shut you down.

Looking back at those data-selling skills on SkillHub, there’s nothing sophisticated about them. They’re simply small companies or independent developers making a living in the gray zone. Their current survival isn’t due to legality—it’s due to their insignificance. The moment they attempt to scale, they’ll be eliminated.

This is the industry’s unwritten rule—the real operating principle, not what’s written in legal textbooks.

Ask for permission later—but before boarding that train, consider carefully whether you’ll be able to get off once you’ve secured your ticket.