On August 24, 2026, lawyers from X Corp sent a cease-and-desist letter to the Nitter project — an open alternative frontend for X that had been operating for seven years. The demand was to take down not only all public instances but also the project's repository. The deadline was set for 5:00 PM EST on August 25. By the evening of the same day, nitter.net was offline, XCancel was taken down, and the developer announced that development had ceased.
On the surface, this appears to be just another story of "Musk shutting down another third-party client." However, the more significant aspect here is that X has stopped suing over scraping and has begun to apply pressure through letters — relying on laws that were previously almost nonexistent in such disputes.
What Exactly Happened
The letters were sent out on August 24 around 8:00 PM EST — to several instance operators, not just the project's author. The wording of the complaint was: "illegal use and circumvention of the X API and related data." Specifically, X accuses Nitter of scraping data from the platform, accessing accounts, and using session tokens in violation of service rules.
The developer, known by the nickname Zedeus, responded briefly: "nitter.net is offline, development is halted indefinitely. I am consulting with lawyers and will not comment on the details." A corresponding notice is posted on the project's website. XCancel — the most popular public instance operating on the Nitter codebase — also went offline.
The interval between the letter and the deadline was approximately twenty-one hours. For a non-commercial open-source project without a legal department, this means exactly one scenario: shut everything down and figure it out later.
Why Nitter Is Not Just a "Tweet Reader"
Nitter emerged as a port of the Invidious idea for Twitter: the server fetches public posts and delivers clean HTML to the user — without JavaScript, ads, trackers, or a login requirement. The practical value was not in "privacy for the sake of privacy," but in three key aspects.
- Embedability. A link to a post could be opened and previewed in a messenger, RSS reader, or wiki — without a session and without client-side JS.
- Research access. Journalists, fact-checkers, and OSINT specialists used instances as a way to view public accounts without leaving a trace in their own profile and without being subject to API limits.
- Cheap automation. Many small scripts, bots, and monitoring tools accessed not the paid X API but a public Nitter instance — because it was free and did not require keys.
It's the third point that is crucial to remember: a significant portion of the "data pipelines" surrounding X relied on infrastructure maintained by enthusiasts at their own expense.
The project's history had already shown how fragile this was. On January 26, 2024, X disabled the creation of guest accounts — the mechanism through which Nitter accessed public feeds. The last issued tokens expired on February 26, and the project effectively came to a halt; the author then directly called it dead. In early 2025, Nitter was revived: an alternative authorization scheme using session tokens was integrated into the codebase, and instances were operational again. It is these tokens that X now cites as a violation of the rules.
The Main Point: X Changed Its Legal Weapon
To understand the scale of this shift, one must recall how the previous attempt by X to litigate against data collection ended.
2024: Federal Court Dismissed X's Case
On May 9, 2024, Judge William Alsup (Northern District of California) dismissed X Corp's lawsuit against Bright Data — a major data provider that X accused of scraping and reselling public posts. Key points of the ruling included:
- X's claims under contract and state law are preempted by federal copyright law (Copyright Act preemption);
- The use of tools for data collection is not inherently illegal or deceptive;
- X does not automatically become the copyright holder of content simply because a user published it on the platform;
- Excessive control by platforms over public data leads to "information monopolies," which the court deemed harmful to society.
This ruling was the main argument for two years in favor of the notion that the collection of public data in the U.S. is protected — at least from lawsuits claiming "we own everything that is on our platform."
2026: Different Laws and No Court
In the letter to Nitter, X relies not on federal norms, which it lost against, but on a different set:
- Texas Harmful Access by Computer Act — § 143.001 of the Texas Civil Practice and Remedies Code along with § 33.02 of the Texas Penal Code. This provision allows for a civil lawsuit by anyone whose property has been harmed due to intentional unauthorized access to a computer, with compensation for actual damages and legal fees.
- Lanham Act — 15 U.S.C. §§ 1114 and 1125, which pertains to trademark infringement and misleading representation regarding the origin of a service.
Note the second point. Trademark law is no longer a dispute about data at all. It is a claim that a third-party service appears as X and is perceived by the user as X. Such an argument strikes at frontends and mirrors much more precisely than discussions about "who owns the posts."
The choice of Texas is also not accidental: X's headquarters has been located in Bastrop, Texas since September 2024 — this is documented in court filings and the company's updated corporate papers. The move provided the platform access to the local law on unauthorized computer access as a working tool.
Why the Letter Worked Where the Lawsuit Failed
The difference between the Bright Data case and the Nitter case is not in the law, but in the asymmetry of resources.
- Cease-and-desist does not require a court. This is a letter, not a lawsuit. No one verified the validity of the claim — it would be the defendant who would have to verify it, at their own expense and in a foreign jurisdiction.
- A twenty-one-hour deadline leaves no room for defense. Bright Data could afford a legal battle and won it. The author of Nitter physically cannot.
- The demand to take down the repository is broader than the demand to shut down the service. It targets not a specific instance but the possibility for anyone to bring it back online.
- The letters were sent in a wave. Instance operators are mostly private individuals, and each of them will arrive at the same decision.
Thus, we are not looking at a new legal basis, but a new tactic: not to win a dispute, but to make the dispute economically impossible for the other side.
What This Means for Data Collectors
A Third-Party Mirror Is Not Infrastructure
Nitter has gone offline for the second time in two and a half years: in February 2024 — technically, and in August 2026 — legally. Any pipeline that accessed a public instance instead of its own collector has broken twice during this time for reasons beyond the owner's control.
The practical takeaway is simple: a free wrapper over someone else's platform is a point of failure with an external owner. If data is needed for work rather than experimentation, collection should occur from your own infrastructure, with your control over limits, retries, and load distribution. How this applies to X has been discussed in a separate article about safe data collection from X through proxies.
"Public" and "Behind a Login" Are Legally Different Stories
The most unpleasant aspect of X's complaint is not scraping per se, but the use of session tokens. Alsup's ruling protected access to what the platform provides to everyone without logging in. Once collection occurs through an authorized session, the argument of "these are public data" ceases to hold: an agreement with the user, service rules, and the question of how the token was obtained come into play.
Hence, the working rule: separate two contours in your project — what is available anonymously and what requires an account. These involve different legal risks, different technical stacks, and different requirements for the network layer. The general framework for legal collection is described in the article about legal use of proxies.
Jurisdiction Has Become a Variable
Previously, the risk map for scraping in the U.S. revolved around the CFAA and the practices surrounding it. The Nitter case shows that a platform can choose the state law of its registration — and this changes both the norms and the statutes of limitations, as well as the court. For teams working with American platforms, this means that "we looked at federal case law" is no longer a complete check.
Where the Access Market Is Heading
The story with Nitter fits into the overall trend of recent months, and this is more important than a single case:
- Reddit is consistently closing free pathways to content and warning of "changes" in the old interface — how this affects data collection has been discussed in the article about Reddit API limits;
- More than 340 local American publications have restricted Internet Archive's access to their materials — according to Nieman Lab, out of fear that content will end up in training datasets;
- Cloudflare, starting September 15, 2026, is changing defaults for AI crawlers, categorizing them into Search, Agent, and Training, and blocking the last two categories by default on advertising pages;
- On July 23, 2026, a bipartisan Stealth Bot Prohibition Act was introduced in Congress, which will require crawlers to honestly identify themselves and disclose the purpose of their crawling.
The direction is clear: anonymous unauthorized access to the public web is being squeezed from all sides — technically, contractually, and legislatively. Those who collect data predictably, from their own infrastructure and within the platform's rules will prevail, rather than those who parasitize on someone else's free gateway.
Practically, this means that load must be distributed fairly and carefully: respect limits, avoid hitting an endpoint with a single IP, and spread requests across geography and time. For tasks requiring access from regular user addresses — monitoring public output, checking localization, research collection — this means residential proxies; for stable and cheap access to one's own services and open sources, data center proxies are sufficient.
Conclusion
Nitter is unlikely to return: unlike in 2024, the problem now is not technical, and a patch will not resolve it. However, the case is useful not as an obituary, but as an indicator.
Firstly, platforms have realized that litigation is costly and risky, and have shifted to letters with short deadlines — against those who will not respond. Secondly, state laws and trademark claims have come into play instead of federal norms regarding computer access. Thirdly, any dependence on someone else's free mirror must now be assessed as a dependence on someone else's legal risk.
If your project includes a step "we take data from a public instance of X" — this is a good moment to locate it in the code and replace it with your own collector with a clear network architecture and a solid legal basis.