Robots.txt is a technical directive, not a legal contract. Search engines like Google, Bing, and other reputable crawlers honor it as an industry standard, but they're under no legal obligation to do so. A bot operator who ignores your robots.txt isn't breaking the law simply by crawling disallowed paths. That said, context matters. In some cases, ignoring robots.txt has led to legal consequences under computer fraud laws (like the Computer Fraud and Abuse Act in the U.S. or similar statutes in Canada). Courts have occasionally ruled that circumventing access controls, including robots.txt combined with other measures, constitutes unauthorized access. The hiQ Labs v. LinkedIn case initially leaned the other way, but legal interpretation remains inconsistent. From a practical standpoint, robots.txt works because major players respect it. Google will not index pages you disallow in robots.txt, though it may still list the URL without a snippet if it finds links pointing to it elsewhere. If someone scrapes your site despite robots.txt restrictions, your recourse is typically through terms of service enforcement, rate limiting, IP blocking, or proving damages under applicable computer misuse laws, not the robots.txt file itself. At Ottawa SEO, we treat robots.txt as a crawl management tool, not a security measure. If content must stay private, we put it behind authentication or use noindex meta tags and password protection. We use robots.txt to manage crawl budget, block low-value sections like /cart or /admin from search engines, and guide bots toward priority pages. We never rely on it to protect sensitive data, because anyone can read your robots.txt file and see exactly what you're trying to hide. Bottom line: robots.txt is respected by legitimate crawlers but carries no inherent legal weight. It's a gentleman's agreement in code form. If you need legal protection, layer in real access controls and clear terms of service.