Robots.txt is not legally binding. It's a voluntary standard established in 1994 that well-behaved search engines and crawlers respect by convention, not legal obligation. Google, Bing, and legitimate bots follow it because they want to be good web citizens and maintain relationships with site owners, but nothing in Canadian or international law compels them to do so. Malicious scrapers, content thieves, and spam bots routinely ignore robots.txt directives. If someone wants to scrape your site, a robots.txt file won't stop them any more than a "No Trespassing" sign stops a determined burglar. The file is publicly accessible at yoursite.com/robots.txt, which means bad actors can read exactly what you're trying to hide and use that as a roadmap to restricted content. The legal angle gets complicated when you combine robots.txt with Terms of Service. In some U.S. cases, courts have ruled that violating a site's ToS after being blocked by robots.txt could constitute unauthorized access under the Computer Fraud and Abuse Act. LinkedIn won a case against hiQ Labs partly on these grounds, though the legal precedent remains murky. Canada doesn't have equivalent federal legislation with the same teeth. From a practical standpoint at Ottawa SEO, we treat robots.txt as a communication tool for legitimate crawlers, not a security measure. If you need to actually protect content, use authentication, paywalls, or server-level access controls. We've seen clients accidentally block entire site sections in robots.txt thinking it would hide sensitive data, only to discover Google had already cached it or scrapers had already copied it. The file is most useful for managing crawl budget on large sites, preventing indexation of duplicate content, and blocking resource-heavy bot traffic that follows the rules. Just never assume it's a legal shield or technical barrier. It's a polite request that good bots honor and bad bots laugh at.