How big a deal is blocking copy-pasting on a website?

Question

I'm working on a website on which the client wants to disable copy-paste.

It's not to do with security or passwords, but that the data on display is valuable if taken en masse (and almost no value if taken singly), though the user can only access the data one at a time. (There is no page a user can access with multiple items.)

I have advised that this is probably bad UX, and that it won't block screenscrapers or similar, but at the end of the day it's his decision.

How much of an impact does blocking this functionality have on a website? Is it likely to turn off users from engaging, or is it a non-entity and I am putting too much value in this?

If it's a big deal, do you have any recommendations on how to advise the client?

The client knows it won't stop even semi-skilled or determined individuals but wants to stop any casual attempts to retrieve data. I'm minded to just show him some of these answers in response.

Answer 1

Ask your client what he's actually trying to accomplish.

Copy-paste restrictions are about as effective as a toddler gate preventing access to an unmonitored garden in a remote area.

Perhaps you could ask the client where he saw copy-paste restrictions being used. Then, while he's there (or via screen share) show him how you'd defeat it.

When the client says:

"Yeah, but you're a professional hacker/coder/computer/nerd"

Then search the internet for:

"Why can't I copy text on a website"

If the goal is to inconvenience people, or if the information isn't extremely valuable... blocking copy-paste may be useful.

You may think that there's no legitimate reason to copy a piece of content, but then you forget use-cases like people using translators. They will copy a word or a phrase and pop it into their translator program... and no, not always Google translate.

I wouldn't rule out copy-blocking, but point out that it a copy-hurdle, not a copy-block and if someone wants the information, it's relatively easy to get access to it.

Answer 2

Disabling copy/paste likely won't stop many people that really want the data, but it may cause inconvenience to users that have a legitimate reason to copy/paste from the site.

Given that users will have to navigate page by page to get the data (I assume the complete dataset is fairly large), I'd be more concerned about people scraping your content than people manually copy-pasting. I highly recommend reading this great article outlining how to prevent scraping. In it, when talking about copy-paste, the author states:

Human copy - and - paste: People will copy and paste your content in order to use it elsewhere. Unfortunately, there's not much you can do about this.

Indeed, a simple google search shows that disabling copy-paste has many work arounds.

When talking to your client, I would try showing them how disabling copy/paste can be worked around, and talking to them about web scraping (and ways to prevent it) as it's the more likely avenue for acquiring the data.

Answer 3

These commands are part of the bedrock of user experience. They are some of the very few commands that work across nearly all applications and contexts, and removing them is far more likely to have a negative impact on user experience and task abandonment.

In his article on generic commands (IE commands that stay consistent across multiple contexts), Jakob Nielsen has this to say about cut/copy/paste:

The cut-copy-paste triad offers the most famous example of generic commands. These 3 basic commands suffice to let users do everything from move text to edit movies. In fact, because they work across so many applications, I view them as " super-generic commands."

The first guidelines for generic commands are:

• If at all applicable to your domain, your application should support the super-generic commands that people expect and know from other applications.
• In particular, provide cut-copy-paste commands for moving stuff around.

Answer 4

As a security professional, I disagree that

It's not to do with security

You are trying to prevent sensitive information from leaving its intended context (the web browser). By definition, this is an information security issue and should be treated as such.

---

Putting on my security hat, let's frame this as a security problem.

Asset to protect: content of the web pages.

Threat model: user extracting the data from the browser, perhaps to a file on disk.

Mitigation: disable copy&paste.

But does that really mitigate the threat? The usual rule-of-thumb for this is that if a user has read access in one context, then they copy the information into a different context - almost regardless of what type of read access or what type of context. For example, if they can load the web page, then they can write a script to fetch all pages and dump them to a file.

In practice the game of restricting the copy of information is a spectrum, from weakest security model to strongest:

• Free to make digital copies.
• Digital copies are possible, but tricky to do.
• Digital copies restricted (usually because it's a non-internet closed network), but cell phone photos can be taken of the screen.
• Cell phones are not permitted in the building, but pencil&paper copies can be made.
• Paper is not permitted to leave the building, employees are searched on their way out. You better have a good memory.

Basically this is a game of making the information harder to acquire than it's worth - a deterrent at best. At some point it's more cost-effective to do extra screening on who's allowed to access the information and rely on good ol' fashion trust & loyalty.

---

Bottom line: disabling copy&paste raises the bar for copying the information, but certainly does not prevent it. Your client needs to view this as a security issue, and apply a security mindset. IMO disabling copy&paste is one of those security theatre things that management can feel smug about, causes a great deal of inconvenience to users, yet does absolutely nothing to prevent skilled hackers.

There's also a running joke over at security.stackexchange called AviD's law of security:

Security at the expense of usability comes at the expense of security.

since users who find your security too onerous will always find dumb workarounds.

Answer 5

Your goal is to block bulk copying of text. To do this, you need to throttle scrapers, not remove accessibility elements from humans.

Blocking copy/paste means disabling the context menu.

That means you lose all contextual control, including accessibility ones like "google this", "translate this", etc; and social media options like "share this" and "copy link URL".

Options like "open in new tab/window" become unavailable unless they know the hotkey.

Accessibility extensions which use rightclick as part of their key-combo (image zoom, etc) are also affected.

I dunno about you, but I always hate websites like this because they conflict with how I use the web. I have to turn off JS just to use them properly, and then the sites often rely on JS just to function, because the kind of knuckledragging mouthbreather who uses copy/paste blocking to prevent bulk theft by scrapers, usually doesn't get the importance of graceful degradation.

Most importantly though: Google is a disabled reader. If you harm accessibility, you risk harming SEO.

Now, I don't know of any evidence that this particular accessibility problem gets you dinged by Google... but simply bringing up the possibility is enough for most clients back down on this issue.

Answer 6

tl;dr

Don't bother

---

This doesn't solve the problem

The usability aspect is irrelevant.
Does a user accessing your data want to copy and paste it to gain value? Rarely.

The security aspect is irrelevant.
Does a data thief want to show up with a mouse, click, drag, copy, and paste to steal your value. Never.

I understand how your product owner came to this position: navel gazing. There is probably zero real data behind the decision. Just fear and insecurity.
Maybe because InfoSec / Engineering didn't adequately address the implications.
Maybe because this person is arrogant and irrational.

In either case, it is wasted engineering that leads to slightly frustrating experience and zero real world security.

Answer 7

The company, in which I used to work, disallowed cut&paste from "across the bubble" between our vnc based working environment, and our public email, documentation, QA and diagnostics environments -- for so called "security" reasons. The key words here are "used to work". I think our productivity took a 90% drop the first month, and was still down by 30% half a year later.

Result was that that it took away a standard simple way we worked for years, required people to adopt less successful working procedures, and pissed off the entire staff. Migration out of the company to a sharp rise. Product was delayed and eventually flushed, and entire team is working elsewhere. One question that often gets asked when we run into another these days is "does you current management enforce those crazy policies like we had back in the good old days" The answer us universally no.

In my opinion, the management adopted a set of policies that they did not understand for reasons that were totally wrong, and thus upsetting the entire balance and trust in their leadership skills.

I know this sounds like a long winded answer to you question, but either get your managers heads screwed on right, or it's time to start looking at for another job.

If I ever run into a site that inhibits basic features like cut&paste, I will move to another site.

Answer 8

There are two minor (or not so minor) other annoyances to users that you will create, due to breaking the principle of least astonishment.

Especially on "noisy" webpages, some people use double clicking and thus marking of non-link text as a reading aid, similar to keeping track of your current line with your finger in a dead-tree book.

Many people use the "google search for..." right-click feature found in multiple modern browsers to further research things found in the text.

Also, evidence of intrusive and clumsy javascript (anything that blocks browser features or pops up dialogs when such is not expected) tends to make people feel unsafe with your page open (too much experience with sloppily written pages that suddenly blare autoplay into your headphones, sabotage your back button or overload your browser into unresponsiveness) - minimizing the visit length.

Answer 9

Plenty of other answers here have covered in depth as to why blocking copy/paste is generally frowned upon, so I'm not going to bother reiterating. Instead I'm going to make a suggestion, and try to deconstruct why your client is intent on pursuing this Sisyphean task.

If your client wants to prevent the user from performing a single copy/paste operation to copy all the data... then have them paginate the data (which it sounds like they're already doing?). Make the user click "Next" a couple of times to see it all, and if they're paranoid about crawlers collecting it all anyways, a simple CAPTCHA for each page or every couple of pages will put a stop to that. This still imposes an inconvenience on legitimate users, but is at least not blocking the context menu and its various legitimate uses.

The crux of the issue boils down to your client's perception of the data's value. You say it's "very valuable" en masse, but of almost no value when taken singly. If there actually is non-trivial financial gain to be had from collecting all the data, someone determined enough will copy it, even if it means copy/pasting individually (including from source code, scraper, etc) and aggregating it on their side. If, as your client seems to believe, copy/pasting individually makes it no longer worth the effort, then the aggregate data really can't be that valuable; the data is the sum of its parts, nothing more, nothing less.

At the end of the day, once that data arrives on a user's computer, there's nothing your client can do to stop them from copying it; if it can be rendered on the screen, it can be copied -- even if that means having someone sit in front of a computer displaying the data and manually transcribing it onto a laptop or tablet. Pretty much any barrier you put up to raise the difficulty of copying will also hinder legitimate users to some degree as well -- including pagination.

Answer 10

A determined thief would never use Copy / Paste, they would use a scraping tool to crawl the site and extract content in an automated way directly into their database.

If it's the organised theft of huge swathes of content your client wishes to prevent, this measure will therefore be totally pointless.

Disabling Copy / Paste will prevent isolated end-users from grabbing snippets of content in a helpful way, although it won't prevent screen-grabbing. It also won't prevent them from simply clicking "view source" in their browser and copying from there.

A simple and perhaps slightly more effective measure might be to edit an open source font, randomly cycling the characters and applying the same transformation to the characters of text so it displays correctly but is gobbledygook if copied or scraped. This would of course be circumvented by a determined individual, and it would impair your appearance in the search engines.

Answer 11

Blocking copy/paste on a website is a very big deal. What your client is trying to achieve is protect digital content from unauthorized redistribution, and falls into a category of data protection called digital rights management (DRM). I am not aware of any DRM solutions to protect text that is rendered in a browser.

Ideally, and one day we might have this, a website would encode text that shouldn't be copied to tell the browser, and the browser AND the underlying operating system would honor preventing a copy action. As it stands today, the OS's and browsers are designed to facilitate using data between apps so that is why copy/paste is a core feature in the OS UI.

All the ways that web sites attempt to prevent copy, or text selection, can be circumvented and there is no 100% solution. This article shows all the ways to work around website attempts at DRM'ing text content:

http://www.manjemedia.com/7-ways-to-copy-content-from-a-website-with-disabled-text-selection-and-right-clicking/

As the article shows, one way or another there is always a way -- if nothing else works, take a picture of the screen and OCR the picture to get the text.

Answer 12

It seems like a business decision.

If disabling the copy paste operation helps the business model of your client then you should disable it.

However, from a purely UX standpoint disabling copy/paste operations will definitely provide worse UX for the users as they have to do manual work (typing) instead of automated (copy-pasting).

Try to come up with use cases where copy-pasting is good for the business model of your employer.

Answer 13

Wow, lots of answers here.

What is the reasoning behind this? I'd ask your client that question. That's the important thing missing here. If it's a question of data security, there are much better ways to enable that rather than blocking copy & paste.

Ultimately it is the client's decision, BUT you should do your due diligence and identify what their underlying concern is and proposing a better solution.

At the end of the day, something as basic as logging IPs is a better solution here. But you can come up with something better than that, I don't know what environment you're working in so I can't suggest anything based on that.

Answer 14

It really depends on your audience. Unlike the other answers, I'd argue that at least in some cases, it isn't a problem anymore.

There are too many smartphone apps that don't support copy-pasting in the first place, and the users don't seem to have too much problems about that. Many users already get used to this situation.

On the other hand, for the advanced users that could bypass the blocking, it might be just slightly more difficult to write a userscript that does this automatically. It isn't too inconvenient to them. It is slightly inconvenient, and more importantly, it leaves the impression that you are ignorant about their feelings. But firstly, it might not change the fact that they are indeed ignorant by not doing this. Secondly, there are many websites that do annoying things such as requiring registration after you have read a certain number of pages, and / or sending you nonsensical emails that cannot be unsubscribed without unsubscribing all the emails from this website, which may contain important informations. And they require slightly more efforts to workaround. Blocking from copying isn't much worse than these things.

Users like me may still feel it bad and making no sense, by the common sense of internet built from maybe 10 years ago. But modern smartphones weren't that common, and people didn't quite understand the need of copyright protection. More importantly, it is one of the few annoying thing they could do 10 years ago and still works today. With the more possibilities of being annoying, I doubt new internet users would perceive it in the same way as I would. With the growth of internet users and the fraction of advanced users, it might be really not that important, depending on what business you are doing there. Even these users may feel that there are much more troublesome DRM systems in the world and they really don't need to hate a website that they know the workaround.

There are also users being just that advanced, who can copy the text, but cannot automate it. But there might not be many of them. But you have to check that there isn't a huge fraction of them in your audiences.

But you have to be sure, that they want to block the normal users who find it helpful to spread the information in your website, and none of the automatic crawlers to copy your website completely. Yes, it does make some sense in some cases. It also makes keyword search more difficult, but you may accommodate that by adding the similarly annoying keyword links.