[1] https://calawyers.org/privacy-law/ninth-circuit-holds-data-s...
The short answer is... uh, not much. The order on the motion to dismiss suggests that to violate the CFAA, there is a requirement that you're specifically bypassing some form of access control, and it says the complaint sufficiently alleges such control (specifically password-protects internet accounts). Which... is a somewhat weak argument, but the judge here seems to think that HiQ is narrowly focused on "what's publicly available without requiring users to authenticate themselves." The motion for summary judgement states:
> Booking and Kayak admit that their access was intentional, and there are no factual disputes that Booking’s and Kayak’s access circumvents authentication mechanisms implemented by Ryanair specifically to keep Defendants out.
which, again, is vague on what those authentication mechanisms were, and it's not like this article provides any elucidation.
It's far from certain that this will be overturned on appeal, but "creating an account to use for screen scraping" doesn't sound like something that CFAA prohibits.
[1] https://storage.courtlistener.com/recap/gov.uscourts.ded.731...
[2] https://storage.courtlistener.com/recap/gov.uscourts.ded.731...