Is web scraping legal? Sometimes. There is no single rule that makes all web scraping legal or illegal. The answer depends on what you access, how you access it, what you collect, and how you use it.
Scraping a publicly accessible page is different from accessing a private account or bypassing authentication. Collecting product prices for internal research is also different from copying copyrighted material or compiling personal information for resale. The website’s Terms of Service and the laws that apply in your jurisdictions can matter too.
That means whether it is legal to scrape a website cannot be answered without looking at the specific project. Web scraping laws by country can also differ, particularly when personal data or restricted data is involved.
Disclaimer: This article is for general information purposes only and is not legal advice. Web scraping laws vary by jurisdiction and by the facts of each project. If your scraping project involves personal data, restricted content, authentication barriers, or commercial use, consult a qualified lawyer before proceeding.
The Short Answer (and Why It’s Not That Simple)
So, is web scraping legal?
Web scraping is not inherently legal. In some situations, collecting publicly available information can be lawful. But that doesn’t mean every scraping project is lawful.
A useful way to access a scraping project is too look at five questions.
| Question | Why it matters |
|---|---|
| What are you accessing? | Public pages and private accounts raise different legal issues. |
| How are you accessing it? | Normal access is different from bypassing authentication or technical controls. |
| What are you collecting? | Product prices, articles, and personal information can trigger different rules. |
| What will you do with it? | Internal analysis is different from publishing, selling, or profiling. |
| Which laws apply? | Requirements vary by country and sometimes by state or region. |
So, the question is not simply whether you are scraping. It’s what the scraping involves and what happens to the data afterward.
Public Data Does Not Mean Unrestricted Use
A page being visible to anyone does not automatically give you unrestricted rights to copy or reuse everything on it.
Public availability mainly answers the questions of access. Other rules can still affect what you do with the information, including:
- Copyright: The underlying content may be protected.
- Privacy: Information about identifiable people may be regulated even when publicly visible.
- Terms of Service: A website may impose contractual restrictions on automated access or data reuse.
- Database rights: Certain jurisdictions provide additional protection for databases.
- Intended use: How and where data will be used.
“I can see it in my browser” doesn’t mean you can scrape and use it anywhere.
What hiQ Labs v. LinkedIn actually tells us
This case shows why the answer can’t be reduced to “public scraping is legal.”
hiQ scraped publicly available LinkedIn profile information, and LinkedIn attempted to stop the practice. In its 2022 opinion, the Ninth Circuit reaffirmed a preliminary injunction in hiQ’s favor when considering whether accessing publicly available information could constitute access “without authorization” under the Computer Fraud and Abuse Act.
However, the decision did not establish that every form of web scraping is lawful. Its analysis focused on specific CFAA questions, while other potential claims, including contract, privacy, and state-law claims, could still matter.
The practical takeaway is simple: public access can be an important factor, but it is not a blanket permission to scrape and use data however you want.
What Actually Matters Legally
There is no single factor that determines whether a scraping project is lawful. The main question is: Is the data accessible? How are you accessing it? What data are you collecting? What will you do with it?
| Factor | Lower-risk situation | Requires more careful analysis |
|---|---|---|
| Access | Publicly viewable page | Login, paywall, or private dashboard |
| Method | Normal HTTP or browser access | Bypassing authentication or technical controls |
| Data | General business or product information | Personal or sensitive information |
| Use | Internal research or analysis | Publishing, selling, profiling, or republishing content |
These factors do not determine legality on their own. The applicable laws, contracts, and facts of the project still matter.
1. Is The Data Publicly Accessible?
Publicly accessible pages generally present a different situation from content that requires authentication. A product page that anyone can view is not the same as a private dashboard, an account-only page, paywalled content, or data obtained with someone else’s credentials.
The key distinction is whether you are accessing information normally to the public or bypassing a restriction to obtain it.
2. Does The Website’s Terms of Service Prohibit Scraping?
A website’s Terms of Service may prohibit scraping, but a contractual restriction is not automatically the same as a criminal law prohibition.
The legal effect of those terms depends on the agreement, the circumstances, and applicable law. In hiQ Labs v. LinkedIn, for example, LinkedIn’s restriction on scraping did not by itself resolve the separate question of whether accessing publicly available information violated the CFAA.
Before scraping, check whether the site’s terms address:
- Automated access
- Data collection
- Data reuse
- API requirements
- Licensing
3. Are you collecting personal data?
Publicly available information can still be personal data. Names, email addresses, phone numbers, professional profiles, and location information may identify individuals and can therefore trigger privacy obligations.
Under the GDPR, publicly accessible personal data is not automatically outside the law’s scope.
For scraping personal data, consider:
- What is the lawful basis?
- Why are you collecting it?
- How much data do you need?
- How long will you keep it?
- What rights do the individuals have?
4. What are you doing with the scraped data?
Collection is only part of the legal analysis. The intended use can change which rules apply.
| Intended use | What may matter |
|---|---|
| Internal research | Whether the collection and processing are permitted |
| Aggregation | Database rights, licensing, and contractual restrictions |
| Publishing | Copyright and privacy |
| Selling data | Privacy, copyright, licensing, and database rights |
| Profiling | Privacy and data-protection requirements |
| Republishing content | Copyright and contractual restrictions |
For example, collecting product prices for internal analysis is different from copying a site’s articles and republishing them. Both involve scraping, but the legal questions can differ significantly.
Accessing data and using data are separate legal questions. A project can begin with publicly accessible information and still create legal issues based on what happens after collection.
United States: Where Things Stand
There is no single US law that makes all web sharing legal or illegal. The main issues can involve the Computer Fraud and Abuse Act (CFAA), contracts, copyright, privacy, and state laws.
Public Data And The CFAA
hiQ Labs v. LinkedIn is one of the key US cases involving public web scraping. hiQ scraped publicly available LinkedIn profile data, and the Ninth Circuit’s 2022 opinion considered whether accessing that public information could count as access “without authorization” under the CFAA.
The court’s analysis distinguished publicly accessible information from data protected by authentication. But hiQ did not establish that all scraping is legal. Other claims, including contract, copyright, and privacy claims, can still apply.
When US Scraping Projects Become Riskier
A scraping project deserves more legal scrutiny when it involves:
- Login-protected or private data
- Bypassing authentication or technical controls
- Personal information
- Copyrighted content
- Terms of Service restrictions
- Excessive requests that disrupt a website
- State-specific privacy or other laws
The key takeaway from US web-scraping law is simple: hiQ provides important guidance on accessing public information under the CFAA, but it does not grant scrapers a blanket legal exemption.
European Union: GDPR and Scraping Personal Data
The GDPR can apply to scraped personal data even when that data is publicly accessible. Publicly available does not automatically mean outside the GDPR.
GDPR Can Apply to Publicly Available Personal Data
The GDPR covers the processing of personal data obtained from sources other than the individual. It also specifically addresses information obtained from publicly accessible sources.
That means a scraper collecting names, email addresses, professional profiles, phone numbers, or other identifiable information may need to consider GDPR requirements even when the information is visible without a login.
This does not mean GDPR makes scraping personal data illegal. The legality depends on the processing activity, its purpose, the applicable lawful basis, and the circumstances of the project.
What a Scraper Needs to Consider
A GDPR web scraping project involving personal data may need to address:
| GDPR consideration | What it means for a scraping project |
|---|---|
| Lawful basis | Identify a valid legal basis for processing the data. |
| Purpose limitation | Collect and use the data for a defined purpose. |
| Data minimization | Collect only the information the project actually needs. |
| Transparency | Individuals may need information about how their data is being processed. |
| Retention | Do not keep personal data longer than necessary. |
| Data subject rights | Consider rights such as access, correction, or objection. |
| Source information | Article 14 can create information obligations when data comes from sources other than the individual. |
The exact requirements depend on the project. Factors such as the type of personal data, purpose of processing, lawful basis, jurisdiction, and any applicable exemptions can change the analysis.
Public Data is Not Automatically “Free to Use”
The main point for GDPR scraping is simple: visibility does not remove privacy obligations.
A publicly visible professional profile, for example, may still contain personal data. Collecting that information at scale, storing it, combining it with other datasets, or using it for profiling can create obligations under data protection law.
So, scraping personal data in the EU should be treated as a data-protection issue from the beginning, rather than assuming that public access makes the data free to collect and use.
United Kingdom
In the UK, web scraping can involve the UK GDPR, Data Protection Act 2018, copyright law, computer misuse rules, and website Terms of Service. The rules should not simply be treated as identical to EU law after Brexit.
What UK Scrapers Should Consider
| Area | What to check |
|---|---|
| UK GDPR | Whether the scraped data contains personal information and what processing rules apply |
| Data Protection Act 2018 | Additional UK data-protection requirements |
| Copyright | Whether the scraping copies protected content |
| Computer misuse | Whether access involves unauthorized access or bypassing security |
| Terms of Service | Whether the website restricts automated access or data reuse |
For UK web scraping laws, the same basic distinction still matters: publicly accessible information is different from private or restricted information. The legality of a specific project depends on the data, access method, intended use, and applicable UK rules.
So, is web scraping legal in the UK? It can be, but public availability alone does not settle the question.
A Few Ground Rules That Hold Up Almost Everywhere
There is no universal checklist that guarantees a scraping project is legal. These practices can, however, help reduce avoidable legal and operational risks.
| Practice | Why it matters |
|---|---|
| Prefer public data | Public access generally creates fewer access-related concerns than restricted content. |
| Do not bypass authentication | Avoid accessing private accounts, password-protected pages, or restricted dashboards without authorization. |
| Check Terms of Service | Look for restrictions on automated access, scraping, and data reuse. |
| Minimize personal data | Collect only the personal information necessary for the stated purpose. |
| Respect copyright | Avoid copying or republishing protected content unnecessarily. |
| Use reasonable request rates | Excessive traffic can create operational and legal concerns. |
| Separate collection from reuse | Assess whether publishing, selling, or profiling the data creates additional obligations. |
Prefer publicly accessible data
Start with information that is available without authentication or access restrictions. Public access does not eliminate every legal issue, but it generally avoids some of the concerns associated with bypassing restricted access.
Do not bypass authentication
Do not use unauthorized credentials or circumvent controls to access:
- Private accounts
- Password-protected pages
- Restricted dashboards
- Other non-public content
Treat personal data separately
If the dataset contains names, emails, phone numbers, profiles, location data, or other information that identifies people, determine which privacy rules apply before collecting it.
Check the website’s Terms of Service
Look for restrictions covering automated access, scraping, data reuse, APIs, and licensing. Terms do not automatically determine whether an activity is criminal, but they can still create contractual or other legal issues.
Do not collect more than necessary
Limit the dataset to the information required for the project’s purpose. This is particularly important when personal data is involved.
Do not overload the website
Use reasonable request rates and avoid unnecessary traffic that could disrupt the site’s operation.
Separate collection from republishing
Collecting information does not automatically give you the right to republish it. Before publishing or selling scraped data, consider copyright, privacy, licensing, database rights, and contractual restrictions.
To know more about ethical solutions, refer to our guide about ethical proxy solutions.
Troubleshooting Common Mistakes That Create Legal Risk
Many scraping problems start with simple assumptions about what is allowed. These are some of the most common ones.
Mistake 1: “It’s public, so I can do anything with it.”
Public access does not automatically give you unlimited rights to collect, copy, publish, or sell the information.
Copyright, privacy, Terms of Service, database rights, and the intended use can still matter.
Mistake 2: “The site’s Terms say no scraping, so scraping is automatically a crime.”
A Terms of Service restriction and a criminal law are not the same thing.
A site’s terms may create contractual issues, but whether scraping also violates a law depends on the facts and applicable jurisdiction.
Mistake 3: “GDPR doesn’t apply because the data is public.”
Publicly available personal data can still fall under data protection rules.
If your project collects names, emails, profiles, or other information that identifies people, assess the applicable privacy requirements before collecting it.
Mistake 4: Scraping behind a login
Accessing private or account-protected information creates a different legal situation from collecting data available to anyone.
Do not assume that having technical access to an account means you have permission to automate collection or reuse the information.
Mistake 5: Ignoring what happens after collection
Getting the data is not the end of the analysis.
Publishing, selling, republishing, combining, or using scraped information for profiling can create additional copyright, privacy, licensing, or contractual issues.
Mistake 6: Using proxies as if they remove legal responsibility
A proxy changes the network path or IP address used to make a request. It does not change the legal status of the data or give you permission to access restricted information.
For example, a proxy cannot make it lawful to bypass authentication, ignore applicable privacy obligations, or reuse copyrighted content without the necessary rights. Websites may also use anti-scraping measures such as rate limits, CAPTCHAs, and access controls.
