Is Web Scraping Legal?

Understand the legal dimensions of web scraping: computer access laws, contract, copyright, database rights and privacy regulation, and what actually raises risk.

Scraping publicly available data is broadly lawful in many jurisdictions, and that sentence answers almost nothing useful. "Web scraping" is not one act, and the legal exposure comes from what you collect, how you obtained access, and what you then do with it.

This page describes the landscape in general terms. It is not legal advice, and anything consequential deserves a lawyer in your jurisdiction.

1. Four Separate Questions

Most confusion comes from collapsing distinct issues into one:

A scrape can be fine on three and a serious problem on the fourth. Answer them separately.

2. Access and Authorisation

The United States' Computer Fraud and Abuse Act turns on access "without authorisation". The direction of travel in recent litigation has been that data published openly, with no login and no technical barrier, is not accessed without authorisation merely because the site would prefer you did not — and the Supreme Court's narrowing of "exceeds authorised access" in 2021 pointed the same way.

What changes the analysis is a barrier:

• Creating an account to reach the data
• Circumventing an authentication or paywall
• Continuing after an explicit, individual cease-and-desist
• Defeating technical measures specifically to obtain access

Public and unauthenticated sits in far safer territory than anything behind a credential.

3. Contract

Terms of service can restrict scraping contractually, independently of any access law. Enforceability generally depends on assent:

• Browsewrap — a footer link, never acknowledged. Weakly enforceable in many cases.
• Clickwrap — an explicit "I agree". Routinely enforced.

The practical implication is direct: creating an account changes your position materially. You have then agreed to terms, and breach of contract is available to the site whatever the access-law analysis says.

4. Copyright and Database Rights

Facts are generally not copyrightable; the expression of them is. A price is a fact. A 500-word product description is expression.

• Collecting for analysis — often defensible, particularly where the use is transformative.
• Republishing verbatim at scale — the highest-risk activity in this category.
• Building a substitute for the source — invites both copyright and unfair competition arguments.

The EU adds a sui generis database right protecting substantial investment in compiling a database, independent of copyright in its contents. Extracting a substantial part of a protected database can infringe even when every individual fact is unprotected — a distinction that surprises people working from a US-centric understanding.

5. Personal Data

This is where risk concentrates, and where "it was public" is least helpful.

Under GDPR, personal data is anything relating to an identifiable person. Public availability does not exempt it. Scraping names, emails, profiles or user-generated content brings obligations: a lawful basis, purpose limitation, retention limits, and — awkwardly for scraping — notifying the individuals whose data you collected.

Regulators have levied significant fines for building databases by scraping public profiles. CCPA/CPRA in California and similar regimes elsewhere impose their own duties.

The reliable risk reducer is not collecting personal data at all. Where the target is prices, availability, specifications or public company information, most of this section does not apply.

6. What Actually Raises Risk

Roughly in ascending order:

1. Public, non-personal, aggregate analysis. Lowest risk.
2. Public, non-personal, republished. Copyright and database-right exposure.
3. Behind a login. Contract, and a weaker authorisation position.
4. Personal data. Data protection obligations regardless of publicity.
5. After a cease-and-desist. Any argument that you believed you were authorised gets much harder.
6. Volume that degrades the service. A separate wrong from reading, and one that turns a quiet disagreement into a complaint.

That last item is the most controllable. Aggressive crawling is what converts an unnoticed scraper into a defendant, and rate limiting costs almost nothing.

7. Practices That Reduce Exposure

• Collect only what you need, and avoid personal data unless it is genuinely required.
• Respect robots.txt. Not binding, but ignoring it looks bad in every forum.
• Rate limit and identify your crawler. Courteous, traceable traffic is treated differently.
• Prefer an API where one exists. It substitutes explicit permission for inference.
• Keep records of what you collected, when, and under what terms.
• Stop when asked. Continuing after a direct request weakens every defence you have.
• Get advice before anything consequential — commercial republication, personal data at scale, or a target that has already objected.

8. Summary

Scraping is not one legal question but four: authorisation, contract, copyright and database rights, and data protection. Public, unauthenticated, non-personal data collected at a considerate rate for analysis sits at the low-risk end in most jurisdictions.

Risk rises with logins and accepted terms, with verbatim republication, with EU database rights, and above all with personal data — where public availability provides no exemption and obligations attach regardless.

The controllable factors are what you collect, whether you crossed an authentication boundary, what you publish, and how heavily you crawl. This is general information rather than legal advice; jurisdictions differ, the case law moves, and anything commercially significant warrants proper counsel.

Potential Related Glossary

• Web Crawling
• Unstructured Data
• Data Structure
• Data Fusion