Last reviewed: November 3, 2026
Web scraping is not illegal in itself, but whether a specific project is lawful depends on the type of data, how it is accessed, the website’s terms and the privacy and copyright laws that apply. Collecting public, non-personal data is generally lower risk; personal data, copyrighted content and logged-in areas carry more. This overview explains each factor in plain language and is general information, not legal advice. For a shorter answer, see Is web scraping legal?.
Web scraping legality is the question of whether collecting data from websites with automated tools complies with privacy law (such as GDPR and CCPA), copyright, computer-access law and the target site’s terms of service.
In this post, we look at the common misconceptions, the factors to consider, current legislation, frequent legal issues and some high-profile cases.

Is Everything Public on the Web Free to Scrape?
The general belief is that everything you see online is free to scrape and reuse. This is probably the biggest misconception out there regarding web scraping, and it can land an individual or company in legal trouble.
The question of web scraping’s legality isn’t as black and white as one might assume, and there is an ethical side as well. Knowing what kind of data is lower risk, higher risk, or somewhere in between helps your decision-making and helps you avoid unintended consequences. Our guides to common myths about data scraping and whether web scraping is legal go deeper.
What Factors Decide Whether Web Scraping Is Legal?
There are a few things one needs to consider before and after scraping any data.
Which Types of Data Are Riskier to Scrape?
In most cases, the degree of ease with which any web data is accessible more or less determines where the data lies on the legality spectrum.
Public data
Scraping data from public sites is generally the lower-risk case. This refers to the data and information on websites which is obtained without the need to log in or authenticate one’s identity. Some examples of such websites are ecommerce platforms like Amazon and BestBuy.
Although these data sources might try to protect public information by posing various obstacles to scrapers and crawlers, extracting publicly available data points from them is generally treated as lower risk, though each site’s terms still apply.
Private or personal data
Any data that can reveal a person’s identity, such as their name, address, date of birth, medical and financial details, and contact information, are called Personally Identifiable Information, or PII.
As a general rule, personal information is subject to strict rules, and collecting it typically requires the person’s consent or another lawful basis. The EU and California have some of the strictest laws in this respect.
Copyrighted data
Openly accessible content such as images, songs and articles can still be protected by copyright. Because owners control how their work is used and reproduced, collecting and reusing it typically requires permission, and exceptions vary by jurisdiction. Seek legal advice before relying on snippets or attribution as a workaround.
| Data type | Typical risk level | Key consideration |
|---|---|---|
| Public, non-personal data (prices, product specs, company information) | Lower | Check the site’s terms of service and rate limits |
| Personal data | Higher | Needs a lawful basis; privacy laws such as GDPR and CCPA apply |
| Copyrighted content | Higher | Reuse typically needs permission from the owner |
| Data behind a login | Higher | Account terms usually forbid scraping |
| Data restricted by terms of service | Varies | Breaching terms can lead to blocks or legal claims |
Do a Website’s Terms of Service Prohibit Scraping?
Before scraping any website for its data, one needs to be aware of its policies regarding its access. If they explicitly contain any scraping restrictions, then it is worth assuming that scraping would constitute a breach of their ToS. In addition, even if there aren’t any such policies, one should be wary that their content may still be copyrighted.
Is It Legal to Scrape Data Behind a Login?
Services like LinkedIn require users to have an account before any data is visible. When signing up with these services, you’re almost always agreeing to their terms which forbid scraping their data.
Since scraper bots and crawlers use your account credentials to gain access to the data, the service provider can easily identify and ban you from their platform altogether. Hence, it is advised to stay away from this option and instead try to find publicly available data.
Which Laws Apply to Web Scraping (GDPR, CCPA)?
As there currently aren’t any clear laws determining the legality or otherwise of web scraping, lawsuits are handled on a case-by-case basis. Having said that, the General Data Protection Regulation (GDPR) and US privacy laws such as the California Consumer Privacy Act (CCPA) are referred to in most cases in Europe and the US respectively.

GDPR
The GDPR came into effect in May 2018 and protects the personal details of people within the European Economic Area (EEA). Some example of personal data include people’s names, emails, phone numbers, dates of birth, IP address, credit card and bank details, medical records and multimedia like photos, audio and videos.
The GDPR classifies the protection of personal data as a “fundamental right“. As such, it prohibits the processing of personal data unless it is done under one of six lawful bases. Which are consent, contract, public task, vital interest, legitimate interest, or legal requirement. When the processing is based on consent, the data subject has the right to revoke it at any time.
Furthermore, data controllers must clearly disclose any data collection, declare the lawful basis and purpose, and state how long they plan to retain the data. Additionally, disclose if it is subject to sharing with third parties or outside of the EEA.
US Privacy Laws
While the US doesn’t have one federal regulation that legislates data privacy and protection like the EU, there are several industry-specific legal acts. Such as the GLBA for finance, HIPAA for healthcare, and COPPA for children’s data.
California’s Consumer Privacy Act (CCPA), which took effect in 2020 and was later expanded by the CPRA, requires covered businesses collecting personal data to disclose how they intend to use that data. It also gives consumers rights to access and delete their information and to opt out of certain uses. These rules can apply to data scraping companies that meet its thresholds.
How Do GDPR and CCPA Differ for Scraped Data?
| GDPR | CCPA (as amended by CPRA) | |
|---|---|---|
| Who it protects | People in the European Economic Area | California residents |
| Basis for processing | Requires a lawful basis, such as consent or legitimate interest | Mainly a notice-and-opt-out model for covered uses |
| Access and deletion rights | Yes | Yes |
| Right to correct data | Yes | Yes, added by the CPRA |
| Opt-out or objection | Right to object and to withdraw consent | Right to opt out of certain uses, such as sale or sharing |
Details change, so review the current text of each law or ask counsel before relying on this summary.
What Legal Claims Do Scrapers Face?
The following are some of the most repeated offenses and issues in context of web scraping.

Can Scraping Copyrighted Content Lead to Infringement?
As mentioned above, although scraping any openly accessible data may be legal, there may be certain restrictions and legal consequences if the data is copyright-protected. If you want to abide by the legal framework, you cannot publish or use any such data for commercial purposes.
Any infringement of copyrighted data is prosecutable, regardless of how you access and collect the data.
See our guide to avoiding copyright issues when web scraping.
Does the CFAA Apply to Web Scraping?
The CFAA was passed in 1984 to prohibit any unauthorized access to computers and networks. The reason for the draft originally was to protect military, financial, and other sensitive data. Later they extended it to include all private information.
US courts, including the Ninth Circuit in hiQ Labs v. LinkedIn, have held that the CFAA does not cover accessing data that is publicly available, though the law continues to develop and facts matter.
What Is Trespass to Chattels in Scraping?
A trespass to chattels (or site security) occurs when a website or its servers are violated or hurt in any way. In web scraping, a crawler repeatedly sending requests affects the target website’s performance by crashing or slowing down its server.
From a legal standpoint, the site owners might consider the frequent requests as an intentional attack on their system. As a result, it is important and morally responsible for DaaS providers to build scrapers that don’t harm the target website.
What Do the eBay and hiQ Cases Tell Us?
As mentioned earlier, there are a few historical cases which have set legal precedence in web scraping lawsuits.
For more cases and takeaways, see web scraping court cases and legal insights and data privacy at scale: ethical frameworks for big data projects.
eBay vs Bidder’s Edge (1999)
Bidder’s Edge, a website that gathered auction listings, sent 100,000 daily requests to eBay’s servers to access its ongoing auctions. This obviously resulted in damage to eBay’s systems. In late 1999, eBay filed an injunction against Bidder’s Edge, stating the violation of the Trespass to Chattels law.
Although both parties later settled the case out of court for an undisclosed amount, it set a legal precedent for future cases.

HiQ Labs vs LinkedIn (2019)
This historic case started when hiQ Labs, a data analytics company, sued LinkedIn for prohibiting it from scraping public profiles on LinkedIn. HiQ Labs used the data to consult employers about job applicants.
In 2019, the Ninth Circuit Court of Appeals ruled that the CFAA did not apply since the data was publicly available and non-copyright. As a result, LinkedIn wasn’t able to prevent hiQ Labs from accessing its public profiles. It did however restrict the user profiles to be accessible only after logging in.
It is worth mentioning that the case is far from concluded as LinkedIn continues to pursue the matter with the US Supreme Court.
Update (April 2022):
In its second ruling on 18 April 2022, the Ninth Circuit reaffirmed its original decision and found that scraping data that is publicly accessible on the internet is not a violation of the Computer Fraud and Abuse Act. The CFAA governs what constitutes computer hacking under U.S. law. via [TechCrunch]
Update (December 2022):
On 6 December 2022, hiQ Labs and LinkedIn reached a confidential settlement agreement, thus ending their long-running litigation.
What Is a Responsible Scraping Checklist?
- Check the terms of service and robots.txt of every source before collecting.
- Avoid personal data unless you have a lawful basis and appropriate safeguards.
- Respect rate limits so your requests do not harm the target site.
- Keep records of sources, purposes and decisions.
- Get legal review for new sources, new data types and new jurisdictions.
- Read up on ethics: see ethical web scraping in the AI era.
How Does Grepsr Approach Compliance?
Since the question of web scraping isn’t black or white, you must analyze each use case thoroughly to avoid any unintended consequences. You need to consider existing legislation, the types of data you collect, and the data sources’ terms and policies. Furthermore the ethical usage after extraction.
Here at Grepsr, we take our web scraping responsibilities seriously. We scope data acquisition projects with legal frameworks in mind before, during, and after delivery. We also follow the best ethical practices and stay within the bounds of the legality of web scraping. We also aim to avoid disrupting our target websites’ performance, while continuing to deliver accurate and reliable data to our customers. For more, see our guides to enterprise web scraping compliance}) and Grepsr’s data-as-a-service}) offering, or contact sales}).
Frequently Asked Questions
Is web scraping legal?
Web scraping is not illegal in itself, but whether a specific project is lawful depends on the data collected, how it is accessed, the website’s terms and the privacy and copyright laws that apply. Public, non-personal data is generally lower risk.
Is it legal to scrape personal data?
Personal data is regulated by laws such as GDPR and CCPA. Collecting it typically requires a lawful basis, such as consent, and you must follow principles such as data minimisation, even when the data is publicly visible.
Does robots.txt have legal force?
Robots.txt is a technical standard that tells crawlers which parts of a site to avoid. It is not a law, but ignoring it can weigh against you in a dispute and may breach a site’s terms, so it is best practice to respect it.
Can a website sue you for scraping?
Yes. Websites have brought claims based on breach of terms of service, copyright, trespass to chattels and access laws. Outcomes depend on the facts, the jurisdiction and the type of data.
Is scraping for AI training legal?
It depends on the source, the type of content and the jurisdiction. Copyright, terms of service and privacy law all play a role, and the law is still developing, so get legal advice before collecting data for AI training.