It is the first question every data team asks, and the honest answer is: scraping publicly available data is generally legal in many jurisdictions — but "generally legal" is not "anything goes." Legality turns on three things: what you collect, how you collect it, and where you and the website operate. This guide lays out the current landscape factually, including the key US cases and the EU rules, and shows how to stay on the right side of the line.
This article is educational and not legal advice. Laws vary by country and change over time — consult a qualified lawyer for your specific situation.
The Short Answer
Courts in several jurisdictions have found that collecting publicly available information — data you can see without logging in — is broadly permissible. The risk rises sharply when scraping involves any of the following: bypassing a login or technical barrier, collecting personal data, copying copyrighted material, ignoring a site's rate limits, or breaching terms you agreed to. Most legal trouble comes not from "scraping" in the abstract but from one of those specific factors.
United States: The Key Laws and Cases
Several distinct legal theories can apply in the US. No single one settles the question — they stack.
The Computer Fraud and Abuse Act (CFAA)
The CFAA prohibits accessing a computer "without authorization." Two decisions narrowed how it applies to scraping:
- Van Buren v. United States (2021). The Supreme Court held that a person does not "exceed authorized access" simply by using access they already have for an improper purpose. This narrowed the CFAA's reach.
- hiQ Labs v. LinkedIn (9th Circuit). The court indicated that scraping publicly available data — where no login is required — likely does not amount to CFAA "without authorization." Importantly, though, the case did not end there: on remand the court found hiQ had breached LinkedIn's User Agreement, and the matter resolved against hiQ on that contract basis. The lesson: public data may clear the CFAA hurdle yet still raise a contract problem.
Breach of Contract (Terms of Service)
Many sites prohibit automated access in their Terms of Service. Violating those terms can be a breach of contract, especially if you accepted them by creating an account. A recent case sharpened this distinction:
- Meta Platforms v. Bright Data (2024). A California federal court ruled largely for the scraper, finding that Bright Data did not breach Facebook and Instagram terms because it scraped public data while logged out — and therefore was not bound by the logged-in user agreement. The takeaway many drew: scraping public pages without logging in stands on firmer ground than scraping from inside an account.
Copyright and Trespass to Chattels
Two more theories round out the US picture. Copyright: raw facts and data are not copyrightable, but original creative expression (articles, photos, reviews) is — copying and republishing it can infringe. Trespass to chattels: hammering a server so hard that you impair its operation can support a claim, which is one legal reason to throttle your requests.
European Union: GDPR and Database Rights
In the EU the biggest factor is personal data. The GDPR applies whenever you collect information relating to identifiable people — names, emails, profiles, even usernames on a review. Scraping personal data is not automatically illegal, but it triggers real obligations: you need a lawful basis, you must minimize what you collect, and individuals have rights over their data. The EU also grants a sui generis database right that can protect substantial investments in compiling a database, independent of copyright. Collecting non-personal, public facts is the lower-risk end; harvesting personal profiles at scale is the higher-risk end.
The Red Lines: What Raises Real Risk
Regardless of jurisdiction, these factors are what turn scraping from routine into risky:
- Bypassing authentication. Scraping behind a login, or defeating a technical block, is the single biggest escalator. Stick to public pages.
- Personal data. Names, contact details, and profiles pull you into GDPR / CCPA territory. Minimize and justify.
- Copyrighted content. Republishing scraped articles, images, or reviews wholesale can infringe. Use data for analysis, not wholesale copying.
- Overloading a site. Aggressive request rates can harm a service and support a trespass claim. Throttle and respect
robots.txt. - Breaching terms you accepted. If you clicked "agree," those terms can bind you as a contract.
How to Scrape Responsibly
A practical checklist that keeps most projects on the right side of the line:
- Collect only public data; never log in to scrape or bypass a technical barrier.
- Avoid personal data where you can; if you must collect it, comply with the GDPR and CCPA.
- Respect
robots.txtand rate limits — scrape politely and throttle your requests. - Use data for analysis, not wholesale republication of copyrighted content.
- Read the target's Terms of Service so you know what you are agreeing to.
- Use ethically sourced proxies so your infrastructure itself is above board.
- When in doubt on a high-stakes project, get advice from a qualified lawyer.
These same principles run through our practical guides, from scraping Amazon reviews to scraping TripAdvisor — each of which flags the personal-data and terms-of-service caveats specific to that site.
Frequently Asked Questions
Is web scraping legal?
Scraping publicly available data is generally legal in many jurisdictions, but it depends on what you collect, how, and where. Risk rises sharply if you bypass a login, collect personal data, copy copyrighted material, overload a site, or breach terms you agreed to. This is an overview, not legal advice.
Is it legal to scrape data that requires a login?
It is far riskier. Scraping behind an account usually means you accepted the site's terms, so it can be a breach of contract, and defeating an access control raises additional legal exposure. Sticking to public pages that require no login is the safer approach — a distinction courts have treated as significant.
Does the GDPR apply to web scraping?
Yes, whenever you collect personal data about identifiable people in the EU. The GDPR does not ban scraping, but it requires a lawful basis, data minimization, and respect for individuals' rights. Scraping non-personal public facts is lower risk; harvesting personal profiles at scale is high risk.
Can I get sued for scraping public data?
It is possible even for public data — typically on breach-of-contract, copyright, or trespass grounds rather than the CFAA. Recent US cases have favored scrapers who collected public data while logged out, but outcomes are fact-specific and the law is still evolving. Reduce risk by staying public, polite, and away from personal and copyrighted content.
Conclusion
Web scraping is not illegal by nature, and courts have repeatedly protected the collection of public data. But legality is about the specifics: stay on public pages, avoid personal and copyrighted content, throttle your requests, respect terms and robots.txt, and use ethically sourced infrastructure. Do those things and you are on solid ground for the vast majority of data projects — and for anything high-stakes, talk to a lawyer.
Scrape on a clean foundation: SpyderProxy residential proxies are ethically sourced from real, consenting users — from $2.75/GB across 195+ countries.