Is Web Scraping Legal? What the Law Actually Says (2026)

Scraping publicly accessible data is generally lawful in the United States, the European Union, and the United Kingdom. Courts have repeatedly declined to treat automated access to public pages as hacking, and no jurisdiction has a statute that bans scraping as such. But “generally lawful” is not “always lawful”: terms of service, copyright, database rights, computer-misuse statutes, and privacy law each draw real boundaries. Scraping behind a login, continuing after being told to stop, republishing creative content, or collecting personal data changes the analysis entirely.

This guide walks through the leading cases and statutes by jurisdiction, then distils them into practical rules. It is general information current as of October 2026, not legal advice for your situation.

The five legal theories that matter

Almost every scraping dispute is argued under one or more of these, and each has its own answer to “is this legal?”

United States

Full guide: Is Web Scraping Legal in the USA?

hiQ Labs v. LinkedIn: public data is not hacking

The most-cited scraping case. hiQ scraped public LinkedIn profiles to build workforce analytics. LinkedIn sent a cease-and-desist and blocked hiQ, and hiQ sued. The Ninth Circuit held in 2019, and again in April 2022 after the Supreme Court sent the case back, that scraping data from publicly accessible pages does not violate the Computer Fraud and Abuse Act (CFAA). The CFAA targets breaking into gated systems, not reading what is open to everyone.

The caveat every summary should include: hiQ still lost. In November 2022 the district court ruled that hiQ had breached LinkedIn's User Agreement, because hiQ employees had accepted those terms and hiQ continued scraping after access was revoked. The parties settled the following month. Public-data scraping is not a federal crime; contract claims remain live.

Van Buren v. United States: gates up or down

In 2021 the Supreme Court narrowed the CFAA's “exceeds authorized access” language. A person exceeds authorised access when they enter parts of a system that are off-limits to them, not when they use accessible information for an improper purpose. The Court's “gates-up-or-down” framing is the reason the Ninth Circuit reaffirmed hiQ: if there is no gate, there is no CFAA violation.

Meta v. Bright Data and X Corp. v. Bright Data: logged-out scraping and terms of service

Two 2024 decisions from the Northern District of California extended the logic to contract claims. In January 2024 the court granted summary judgment to Bright Data against Meta: scraping public Facebook and Instagram pages while logged out did not breach Meta's terms, because those terms govern use of an account, and Bright Data was not using one when it scraped. Meta dropped its remaining claims shortly after. In May 2024 a different judge dismissed X Corp.'s claims against Bright Data, noting that allowing platforms to use contract law to restrict copying of public content they do not own would undermine the balance struck by copyright law.

When scrapers lose: revocation and gates

• Facebook v. Power Ventures (9th Cir. 2016). Continuing to access Facebook after a cease-and-desist letter and IP block violated the CFAA, even though users had consented. Revocation of access is where public-data arguments end.
• Craigslist v. 3Taps (N.D. Cal. 2013).Same pattern: a cease-and-desist plus IP blocking made further access “without authorization.”
• Ryanair v. Booking.com (D. Del. 2024). A jury found Booking.com liable under the CFAA for accessing password-protected myRyanair accounts through intermediaries. Damages were nominal, but the principle is clear: behind a login is behind a gate.
• Southwest Airlines v. Kiwi.com (N.D. Tex. 2022). Southwest obtained an injunction on contract grounds; Kiwi had accepted the terms in the course of booking flights on customers' behalf.

Copyright: facts are free, expression is not

Under Feist v. Rural (1991), facts and unoriginal compilations are not copyrightable. Prices, specifications, availability, addresses, and dates can be extracted into a database without a copyright problem. Creative expression, meaning articles, photographs, reviews, and original descriptions, is protected. Scraping it for indexing or analysis is usually defensible; republishing it wholesale is not. The 2025 AI training decisions (Thomson Reuters v. Ross, Bartz v. Anthropic, Kadrey v. Meta) show courts weighing fair use case by case, with how the copies were obtained mattering as much as how they were used.

Two further federal hooks: the DMCA's anti-circumvention provision (17 U.S.C. §1201) can apply if you defeat a technical access control such as a paywall, and the Copyright Act preempts some contract claims that merely restate copyright, as the Second Circuit held in ML Genius v. Google (2022).

State law: CCPA, BIPA and trespass

California's CCPA/CPRA treats scraped personal information as collected personal information, with notice and opt-out duties. Illinois' Biometric Information Privacy Act (BIPA) requires consent before collecting face geometry and produced Clearview AI's 2022 settlement with the ACLU. Trespass to chattels, established for scraping in eBay v. Bidder's Edge(2000), requires showing actual harm to the target's systems and rarely succeeds against polite, rate-limited scrapers.

European Union

Full guide: Is Web Scraping Legal in the EU?

Copyright, database rights and the text-and-data-mining exception

Facts are not copyrightable in the EU either, but the EU adds a sui generisdatabase right (Directive 96/9/EC) that protects substantial investment in obtaining, verifying, or presenting a database's contents. Extracting a substantial part of a protected database can infringe even when no individual item is copyrighted. The bar is meaningful: in Ryanair v. PR Aviation(CJEU C-30/14, 2015) the Court held that Ryanair's flight data was not a protected database, which in turn meant Ryanair could rely on its contractual terms to restrict use, since the statutory user rights that override contract only attach to protected databases.

The 2019 Copyright in the Digital Single Market Directive (2019/790) created two text-and-data-mining (TDM) exceptions. Article 3 permits TDM by research organisations for scientific purposes. Article 4 permits TDM by anyone on lawfully accessible works, unless the rights holder has expressly reserved its rights in a machine-readable way, for example in robots.txt, terms published in metadata, or an ai.txt-style file. The EU AI Act (2024) references the Article 4 opt-out for general-purpose AI training, giving machine-readable reservations extra weight.

GDPR: public does not mean free to process

Names, profiles, photos, and contact details are personal data under the GDPR whether or not they are public. Processing them requires a lawful basis under Article 6, most often legitimate interests, which demands a documented balancing test. Article 14 requires informing data subjects when data was not collected from them directly, and Article 9 forbids processing biometric or other special-category data without a narrow exception.

Enforcement has been vigorous. Clearview AI, which scraped billions of face images, was fined €20 million each by the French CNIL, the Italian Garante, and the Greek authority in 2022, and €30.5 million by the Dutch Autoriteit Persoonsgegevens in 2024. The UK ICO's £7.5 million fine was contested on jurisdiction grounds. If your pipeline touches personal data of EU or UK residents, treat data protection as a design requirement: minimise fields, define a retention period, run a legitimate-interests assessment, and be ready to honour access and erasure requests.

Germany

Germany is one of the most active jurisdictions for scraping litigation and a frequent source of the question “ist Web Scraping legal?”. Three points define the position (full guide: Is Web Scraping Legal in Germany?):

• Screen scraping is not unfair competition per se. The Federal Court of Justice (BGH) held in its 2014 Flugvermittlung im Internetdecision (I ZR 224/12) that a travel portal scraping Ryanair's public flight data did not violate the Unfair Competition Act (UWG), because Ryanair had not put technical protection measures in place. Circumventing a technical barrier would change that analysis.
• §44b UrhG implements the TDM exception.The German Copyright Act allows text-and-data-mining of lawfully accessible works, subject to machine-readable opt-outs. In September 2024 the Hamburg Regional Court applied the research exception (§60d UrhG) to LAION's creation of an image training dataset in Kneschke v. LAION, one of the first European rulings on scraping for AI.
• The GDPR applies in full, enforced by state data protection authorities. Scraping personal data of German residents without a lawful basis and Article 14 transparency is the most common source of exposure for commercial scrapers.

Contract claims based on terms of use follow the same logic as elsewhere: enforceable where the scraper affirmatively accepted them, weak against logged-out visitors, and stronger where the operator also deploys technical measures.

United Kingdom

Full guide: Is Web Scraping Legal in the UK?

The UK retained the EU acquis after Brexit, so the database right, UK GDPR, and Data Protection Act 2018 apply. The Computer Misuse Act 1990 criminalises unauthorised access, and UK prosecutors and courts read “unauthorised” broadly, which makes scraping behind logins or after revocation riskier than in the US. The UK has no general commercial TDM exception; the 2014 exception covers non-commercial research only, and a broader exception proposed in 2022 was withdrawn. Commercial scrapers in the UK therefore rely on the fact that facts are not protected, on licences, and on the absence of a protected database.

Other jurisdictions in brief

Do terms of service bind a scraper?

It depends on how the terms are presented and whether you accepted them. Courts distinguish clickwrap agreements, where you clicked “I agree” and which are generally enforceable, from browsewrap, where terms sit behind a footer link and enforceability turns on whether a reasonable user had notice. The practical consequences:

• Scraping while logged into an account almost always means you accepted terms that prohibit it. That is a contract risk, and it is how hiQ ultimately lost.
• Scraping public pages without an account leaves terms-of-service claims on much thinner ice, as Meta v. Bright Data shows. Cease-and-desist letters and IP blocks can still follow, and continuing after them creates CFAA exposure.
• Using a third party's account or credentials to reach gated data does not launder the access; Ryanair v. Booking.com is the cautionary example.

Does robots.txt matter?

robots.txt is a voluntary convention, not a statute. Ignoring it is not itself illegal in any jurisdiction we are aware of. It matters anyway, for three reasons. First, it is evidence of the operator's intent, and courts weigh it when deciding whether access was authorised or a scraper acted in good faith. Second, under the EU TDM rules a machine-readable reservation is exactly what removes the Article 4 exception, and robots.txt is the most common place to express one. Third, respecting crawl-delay and disallow rules keeps your traffic polite, which is the best defence against trespass-to-chattels claims. Our best-practices guide covers how to honour it programmatically.

Practical rules for staying on the right side

1. Scrape public pages only. Do not bypass logins, paywalls, CAPTCHAs presented as access controls, or IP blocks. Gates are where criminal statutes begin.
2. Do not scrape while logged in unless you have read the terms and accepted the contract risk, or hold a licence.
3. Prefer factual data. Extract prices, specifications and availability freely; do not republish articles, images or reviews wholesale.
4. Check for protected databases in the EU before extracting a substantial part of a curated dataset.
5. Honour robots.txt and machine-readable opt-outs, rate-limit per host, and identify your bot with a contact address.
6. Minimise personal data. If you must collect it, document a lawful basis, run a legitimate-interests assessment, set a retention period, and be ready for access and erasure requests. Never collect biometric data without explicit consent.
7. Stop and reassess on a cease-and-desist. Continued access after revocation is where scrapers lose in court. Get counsel before resuming.
8. Keep records. Log what you accessed, when, at what rate, and under which policy. It is the difference between a defensible position and a guess.

For the technical side of collection, see what is web scraping? and how to scrape JavaScript-rendered websites. Scrapeshop customers remain responsible for compliance with target sites' terms and applicable law, the same rule stated in our Terms of Service.