Is Web Scraping Legal? What the Law Actually Says

Scraping publicly accessible data is generally lawful in the United States and the European Union — courts have repeatedly declined to treat automated access to public pages as a crime. But “generally lawful” is not “always lawful”: terms of service, copyright, database rights, and privacy law each draw boundaries, and scraping behind a login or collecting personal data changes the analysis entirely. This article summarizes the landscape in plain language; it is general information, not legal advice for your specific situation.

What did hiQ v. LinkedIn decide?

The most-cited scraping case is hiQ Labs v. LinkedIn. The US Ninth Circuit held (2019, reaffirmed 2022) that scraping data from publicly accessible pages does not violate the Computer Fraud and Abuse Act (CFAA) — the CFAA targets breaking into gated systems, not reading what is open to everyone. The Supreme Court’s Van Buren v. United States (2021) pointed the same way with its “gates-up-or-down” reading of the statute.

The caveat: hiQ still ultimately lost the case — not on the CFAA, but on breach of contract, because it continued scraping after LinkedIn revoked access and it had accepted LinkedIn’s terms. Public-data scraping is not hacking, but contract claims remain live.

Do a website’s terms of service bind a scraper?

It depends on how the terms are presented. Courts distinguish “clickwrap” agreements (you clicked “I agree” — generally enforceable) from “browsewrap” (terms linked in a footer — weaker, enforceability turns on notice). Practical consequences:

• Scraping while logged into an account almost always means you accepted terms that prohibit it — a contract risk.
• Scraping public pages without an account leaves ToS claims on much thinner ice, though cease-and-desist letters and IP blocks can still follow.

Does copyright apply to scraped data?

Facts — prices, specifications, availability, dates — are not copyrightable in the US or EU. Creative expression — articles, photographs, reviews — is. Scraping factual fields into a database is on solid ground; republishing scraped articles wholesale is not. The EU adds a sui generis database right protecting substantial extraction from protected databases, and the 2019 DSM Directive’s text-and-data-mining exception permits mining of lawfully accessible works unless the rights holder has opted out in machine-readable form.

What about personal data and the GDPR?

“Publicly visible” does not mean “free to process” under the GDPR. Names, profiles, and contact details are personal data even when posted publicly; processing them requires a lawful basis, and data-protection authorities have imposed multimillion-euro fines on companies that scraped faces and profiles at scale (Clearview AI has been fined by regulators in France, Italy, the UK, and elsewhere). If your pipeline touches personal data of EU or UK residents, treat GDPR compliance as a design requirement, not an afterthought.

Practical rules for staying on the right side

1. Scrape public pages; don’t bypass logins or paywalls.
2. Prefer factual data; don’t republish creative content wholesale.
3. Respect robots.txt and rate-limit requests — it strengthens your good-faith position and keeps you off block lists.
4. Minimize personal data, and have a GDPR basis if you collect it.
5. Stop and reassess if you receive a cease-and-desist — continued access after revocation is where scrapers lose in court.

For the technical side of collection, see What is web scraping? and How to scrape JavaScript-rendered websites. Scrapeshop customers remain responsible for compliance with target sites’ terms and applicable law — the same rule stated in our Terms of Service.