Is Web Scraping Legal in Australia? Privacy Act and Copyright (2026)

Web scraping is legal in Australia when you collect publicly accessible facts, do not defeat an access control, do not copy creative content beyond fair dealing, do not harvest email addresses for marketing, and handle any personal information in line with the Privacy Act 1988. No Australian statute bans scraping, and Australian copyright law is unusually generous to scrapers of factual data. The Privacy Act is where the real exposure sits, as the Clearview AI determination showed.

This guide covers the five laws that matter, the cases that interpret them, and the 2024 privacy reforms. General information current as of October 2026, not legal advice. The overview across jurisdictions is Is Web Scraping Legal? What the Law Actually Says.

Which Australian laws govern web scraping?

How does the Privacy Act apply to scraping?

The Privacy Act binds organisations with annual turnover above A$3 million and smaller entities in listed categories, and it applies to foreign companies that carry on business in Australia and collect information there. The Australian Privacy Principles govern every step. APP 3 requires that personal information be collected only where reasonably necessary for the entity’s functions and only by lawful and fair means; sensitive information, including biometric templates, requires consent. APP 5 requires notifying individuals at or before collection, or as soon as practicable afterwards.

Commissioner v Clearview AI (OAIC, October 2021; Administrative Appeals Tribunal, 2023). The OAIC determined that Clearview had breached APP 3 by collecting sensitive biometric information without consent and by unfair means, and APP 5 by failing to notify. The Tribunal upheld the core finding. The determination is the clearest Australian statement that scraping personal information from public websites is a regulated collection. The 2024 amendments increased maximum penalties to the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover, and created a statutory tort for serious invasions of privacy that commenced in June 2025.

Practical consequences: a scraper that collects names, photos, contact details, or employment information about identifiable people must have a documented purpose, limit collection to what is necessary, have a privacy policy that discloses the practice, and be able to answer access and correction requests.

Copyright: why Australia is friendly to data scrapers

Australian copyright requires a human author who exercised independent intellectual effort. Three decisions apply this to data:

• IceTV v Nine Network (High Court, 2009).Nine’s weekly programme schedules were not infringed by IceTV’s reproduction of time and title information, because the facts were not where the originality lay.
• Telstra v Phone Directories (Full Federal Court, 2010).Telstra’s White and Yellow Pages directories were not protected: they were compiled by automated processes with no identifiable human author.
• Fairfax Media v Reed International Books (Federal Court, 2010). Newspaper headlines are too short and functional to be literary works, and reproducing them in an abstracting service did not infringe.

Prices, listings, specifications, schedules and most directory data can therefore be scraped without a copyright problem. The limits remain: articles, product descriptions written by a person, photographs, and reviews are protected, and Australia has neither a text-and-data-mining exception nor a general fair use defence. Fair dealing for research or study is read narrowly for commercial actors. Analyse creative content; do not reproduce it.

When does scraping become a criminal offence in Australia?

Section 478.1 of the Commonwealth Criminal Code makes it an offence to cause unauthorised access to, or modification of, restricted data, defined as data held in a computer to which access is restricted by an access control system. A public web page is not restricted data. A page behind a login, a paywall, or a token-protected endpoint is. Section 477.3 separately criminalises unauthorised impairment of electronic communication, which a scraper that saturates a server could satisfy. State computer-offence provisions mirror these. Stay logged out, do not defeat access controls, and rate-limit, and the criminal provisions do not reach you.

The Spam Act trap: harvested email addresses

Sections 20 to 22 of the Spam Act 2003 prohibit supplying, acquiring or using address-harvesting software, and supplying, acquiring or using a harvested-address list, where the purpose is to send commercial electronic messages. This is a specific statutory bar on one scraping use case: building marketing lists. ACMA enforces it with civil penalties. Scraping email addresses for other purposes, such as enrichment of records you already hold with consent, sits under the Privacy Act instead, and the consent requirements for direct marketing under APP 7 still apply.

Checklist for scraping Australian websites

1. Scrape logged-out, public pages only. Never defeat an access control; section 478.1 turns on it.
2. Extract facts, listings, prices and specifications freely; do not reproduce articles, photos, or human-written descriptions.
3. Never scrape email addresses to send commercial messages.
4. If collecting personal information, document the purpose, limit fields, update your privacy policy, and be ready for access requests. Do not collect biometric or other sensitive information without consent.
5. Read the site’s terms. If you accepted them, honour the anti-scraping clause.
6. Rate-limit and identify your crawler; impairment is a separate offence.

Implementation guidance is in Web Scraping Best Practices.