CCPA Web Scraping: Public Data, Business Thresholds and Compliance

For CCPA web scraping, the answer is conditional: scraping does not automatically violate California privacy law, but a covered business collecting personal information must meet applicable obligations. Qualifying publicly available information is excluded from the CCPA’s personal-information definition; a page loading without authentication does not establish that qualification. See the California privacy agency’s scope guidance.

Review the dataset, the business and the intended use together. This legal orientation, dated October 20, 2026, explains how developers and privacy reviewers can classify fields, identify duties and record a collection decision. It is not a compliance certification or a measured scraping tutorial.

When does CCPA web scraping fall within the law’s scope?

Start with the business definition and California connection, then classify the information. Neither the scraper’s server location nor the absence of a California office settles applicability.

The core definition covers a for-profit entity doing business in California that determines the purposes and means of processing consumers’ personal information and meets at least one threshold:

• Annual gross revenue in excess of $26,625,000 in the preceding calendar year.
• Annually buying, selling or sharing personal information of 100,000 or more consumers or households, alone or in combination.
• Deriving 50% or more of annual revenue from selling or sharing consumers’ personal information.

The revenue figure comes from the CPPA’s monetary adjustment; the comparator and alternative tests come from Civil Code section 1798.140(d). Do not substitute total page requests for people or households, or assume every collection counts as buying, selling or sharing.

CPRA amended the CCPA rather than replacing it with a separate compliance regime. California’s temporary employment and B2B exemptions expired at the end of 2022, so professional contact information needs review too. Certain affiliates and joint ventures can also fall within scope, while service providers and contractors have separate duties. The CPPA applicability FAQ explains these distinctions.

Record the entity, relevant revenue year, counting method and role. A small project inside a covered enterprise does not become exempt merely because its own dataset is small.

What does “publicly available” mean for CCPA web scraping?

Public availability is a legal classification supported by evidence about publication and audience. It is not an HTTP response status.

Section 1798.140(v) includes lawfully accessible government records and information the business reasonably believes was lawfully made public by the consumer or through widely distributed media. It also addresses onward disclosure where the consumer did not restrict the audience. Biometric information collected without the consumer’s knowledge does not qualify through this exclusion. Read the statutory personal-information definition.

• Public professional profile: Check who published it and whether the relevant fields were intentionally public. A profile label alone proves little.
• Personal email address: A deliberate public posting and a leaked mailing list require different conclusions, even if both appear in search results.
• Restricted audience: Treat access settings and the original disclosure context as evidence. A repost does not automatically remove the original restriction.
• New inference: Reassess a health, financial or behavioral label created from source material. Do not assume its classification matches the inputs.

For each field, retain a short classification record: source, observation date, publication context, audience evidence and exclusion rationale. Separate uncertain fields from approved ones before enabling recurring collection.

For example, an organization directory can mix company categories with named employees and inferred purchasing authority. Review those separately. Calling the whole table public obscures the actual decision and makes later corrections harder.

How can teams assess a scraping project before collecting data?

Use the 5-step Collection Scope Check to turn legal questions into an explicit collection decision. This is an operational review framework, not a statutory safe harbor.

Step 1: Purpose. Describe the output and its users. Comparing organization categories, selling contact records and ranking job candidates are different projects even when they start with the same pages.

Step 2: Jurisdiction. Identify affected residents, business connections and controller or processor roles. Record uncertain geography instead of treating a website’s domain or hosting country as the person’s residence.

Step 3: Fields and source. Create a field allowlist. Document public-availability evidence, sensitive attributes, audience restrictions and planned inferences. Ask whether organization-level information can answer the business question without individual identifiers.

Step 4: Obligations. Assign owners for notices, requests, retention, contracts, opt-outs and any required assessment. Trace the data into exports, analytics stores and downstream recipients.

Step 5: Documented decision. Record proceed, narrow or stop, with reasons, reviewer and review date. Reopen the decision when sources, fields, recipients or purposes change.

Consider an illustrative directory project: retain organization and category, exclude personal email and phone, and prohibit individual scoring. That narrower design is a proposal to evaluate, not a test result or proof of compliance. No performance or storage-reduction claim is made here.

Make the review actionable by linking each approved field to its business use. If nobody can explain why a field is necessary, remove it from the collection plan. Include logs and temporary storage in that discussion: dropping an identifier from the final table does little if it remains elsewhere.

Our ethical web scraping guide adds operational practices that complement this scope check.

What notices, rights and controls apply?

Indirect collection is not a blanket exemption. Determine the notice rule, consumer rights and transfer controls for the actual processing arrangement.

Under section 7012(h), a business that neither collects nor controls collection directly from the consumer need not deliver a Notice at Collection if it neither sells nor shares that information. Section 7012(i) has a separate registered-broker route involving a linked privacy policy and opt-out instructions. These exceptions do not remove every other duty. See the current CCPA regulations.

Covered businesses must address access, correction and applicable deletion rights. Acknowledge requests to know, correct or delete within 10 business days; generally respond within 45 calendar days, with a permitted extension where requirements are met. Sale/sharing opt-outs follow a different timetable, generally no later than 15 business days. The Attorney General’s CCPA guidance explains the rights and exceptions.

Collection, use and retention must be reasonably necessary and proportionate. Required contracts must reflect recipient roles. Businesses selling or sharing information must honor qualifying opt-out preference signals, including GPC, under the CCPA regulations.

Translate these requirements into engineering controls:

• Maintain source and recipient lineage for each dataset.
• Set retention periods with an owner and deletion job.
• Route requests across production data, exports and applicable downstream systems.
• Record exceptions narrowly, with reasons and review dates.
• Keep suppression controls separate from marketing or analytical reuse.

Do not equate sharing with every disclosure: CCPA sharing concerns cross-context behavioral advertising, while a sale can involve valuable consideration beyond cash. The AG’s sale and sharing explanation helps classify transfers. For ownership and review responsibilities, see our guide to reducing scraping-related legal risk.

When does scraping make a business a data broker?

Scraping alone does not establish broker status. California’s definition generally concerns a qualifying business knowingly collecting and selling personal information about consumers with whom it lacks a direct relationship, subject to exclusions.

A contact-data resale operation should therefore review broker status before distribution. Registration is annual, generally beginning the year after brokering starts, with a January 31 deadline. Separate DROP account and access requirements also matter for newly operating brokers. The CPPA broker guidance explains both.

Beginning August 1, 2026, brokers must access DROP at least every 45 days and process applicable deletion requests. The mechanism reaches relevant information held by the broker and its service providers or contractors, subject to exceptions. Build downstream instructions and recurring suppression into the workflow rather than treating deletion as a one-time database operation.

Risk assessments are a separate question, not an automatic consequence of using a scraper. California’s rules cover specified processing presenting significant privacy risk. Relevant continuing activities begun before January 1, 2026 have a December 31, 2027 assessment deadline; new covered activities require earlier assessment under sections 7150 and 7155.

The CPPA implementation announcement distinguishes the January 1, 2026 regulatory effective date from later deadlines, including January 1, 2027 compliance for covered automated decisionmaking requirements. Do not treat a later reporting deadline as permission to postpone all controls.

Which US state privacy rules change the decision?

A California conclusion cannot stand in for a nationwide review. State laws differ in covered entities, counting rules, public-data treatment and sensitive-data restrictions.

Selected state comparison, October 20, 2026. These are principal screening thresholds, subject to nexus requirements, exclusions and specialized provisions. Counts concern relevant residents, not total records.

Three differences deserve explicit implementation tickets. Maryland ties minimization to a consumer-requested product or service and imposes a stricter necessity rule for sensitive data under section 14-4707. Oregon banned precise-geolocation sales starting January 1, 2026, according to its consumer guidance. Colorado requires assessments for specified processing and recognition of universal opt-out mechanisms under its privacy framework.

Rhode Island’s public-information definition also requires lawful availability. Keep these classifications jurisdiction-specific rather than assigning one global public flag.

How does GDPR differ from CCPA for scraped data?

GDPR does not offer a general exclusion for personal data simply because it is public. A dataset outside CCPA’s personal-information definition may still require GDPR analysis.

See GDPR Articles 3, 6, 14 and 17. Article 14 generally requires information within one month, or earlier at first communication or disclosure where applicable. Large collection volume is not an automatic notice exemption.

The CNIL’s scraping guidance explains safeguards when relying on legitimate interests for AI development. It considers publication context and reasonable expectations, including technical opposition to scraping. This is a conditional analysis, not blanket approval.

For a combined review, document territorial scope, field classification, lawful basis where required, notice route, sensitive-data treatment, rights handling and recipient restrictions. Keep the CCPA exclusion rationale separate from the GDPR lawful-basis assessment so neither silently substitutes for the other.

How do AI training, social media and sensitive datasets change risk?

Purpose and derived outputs can change the analysis even when the source stays the same. Escalate training datasets, individual profiles and eligibility decisions before collecting broadly.

AI and social media: Specify the model’s intended use, source categories, filtering and rights-handling design. The CNIL’s AI recommendations emphasize lawful collection and safeguards. An engineering review should also ask whether downstream outputs can expose individuals or undermine restrictions attached to source records.

Health inferences: Washington’s My Health My Data Act can reach health information inferred from nonhealth purchases. Its rules extend beyond HIPAA contexts, and sales require valid authorization. See the Washington AG’s health-data guidance. Do not dismiss a health score because the input was an ordinary consumer purchase.

Biometrics: Illinois BIPA section 15 requires advance written information about collection, purpose and duration, plus a written release, for covered biometric collection. Review the Illinois statutory text before turning images or recordings into identifying measurements.

Eligibility and children: Selling consumer information for employment, credit or insurance decisions can trigger FCRA duties, as the FTC’s broker warning explains. COPPA applicability depends on covered operators and collection involving children under 13, not merely a dataset’s size. Consult the FTC’s COPPA FAQ.

Use a separate approval record for sensitive enrichment. Excluding an original identifier while retaining a linkable health or eligibility score does not resolve the underlying risk.

What other legal issues and collection alternatives matter?

A favorable privacy classification does not resolve access, contractual or intellectual-property questions. Review those issues before choosing collection infrastructure.

In its 2022 hiQ v. LinkedIn opinion, the Ninth Circuit addressed a preliminary injunction and the CFAA’s application to publicly accessible pages. It did not establish unrestricted scraping rights or decide every contractual and privacy claim. Treat that holding as a narrow access-law analysis, not a permission slip for an entire project.

Contracts can create separate exposure. Review applicable terms, assent and permitted reuse against the actual collection method; avoid relying on a generic statement that public pages are unrestricted. Preserve the relevant version for review. The same project may also involve copyrighted material, personal data and contractual restrictions, each requiring its own conclusion.

For European databases, the Database Directive can restrict extraction or reuse of substantial protected contents. Database rights and personal-data obligations address different interests. Our general scraping legality overview places these questions alongside other legal considerations.

DataImpulse supplies proxy infrastructure, not a scraping API, managed unblocker, VPN or datasets. Customers remain responsible for collection and use. Review residential proxy legality and proxy-provider ethics after documenting the collection decision.

Document the collection decision before choosing infrastructure

If authorized collection needs proxy transport, consider DataImpulse after completing the scope check. Keep responsibility for fields, purposes, retention and consumer requests with the collection team.

This article supports project review rather than replacing tailored legal advice: the reader decides, check local law.

Last updated: October 20, 2026.