Is Web Scraping Legal? Laws, Cases & Compliance (2026 Guide)

Is web scraping legal? The legality of web scraping comes down to four things: what you scrape (public product prices vs. personal profiles), how you scrape it (public pages vs. behind a login), where you operate (the US’s CFAA logic vs. Europe’s GDPR), and what you do with the data (price monitoring vs. AI training). So when people ask “is it legal to scrape data from websites,” the honest answer is that scraping publicly available, non-personal data is broadly legal in most jurisdictions — but each of those factors moves you between defensible business practice and regulatory action. This guide walks the landmark cases, the 2025–2026 AI-era lawsuits, every major regulator’s position, and a practical compliance framework.

One thing up front: this is general information, not legal advice. Before scaling a commercial scraping pipeline, seek legal advice in your jurisdiction and your targets’.

The Short Answer, by Question

Common Myths About Web Scraping Legality

Most confusion about the legality of web scraping comes from mixing up technical ability with legal permission. Three myths are worth clearing up before the details.

Myth 1: Web Scraping Is Hacking

Scraping a public page isn’t unauthorized access — a bot requests the same page a normal browser does. The US Ninth Circuit’s hiQ v. LinkedIn (2022) held that public-page scraping likely doesn’t violate the CFAA where no authentication gate is bypassed. People also ask “is screen scraping legal?” — same answer: reading a public page the way a browser does isn’t “hacking.”

Myth 2: “Public Data” Means Free to Take

Public doesn’t mean unrestricted. Personal data stays protected even when it’s openly visible — Europe’s regulators fine for scraping public personal data. Copyright still covers public articles and images. And terms of service can bind you even without a login. So the real question — is data scraping legal? — depends heavily on what the data actually is.

Myth 3: Violating ToS Is a Crime

Breaching terms of service is a civil matter, not a criminal one. Violating ToS isn’t automatically illegal — but it’s grounds for being blocked, a basis for a civil lawsuit, and evidence of bad faith in court. More on web scraping terms of service below.

United States: the CFAA, hiQ, and the Contract Layer

The foundational question — is website scraping legal in the US? — came down to whether scraping public pages is “unauthorized access” under the Computer Fraud and Abuse Act — the anti-hacking statute. The Ninth Circuit answered in hiQ Labs v. LinkedIn (2022, applying the Supreme Court’s Van Buren logic): no. Where a page is open to anyone without credentials, there is no authorization gate to breach, so public-data scraping is not a CFAA violation.

But hiQ’s full story is the real lesson. After winning the CFAA battle, hiQ lost the war: in November 2022 the court found it had breached LinkedIn’s User Agreement (which it had accepted by creating accounts), and the case ended in a consent judgment. The CFAA protects you from hacking claims on public pages; it does not protect you from contracts you’ve agreed to.

Meta v. Bright Data (January 2024) sharpened the line: a court declined to find Bright Data in breach for scraping public, logged-out Facebook and Instagram pages, since the platforms’ terms govern account holders, not logged-out visitors. The rule that emerged — logged-out public scraping is defensible; logged-in scraping against accepted terms is not. Older trespass-to-chattels cases (eBay v. Bidder’s Edge, 2000) still bite at extreme volumes, and state privacy laws (California’s CCPA/CPRA, Virginia’s VCDPA) add personal-data obligations on top.

Terms of Service: Browsewrap, Clickwrap, and When Rules Become Legal Risk

Terms of service aren’t law, but courts weigh them heavily — and the key question is whether the user actually accepted them.

Browsewrap vs. Clickwrap: Which ToS Actually Binds You

A browsewrap agreement is just a link sitting somewhere on the page with no active acceptance — courts rarely enforce it against someone who never clicked. A clickwrap agreement requires an explicit action — a checkbox or an “I agree” button — and courts enforce it almost every time. The practical line: terms you actively accepted (usually by creating an account) bind you; terms you merely could have seen often don’t.

When ToS Violations Become Legal Evidence

Violating web scraping terms of service isn’t a criminal offense, but it has three practical consequences: the platform can block you immediately, it’s a basis for a civil breach-of-contract suit (the claim that ultimately sank hiQ), and it reads as bad faith if a CFAA or related claim reaches court.

The AI Era: 2025-2026 Lawsuits That Changed the Map

AI training created a second wave of scraping litigation — less about “was access authorized” and more about contracts, licensing, and copyright (the same questions that shape proxies for AI training data collection):

• Bartz v. Anthropic (June 2025, Judge Alsup): training an LLM on lawfully obtained books is “exceedingly transformative” fair use — but the ruling explicitly carved out pirated source copies. How you obtained the data matters as much as what you did with it.
• Kadrey v. Meta (June 2025, Judge Chhabria): plaintiffs lost on the record they brought, but the opinion warned this was not broad permission for AI training — a narrow win, not a doctrine.
• Reddit v. Anthropic (filed June 2025): Reddit sued over terms-of-service and unjust-enrichment theories, not copyright. In late March 2026 a federal judge remanded the case to California state court, holding the claims aren’t preempted by the Copyright Act — confirming contract-based scraping claims have independent life.
• Reddit v. Perplexity, SerpApi, Oxylabs & AWMProxy (Oct 2025, S.D.N.Y.): the first case to name scraping infrastructure vendors as co-defendants alongside the AI company. For proxy buyers, the takeaway is about supply chains: who collects your data, and how, is now part of your legal exposure.
• NYT v. OpenAI (consolidated, S.D.N.Y.): in January 2026 the court ordered OpenAI to produce a 20-million-conversation log sample in discovery; the case tests whether model “regurgitation” undermines fair use.
• The licensing economy is the flip side: Reddit licenses data to Google (~$60M/yr) and OpenAI; Cloudflare and Stack Overflow launched pay-per-crawl. “Free to scrape” and “licensed to train” are diverging tracks.

Europe: GDPR and the Strictest Regulators

In the EU (and the UK), the question is rarely “was access authorized” — it’s “did you process personal data without a lawful basis?” Under the GDPR, scraping any data that identifies a person (names, photos, profiles, contact details) is “processing,” and “it was public” is not a lawful basis by itself. The enforcement record is unambiguous:

• Netherlands (AP) — the hardest line in Europe. Its May 2024 guidance calls scraping personal data “almost always a violation of the GDPR,” and it fined Clearview AI €30.5 million, with directors warned of personal liability.
• Italy (Garante) — fined Clearview €20 million; its stated principle: “if it’s public, I can take it” is false.
• France (CNIL) — fined contact-data broker KASPR €240,000 (Dec 2024). Its June 2025 guidance allows scraping public personal data under legitimate interest — but only with safeguards (exclusion lists, minimization, transparency).
• UK (ICO) — fined Clearview £7.5 million; the UK GDPR plus the Data (Use and Access) Act 2025 keep the framework aligned with the EU’s.
• EU-wide: the Database Directive adds a separate sui generis right against extracting substantial parts of protected databases — a claim that exists in Europe but not the US.

The crucial nuance: none of this targets non-personal data. Prices, product listings, availability, and rankings are outside the GDPR’s scope — European price-intelligence and SEO pipelines run legally every day. The risk map below shows how personal-data scraping risk varies by jurisdiction.

Beyond Europe and the US, the picture for personal-data scraping ranges from strict to softening:

Every country guide in our blog library — from Germany to Japan — carries a fact-checked local legal section if you need depth on a specific market.

Copyright Law: What You Can and Cannot Scrape

Copyright is one of the most common sources of legal trouble in scraping — but most business use cases sit in a safe zone once you separate facts from creative content.

What’s Protected and What’s Not

Facts aren’t copyrightable — prices, ratings, availability, and specifications are free to collect, which is why scraping product data is a safe zone. What is protected: articles, photos, videos, original text, and the creative selection or arrangement in a database. Republishing those wholesale is where copyright-infringement claims arise; the US Digital Millennium Copyright Act (DMCA) comes in separately — when you bypass access controls or strip copyright-management information, not from republication alone.

Fair Use (US) and the DSM Directive (EU): When Scraping Copyrighted Content Is Allowed

In the US, fair use weighs four factors: the purpose of the use (transformative or merely commercial?), the nature of the work, how much you take, and the effect on the market — with Authors Guild v. Google (Google Books) the classic precedent for transformative use. In the EU, the DSM Directive permits text and data mining where you have lawful access and the rightsholder hasn’t opted out (often signalled via robots.txt). Both leave room to scrape copyrighted content for analysis — neither licenses wholesale republication.

What’s Defensible vs. What’s Risky

Not every scrape carries the same risk — it depends on the data type, how you access it, and what you do with the result. The two lists below place your project quickly.

Generally defensible

• Public, read-only collection of non-personal data: prices, product specs, stock, rankings, search results, flight fares, real-estate listings
• Logged-out access only — nothing behind authentication
• Human-paced request rates that don’t burden the target’s infrastructure
• Honoring robots.txt and published crawl policies
• Competitive intelligence, market research, SEO monitoring, ad verification, academic research on aggregates

Risky to indefensible

• Scraping personal data — names, photos, emails, phone numbers, profiles — especially at scale, especially in Europe
• Scraping behind a login, against terms you accepted (the hiQ contract lesson)
• Bypassing technical barriers: CAPTCHAs presented as access controls, IP blocks aimed at you specifically, paywalls
• Republishing scraped content wholesale (copyright), or extracting substantial parts of protected databases (EU database right)
• Volume that degrades the target site (trespass-to-chattels exposure)
• Training AI on content you obtained from pirated or terms-breaching sources (Bartz‘s carve-out)

A Compliance Checklist for Scraping Teams

1. Scope the data. If a field can identify a person, treat it as regulated: either drop it, or establish a GDPR lawful basis with documented safeguards (CNIL’s 2025 legitimate-interest sheet is the best template).

2. Stay logged out. Public pages only. The moment you authenticate, you’ve accepted a contract — and contract claims are the ones that win.

3. Respect the site’s signals. robots.txt, rate limits, crawl-delay. Not always legally binding, but the first thing a court or regulator looks at.

4. Engineer for restraint. Human-paced cadence, caching to avoid re-fetching, no hammering. Volume is what turns a scraping dispute into a trespass claim.

5. Mind the supply chain. Reddit v. Perplexity named the scraping vendors, not just the AI buyer. Know how your data providers collect.

6. Separate collection from use. Lawful collection doesn’t license every use: republishing, database extraction, and AI training each carry their own analysis.

7. Get counsel before scale. A pipeline that’s fine at 1,000 requests/day may need review at 10 million.

8. Choose ethically sourced proxy infrastructure. The important thing isn’t the tool but its sourcing: proxies are legal, but ethical web scraping extends to how the IPs are obtained. Consent-based, ethically sourced residential proxies keep your collection layer defensible if anyone asks about your supply chain.

Summary

So, is web scraping legal? Scraping publicly available, non-personal data is broadly legal and defensible — the three biggest risks are personal data (GDPR and its global equivalents), access against accepted terms (the contract claims that beat hiQ and now drive the AI-era suits), and copyright on creative content. Stay logged out, collect non-personal data, honor robots.txt, and separate collection from use. After 2026, supply chain is part of compliance too: where your data — and your proxies — come from is now part of the legal picture. For the infrastructure side, see best proxies for web scraping. This remains general information, not legal advice — seek legal advice for your specific case.

Last updated: June 24, 2026.