Is Web Scraping Legal in 2026? The Cases, the Lines, the Checklist
Scraping public data is broadly legal. Scraping personal data, copyrighted work, or anything behind a login is where it goes wrong. Here are the cases that drew the lines and a checklist to stay on the right side of them.
"Is web scraping legal?" is the wrong question, and it's why the answers online contradict each other. Scraping isn't one act — it's a tool, and its legality depends entirely on what you collect, how you access it, and what you do with it afterwards. The clear version: scraping publicly available data is broadly legal across the US, EU and UK, but personal data, copyrighted work, login-gated content and circumventing blocks are where cases get lost. This guide walks the rulings that drew those lines and ends with a checklist you can actually apply. It's informative, not legal advice — for a real decision, talk to a lawyer in your jurisdiction.
The short answer
There is no law that bans web scraping. A scraper requests public data the same way a browser does; both receive data the server chooses to serve and do something with it on their side. As long as the data is publicly available — you can see it without logging in — collecting it is generally lawful. The risk doesn't come from scraping itself; it comes from four things layered on top: personal data, copyright, terms of service, and how you access the site. Get those right and you're on solid ground.
The cases that drew the lines
A handful of rulings shape today's landscape, and it's worth knowing them because they're what courts actually cite:
- hiQ Labs v. LinkedIn (US). The 9th Circuit held that scraping publicly available data does not violate the Computer Fraud and Abuse Act — you can't "exceed authorised access" to a page that's open to everyone. This is the anchor for the position that public data is fair to scrape in the US.
- Ryanair v. PR Aviation (EU). Europe's highest court ruled that a site can restrict scraping through its terms of use, even for publicly available data. Scraping the data may be lawful, but doing so in breach of enforceable terms can be a contract problem — jurisdiction matters.
- Meta v. Social Data Trading (US). Meta sued a firm that used thousands of fake automated accounts to scrape Instagram and Facebook after being blocked. The lesson isn't "scraping social media is illegal" — it's that circumventing technical blocks and using fake accounts moves you from public-data collection into hacking-adjacent territory.
The through-line: publicly visible, openly accessible data is defensible; getting around a block, a login or an enforceable contract to reach it is not.
Personal data is the real line
If there's one thing to internalise, it's this: publicly available does not mean unregulated when the data is about people. Under the GDPR, all personal data is protected regardless of where it came from — a company was fined for scraping publicly available personal data from a public business register (the fine was later overturned, but the principle that public PII is still protected was upheld). Personal data is defined broadly: names, addresses, emails, phone numbers, even IP addresses and social handles. The GDPR applies to anyone processing EEA residents' data, wherever they're based.
The US is more permissive but moving in the same direction. California's CCPA, expanded by the CPRA in 2023, broadened what counts as protected personal information, though it treats data a person made public themselves more leniently than the GDPR does. Colorado and Virginia have passed similar laws. The practical rule everywhere: collect as little personal data as possible, avoid special categories entirely, and don't build a database of identifiable people without a lawful basis. Our deeper dive on GDPR and scraping personal data covers the lawful-basis question in detail.
Copyright and terms of service
Two more layers sit on top of privacy. Copyright: facts aren't protected — prices, specifications, stock levels, star ratings are fair to collect — but creative work is. Images, articles, songs, databases and long-form text can be copyrighted, and republishing them may infringe even if scraping them didn't. Terms of service: as Ryanair established, a site's terms can prohibit automated collection, and a "clickwrap" agreement you actively accepted is far more enforceable than a "browsewrap" notice buried in a footer. Breaching enforceable terms is a contract risk, not a criminal one, but it's a risk. The safe move is to check the target's terms before you build a pipeline around it.
A compliance checklist
Before a scrape, run through this. It maps directly to the risks above and to the ethical-scraper principles legal scholars propose — collect public, factual data; be a good citizen of the web; and build something transformative rather than a copycat:
- Is it public? No login, no paywall, no block to get around. If you'd need credentials, stop.
- Is it personal data? If it identifies people, minimise, get a lawful basis, and avoid special categories. When in doubt, don't collect it.
- Is it copyrighted? Scrape facts freely; be careful republishing images, articles or media.
- What do the terms say? Read them. Breaching enforceable terms is a contract risk.
- Are you polite? Rate-limit, scrape off-peak, and don't degrade the site's service for real users.
- Is your purpose transformative? Building analysis or a new product is defensible; cloning the source to steal its users is not.
Being polite is also a compliance signal, not just courtesy — overloading a server strengthens any claim against you. Our guide on robots.txt and scraping ethics and our guide to choosing ethical proxy providers both go deeper on doing this responsibly.
Collect public web data compliantly with Scraper API
How infrastructure keeps you compliant
Good tooling makes the right thing the easy thing. Rate-limiting and rotating residential proxies let you spread requests so you never hammer a single server — the politeness the checklist asks for. A Scraper API that only fetches public pages and returns clean structured data keeps you out of the login-circumvention trap by design. None of this substitutes for legal judgement about what you collect and why, but it removes the technical shortcuts that turn a defensible scrape into an indefensible one.
Frequently asked questions
Is web scraping legal in the US?
Scraping publicly available data is broadly legal in the US, and courts have held it doesn't violate the CFAA. The risks are copyright (don't republish protected work), privacy laws like the CCPA/CPRA (be careful with personal data), and terms of service (breaching enforceable terms is a contract risk). Circumventing blocks or logins changes the analysis.
Is web scraping legal in Europe?
Yes for publicly available, non-personal data — but the GDPR protects all personal data regardless of source, so scraping identifiable information about people needs a lawful basis. The EU Database Directive and site terms can also restrict collection. In practice, avoid personal data, respect terms, and treat the EU as the strictest jurisdiction you operate in.
Is web scraping legal for personal use?
Personal and academic use generally faces lower risk than commercial use, but the same lines apply: stick to public data, avoid personal information and copyrighted material, respect the site's terms, and don't overload the server. "For personal use" is not a blanket exemption — it just tends to lower the stakes and the likelihood of a dispute.
Is it legal to scrape LinkedIn?
The hiQ case supported scraping LinkedIn's publicly visible data without logging in, but LinkedIn's terms prohibit automated collection and much of the useful data sits behind a login. Scraping public profiles you can see without an account is the defensible edge; using fake accounts or bypassing authentication is where cases have been lost, as Meta's litigation showed.
Web scraping is a lawful tool with clear boundaries: public and factual is defensible, personal and copyrighted and login-gated is where the risk lives. Know the cases, run the checklist, minimise personal data, respect terms, and scrape politely. Do that, and you spend your energy on the data instead of the disputes — this is general information, so confirm the specifics for your project with a lawyer.