Is Web Scraping Legal? Laws, Cases and Compliance Steps

Amna ManzoorLast Updated on November 6, 2026

9-10 Min Read TimeAdd as preferred on Google

Key Takeaways

Scraping public pages in the US generally does not violate the CFAA, but logins, personal data, copyright and agreed terms still create legal risk.

The Ninth Circuit ruled in April 2022 that scraping publicly accessible pages is likely not access "without authorization" under the CFAA, so CFAA risk centers on logins, blocks and other access barriers.
Contract claims remain even when the CFAA does not apply. A court found in November 2022 that hiQ breached LinkedIn's User Agreement through scraping and fake accounts.
GDPR and UK GDPR apply to personal data even when it is public, so scrapers need a documented lawful basis, and consent is only one of several.
Social platforms enforce their terms in court. In Meta v. BrandTotal, the defendants agreed to a permanent injunction barring them from scraping Facebook and Instagram.
Copyright and database rules can restrict reuse of scraped content, and fair use is limited and context-specific. Copying large amounts of content for commercial purposes likely would not qualify.
Risk falls with practices such as checking and recording terms, avoiding login-gated areas, minimizing personal data, following robots.txt, throttling requests and using official APIs where they exist.

Have legal counsel review projects that need login-gated data, personal data or copyrighted content before anyone builds the scraper.

Teams that need competitor prices or market data usually ask whether web scraping is legal before they build a scraper, and whether collecting this data could expose the company to a lawsuit. In the US, collecting publicly accessible pages generally is not 'unauthorized access' under the Computer Fraud and Abuse Act (CFAA). Risk rises when a scraper gets past a login wall, collects personal data, copies copyrighted content or breaks terms it has agreed to.

This article maps the laws, key cases and regional differences and ends with a checklist to run before a project starts. It is general information, not legal advice.

What Counts as Web Scraping?

Web scraping is the use of software to collect data from web pages automatically. E-commerce teams use it to monitor competitor prices and stock levels, research firms use it to build market datasets, and news and content services use it to aggregate articles. The use matters legally, because the type of data and how it is reused decide which laws apply.

Which Laws Decide Whether Web Scraping Is Legal?

Whether web scraping is legal depends on how the data is accessed, what the data is and how it is used. Five areas of law decide most cases.

Terms of Service and Contract Claims

Many websites have terms of service that prohibit scraping. Breaking those terms is generally not a crime, because the US Supreme Court in Van Buren (covered below) rejected reading federal computer-crime law so that every computer-use policy violation is criminal. Civil exposure remains.

A scraper that has agreed to terms banning scraping, for example by signing up for an account, can face a contract claim from the site. In the hiQ v. LinkedIn dispute, a court found in November 2022 that hiQ had breached LinkedIn's User Agreement through scraping and fake accounts.

Copyright and Scraped Content

Data protected by copyright law cannot be scraped and used without permission. This is particularly relevant for content-heavy websites such as news sites, blogs, and media outlets. Unauthorized scraping of such data can lead to copyright infringement claims.

In some cases, fair use exceptions may apply, but these are limited and context-specific. For example, using a small portion of data for commentary or criticism might be considered fair use, but copying large amounts of content for commercial purposes likely would not.

The General Data Protection Regulation (GDPR) in the EU and the UK GDPR apply to personal data even when it is publicly visible. Consent is one of several lawful bases for processing it. The UK Information Commissioner's Office (ICO) lists seven lawful bases and says none is better or more important than the others, and legitimate interests is a common alternative to consent.

A team that scrapes public personal data still needs a documented lawful basis and has to be transparent with the people concerned. Breaches can lead to regulator enforcement. In the US, the California Consumer Privacy Act (CCPA) also protects personal data, so scraped personal information can bring obligations there too.

The Computer Fraud and Abuse Act After Van Buren

The CFAA makes it illegal to access a computer without authorization. The Supreme Court's 2021 decision in Van Buren v. United States set limits on how far that reaches. It rejected reading the CFAA's 'exceeds authorized access' clause so that every computer-use policy violation is a crime, and it applied a gates-up-or-down test. A person either can or cannot access a system, or certain areas within it.

After reconsidering hiQ v. LinkedIn in light of that decision, the Ninth Circuit ruled in April 2022, at the preliminary injunction stage, that scraping publicly accessible pages is likely not access 'without authorization'. CFAA risk now centers on getting past logins, blocks or other access barriers.

Competition Law

Using scraped competitor data can raise unfair-competition questions in some situations. Projects that depend on heavy commercial reuse of a competitor's data need legal review before they launch.

How Do US, EU and UK Web Scraping Laws Differ?

In all three regions, the same kinds of data carry the most risk: anything behind a login, personal data, and content protected by copyright or database rights. The differences lie in which laws apply.

Is Web Scraping Legal in the US?

Scraping publicly accessible data in the US likely does not violate the CFAA, following the Ninth Circuit's 2022 ruling in hiQ v. LinkedIn. Contract claims remain, as hiQ found when a court held that it had breached LinkedIn's User Agreement. Copyright law and the California Consumer Privacy Act (CCPA) still apply to what is collected and how it is used.

Is Web Scraping Legal in the EU?

The EU has no general ban on web scraping. The GDPR applies to personal data even when it is public, and the Database Directive and the Digital Single Market Directive set database and copyright rules that can restrict how scraped content is extracted and reused.

Is Web Scraping Legal in the UK?

The UK has no general ban on web scraping, but data protection, copyright and computer misuse law all apply. According to the ICO's June 2025 announcement, the Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It amends, but does not replace, the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The Copyright, Designs and Patents Act and the Computer Misuse Act also apply to scraping projects in the UK.

Ready to ensure your web scraping practices are legal and ethical?

Download our Web Scraping Legal Compliance Checklist now!

Can Legal Action Be Taken to Prevent Web Scraping?

Yes. Site owners have won scraping cases, mostly under contract law and other general laws. No single US federal statute targets scraping as such, so claims rely on general laws like the CFAA and contract law. Each case turns on its own facts: how the data was accessed, whether the scraper agreed to the site's terms and what harm the site can show.

According to Meta's newsroom, Facebook sued BrandTotal, a marketing analytics company, and Unimania on October 1, 2020 for collecting data from its platform without permission. In a September 30, 2022 update, Meta said the court had granted summary judgment on a number of its claims, after which the parties settled. BrandTotal and Unimania agreed to a permanent injunction barring them from scraping Facebook and Instagram and paid a significant sum. The case shows that social platforms will take their terms to court against companies that scrape them.

What Did hiQ v. LinkedIn Decide About Scraping Public Data?

In April 2022, the Ninth Circuit ruled that scraping publicly accessible pages likely does not violate the CFAA. In November 2022, the district court found that hiQ had breached LinkedIn's User Agreement through scraping and fake accounts. For scrapers, the case means CFAA risk on public pages is lower, while contract exposure remains.

Which Data Protection Rules Have Changed for Scrapers?

As of October 2026, three changes matter for teams that collect personal data. India's Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received Presidential assent on 11 August 2023 and took the place of the earlier proposed Personal Data Protection Bill. In the EU, the Commission approved withdrawing the proposed ePrivacy Regulation at its meeting on 16 July 2025, so it is no longer a pending law. In the UK, the Data (Use and Access) Act 2025 amends existing data protection law, as covered in the UK section above.

How to Reduce Legal Risk When Scraping Websites

Teams can reduce most of the legal risk in a scraping project before the first request goes out. These best practices for web scraping address the risks covered above:

Check the site's terms of service before starting and keep a dated record of them. A scraper that has agreed to terms banning scraping can face a contract claim.
Stay out of login-gated areas unless the team is authorized to access them. Under Van Buren's gates-up-or-down test, getting past an access barrier is what creates CFAA risk.
Collect only the personal data the project needs and avoid sensitive personal information entirely. Where personal data cannot be avoided, document the lawful basis for processing it, and minimize or pseudonymize it where possible. These steps lower the risk but do not guarantee compliance on their own.
Follow the site's robots.txt file, which tells crawlers which parts of a site they can and cannot access.
Throttle requests so the scraper does not overload the site's servers or get blocked.
Use an official API where one exists. APIs are designed to handle data requests and often provide more reliable data.

For more information about the guidelines for website owners and web scrapers, read our previous blog on Ethical Web Scraping.

At Arbisoft, we do not provide data scraping services for platforms whose terms of service prohibit such activity. We also make sure our data collection does not breach GDPR and is always justified from a legal point of view.

What Are the Alternatives to Web Scraping?

The main alternatives to web scraping are open data, data feeds, partnerships, public APIs and licensed data from providers. These options reduce the legal questions a team has to answer, because the data owner has already set the terms of use.

Open data from governments, organizations and research institutions, released for public use and covering a wide range of topics.
Data feeds, such as RSS feeds, that websites offer for regular updates and that are intended for public use.
Partnerships with data providers or companies, set up through data-sharing agreements that benefit both sides.
Publicly available APIs that give structured access to a site's data. APIs are designed to handle data requests and often provide more reliable and up-to-date information than scraping.
Licensed data from providers that collect and license data for specific industries, often as curated datasets with documented collection methods and support.

How to Decide Whether Your Scraping Project Is Safe to Run

One decision rule covers most projects. In the US, scraping public, non-personal data without logging in, while following the site's terms, robots.txt and reasonable rate limits, is defensible in most cases after hiQ v. LinkedIn. The risk goes up when a project needs data behind a login, personal data or copyrighted content, or when the team has agreed to terms that ban scraping.

Have legal counsel review those projects before anyone builds the scraper, because choices about which pages to access, what to store and how long to keep it are hard to change later. The rules also differ across the US, EU and UK, so a project that collects data in several regions needs a check for each one.

If you are planning a data collection project, Arbisoft's web scraping services team can help you scope it so it stays within these limits.

Frequently Asked Questions About Web Scraping Legality

Scraping behind a login carries more risk than scraping public pages. Under the gates-up-or-down test from Van Buren, getting past an access barrier without authorization is what the CFAA targets. Creating or using an account also usually means agreeing to the site's terms, so a site that bans scraping can bring a contract claim as well.

Not always. Under the GDPR and UK GDPR, consent is one of several lawful bases. The ICO lists seven and ranks none above the others, and legitimate interests is a common alternative. Whichever basis a team relies on, it still has to document that basis and tell people how their data is being used.

Can a website sue a scraper if scraping does not break the CFAA?

Yes. A site can still sue for breach of contract if the scraper agreed to terms that ban scraping. In hiQ v. LinkedIn, the Ninth Circuit ruled that scraping public pages likely does not violate the CFAA, but a court later found that hiQ had breached LinkedIn's User Agreement through scraping and fake accounts. Copyright and privacy claims can also apply.

Is scraping LinkedIn or Facebook allowed after hiQ?

Both platforms have enforced their terms against scrapers. Meta v. BrandTotal ended with a permanent injunction barring the defendants from scraping Facebook and Instagram. Scraping either platform without permission carries real contract risk, so check the current terms and use an official API where one exists.