WEBROBOT

Is Web Scraping Legal? What Every Business Needs to Know in 2026

2026-06-24 · 8 min read · WebRobot field notes

SHORT ANSWER

Scraping publicly available data is generally legal in the United States. US courts have held that reading pages any visitor can reach without an account is not unauthorized access under the Computer Fraud and Abuse Act. The conditions are real, though: data behind a login or a paywall is a different legal category, terms of service you agreed to can bind you in contract, copyrighted expression stays copyrighted, and personal data is governed by GDPR and CCPA no matter how public it looks.

Run the robot

Last updated July 2026. This article is general information, not legal advice. Get advice from a qualified attorney about your specific situation before you start a scraping program.

Robot console · WR-01

Standing by Running · s Complete · rows

1 · Pick a target

3 · Fields to extract

Agent log

▌

Crawl graph

Extracted data · rows

Want this data fresh every morning, without lifting a finger?

01 / US CASE LAW FIG. 1 · WHAT COURTS SAID

What US courts have actually decided

Most of what people repeat about scraping law is folklore. Here is what the decided cases say, and just as importantly, what they do not say.

CASE 1

hiQ Labs v. LinkedIn

The Ninth Circuit held that automated collection of data from publicly accessible pages, ones that do not require creating an account, is unlikely to be access "without authorization" under the CFAA. It affirmed hiQ's preliminary injunction in 2019, and after the Supreme Court sent the case back for reconsideration in light of Van Buren, the Ninth Circuit reaffirmed that conclusion in April 2022.

The tail of the story matters more than the headline. In November 2022 the district court granted LinkedIn summary judgment on breach of contract: its user agreement banning scraping and fake accounts was enforceable. The parties then stipulated to a judgment and permanent injunction against hiQ. hiQ had used fake accounts to reach data that was not public. Public pages won. Everything hiQ did beyond them lost.

CASE 2

Van Buren v. United States

In June 2021 the Supreme Court, 6 to 3, narrowed the CFAA's "exceeds authorized access" clause. The Court framed liability as a gates-up-or-down question: either an area of a system is off limits to you or it is not. If you are entitled to access information, using it for a purpose the owner dislikes is not a federal computer crime.

For scrapers this killed the most aggressive theory in circulation, that breaching a terms of service line turns an ordinary HTTP request into a crime. It did not legalize everything. It moved the fight from criminal law to contract law.

CASE 3

Meta Platforms v. Bright Data

In January 2024 a federal judge in the Northern District of California ruled against Meta on its breach of contract claim, finding that the Facebook and Instagram terms did not bar logged-off scraping of public data, and that Meta could not bind a company that had closed its accounts.

The lesson is precise: terms of service bind users, and if you never log in, you may never be a user. That is a narrow doorway, not a highway, and it turns on the specific wording of the specific terms.

The counterweight is Ryanair v. Booking.com. In July 2024 a Delaware jury found that Booking.com had violated the CFAA in connection with access to the logged-in myRyanair area of Ryanair's site, though the damages were nominal and the verdict was later cut back on the statute's $5,000 loss threshold. Read the four cases together and one line separates them all: what is public, and what sits behind a login.

02 / RISK MAP FIG. 2 · WHERE THE RISK LIVES

Public data versus everything else

The question is almost never "is scraping legal". It is "which of these am I doing". Find your row.
What you are scraping Legal exposure Why
Public pages, no account needed Low The hiQ line of cases: no authorization gate means no CFAA "without authorization" problem. Facts like prices and specs are not copyrightable.
Public pages, but you clicked "I agree" to browse Moderate Contract, not crime. If a court finds you accepted the terms, an anti-scraping clause can be enforced against you. Meta v. Bright Data shows this depends heavily on the wording.
Behind a login you created High You accepted the terms. Anti-scraping clauses have been enforced against account holders, and the Ryanair verdict shows CFAA claims still land here.
Behind a login you do not own, or a bypassed CAPTCHA Do not do this Circumventing an access control is the clearest possible case of unauthorized access. Fake accounts sank hiQ.
Creative content: articles, photos, reviews Moderate to high Copyright attaches to expression. Collecting it to analyze is a different act from republishing it, and the second one is where suits start.
Personal data about identifiable people High GDPR and CCPA apply regardless of how public the source was. You need a lawful basis, notice obligations, and a deletion path.
Anything, at a request rate that degrades the site High Trespass to chattels and related claims turn on harm to the server. Volume converts a defensible activity into a demonstrable injury.
03 / IP FIG. 3 · COPYRIGHT AND DATABASES

Copyright, and the database right nobody in the US thinks about

Facts are free. Expression is not.

Feist Publications v. Rural Telephone Service (1991) is the anchor: the Supreme Court held that facts are not original to any author and therefore not copyrightable, and that a compilation earns protection only for its original selection and arrangement, never for the underlying facts. A phone book sorted alphabetically got nothing.

Applied to scraping: a price, a SKU, a job title, an address, a stock count. Those are facts. The 800 word product review somebody wrote is expression, and copying it wholesale into your own site is the thing that gets a letter.

In Europe, the database itself can be protected

The EU Database Directive (96/9/EC) created a sui generis right that has no US equivalent. If a maker put substantial investment into obtaining, verifying or presenting the contents of a database, they can prevent extraction or re-utilization of the whole or a substantial part of it, for 15 years, even where no individual fact is copyrightable.

Note the word substantial. Taking a small slice is generally outside the right. Systematically harvesting an entire European listings database is exactly what it was written to stop.

04 / PRIVACY FIG. 4 · PERSONAL DATA

GDPR and CCPA: public does not mean unregulated

This is the part that catches US teams, because the American instinct is that anything posted in public is fair game. Under GDPR that instinct is wrong, and the fines are not theoretical.

EUROPE

GDPR: you need a lawful basis and you must tell people

GDPR covers personal data about people in the EU whether or not the data was published openly. Scrapers normally rely on legitimate interest under Article 6(1)(f), which requires a documented balancing test against the rights of the individual. Article 14 then obliges you to inform people when you obtained their data from somewhere other than them, generally within a month.

Clearview AI is the cautionary tale: scraping public photos to build a facial recognition database drew fines from multiple European regulators, including 20 million euros from Italy's Garante and 30.5 million euros from the Dutch DPA, on findings that it had no valid lawful basis and failed its transparency duties.

CALIFORNIA

CCPA and CPRA: a real carve-out, with edges

California is friendlier. The CPRA excludes "publicly available information" from the definition of personal information, covering data lawfully made available from government records, and information a business reasonably believes the consumer lawfully made available to the general public or that came from widely distributed media.

The edges bite. Biometric data collected without the consumer's knowledge is not "publicly available" even when the source photo was. And once you combine public facts into a profile and sell it, you are in scope for a pile of obligations you probably have not built.

The practical rule for most business scraping: if the record is about a company (a price, a listing, a product, a store location) the privacy analysis is short. If the record is about a person (a name, an email, a photo, a profile) stop and get a lawful basis before a single request goes out. If you are running a program at scale, write the basis down and map those controls to a compliance program so the answer exists before someone asks for it in a security review.

05 / CHECKLIST FIG. 5 · COMPLIANCE PASS

The practical compliance checklist

None of this is exotic. It is the list a legal team will hand back to you anyway, so it is cheaper to build the program around it from day one.
Control What it means in practice
Honor robots.txtNot legally binding, but it is the site owner's stated wish and the first thing an opposing lawyer will screenshot. Read it, respect the disallow rules, log that you did.
Rate-limit yourselfOne request every second or two per host, one concurrent session, back off on 429s. Harm to the server is what turns a scraping dispute into a damages claim.
Stay on public pagesIf a human visitor needs no account to see it, you are in the zone the courts have protected. Cross that line only with legal sign-off.
Never bypass auth or CAPTCHAsCircumventing an access control is the fact pattern that loses. No fake accounts, no borrowed credentials, no CAPTCHA-solving pipelines.
Read the terms you acceptedVan Buren moved the risk from crime to contract, and contract still bites. If you have an account with the target, its terms apply to you.
Do not collect personal data without a basisCompany facts, low risk. People data, get a lawful basis, a notice plan and a deletion path before you start.
Take facts, not expressionPrices, specs and availability are facts. Article text, photos and reviews are somebody's copyrighted work. Analyze, do not republish.
Document your purposeWrite down what you collect, why, how long you keep it, and who sees it. Every serious inquiry starts with that question and a good answer ends it.

WebRobot is built to sit on the right side of that list: robots.txt honored, rate limits applied by default, and public-page crawling as the standard mode. You can read our security and compliance posture, or see how the agent behaves on a live site in the interactive demo. If an official API exists for what you need, take it: our web scraping vs API guide covers when that is the better route, and a no-code web scraper is often the fastest way to test whether the data is even worth the program.

06 / FAQ FIG. 6 · FIELD QUESTIONS

Web scraping legality questions

Generally yes, when you collect publicly available data from pages that do not require an account. In hiQ Labs v. LinkedIn the Ninth Circuit held that scraping public pages is unlikely to be access "without authorization" under the Computer Fraud and Abuse Act. Login-gated pages, personal data and contract terms are where the real risk sits.

Yes, but usually not for the scraping itself. Trouble comes from how you scrape and what you take: bypassing a login, breaching terms you agreed to, republishing copyrighted content, collecting personal data without a lawful basis, or hammering a site hard enough to degrade it. Public pages, gathered politely, are the safe zone.

That is the highest risk category. Once you create an account you accept the terms of service, and courts have enforced anti-scraping clauses against account holders. Ryanair won a 2024 jury verdict under the CFAA over scraping of its logged-in area. Treat authenticated scraping as a decision for your legal team, not your data team.

It can make it a breach of contract, which is a civil claim, not a crime. Van Buren v. United States (2021) narrowed the CFAA so that misusing access you legitimately have is not a federal computer crime. But a court granted LinkedIn summary judgment against hiQ on breach of its user agreement, and that ended the case.

No. robots.txt is a convention, not a statute, and ignoring it is not automatically unlawful. It still matters: it is the clearest evidence of what a site owner asked crawlers to do, and disregarding an explicit disallow makes every other argument you have look worse. Honor it as a matter of practice.

Facts are not copyrightable. Feist Publications v. Rural Telephone Service (1991) held that facts and unoriginal compilations get no copyright protection, so prices, addresses and stock levels are generally safe to collect. Copying creative expression such as full article text, photos or reviews verbatim is a different question.

Only with a lawful basis. GDPR applies to personal data even when that data is public. You typically need legitimate interest under Article 6(1)(f) plus a balancing test, and Article 14 requires you to notify people whose data you collected indirectly, usually within a month. Clearview AI was fined tens of millions of euros for getting this wrong.

Commercial purpose does not by itself make scraping unlawful. Competitive price monitoring, market research and lead enrichment are routine business practices. What changes the analysis is scraping behind authentication, republishing protected content, or building a product out of personal data you had no basis to collect.

Again, and it matters: this is general information about US and EU law as of July 2026, not legal advice, and no article can account for your jurisdiction, your target sites or your contracts. Talk to counsel before you build a scraping program on top of it. Want to see what a compliant crawl looks like? Start with the web scraping tool or check pricing.

FINAL ASSEMBLY

Scrape public data, properly

Rate limits and robots.txt honored by default. Describe the data you want and let the robot collect it the way your legal team would want it collected.