Your scraper is written. The CSV looks great. Then a thought stops you before you hit run: could this get you sued?
Short answer: web scraping is legal in most places when you collect public data, logged out, at a polite pace. The trouble starts with four moves: logging in, beating anti-bot blocks, collecting personal data, and republishing someone’s content.
We read the rulings and regulator decisions behind that answer, up to October 2026. One of those four moves is where this year’s biggest lawsuits are being fought.
Is web scraping legal? Check your scenario first
Scraping isn’t legal or illegal as a whole. What you collect, how you get it and what you do with it decide the risk. Here’s how common jobs stack up under US and EU rules as of October 2026.
| What you’re scraping | Risk | Why |
|---|---|---|
| Competitor prices on public product pages, logged out | Low | Public facts, no account, no personal data |
| Public job listings or real estate ads for a market report | Low | Facts you summarise, not copy |
| Google results through a tool that beats Google’s bot checks | Unsettled | Two live lawsuits over getting past bot protection |
| LinkedIn profiles from a logged-in or fake account | High | You agreed to terms that ban it, and LinkedIn enforces them |
| Names and emails of EU or Indian people for cold email | High | Privacy law covers public personal data too |
| Full articles or photos to republish on your site | High | Copyright protects the writing, not just the facts |
Most everyday jobs sit in the first two rows. If yours lands in the bottom three, read the rest before you press run.
Public pages, logged out: what the courts have said
In the US, scraping pages anyone can see without logging in isn’t hacking. Three cases built that answer.
Van Buren v. United States (2021) came first. The Supreme Court read the US anti-hacking law, the Computer Fraud and Abuse Act, as a gate: either you’re allowed through or you aren’t.
Using data you can already reach, for a reason the owner dislikes, isn’t a crime under it.
A year later, an appeals court applied that to hiQ v. LinkedIn. A public profile has no gate, so scraping it wasn’t access without authorization.
Then Meta sued Bright Data, a data company that had sold a set of 615 million Instagram records for $860,000. In January 2024 the judge ruled that Meta’s terms didn’t cover logged-out scraping of public pages. Meta dropped the case and gave up its appeal. X lost a similar suit against Bright Data four months later.
Our take: public and logged out is the safest ground scraping has. It isn’t a free pass, because three other laws still apply. And hiQ, the company that won the hacking argument, still lost the war.
The moment you log in, the terms bind you
Logging in turns a website’s terms of service into a contract you signed. That’s how LinkedIn beat hiQ in the end.
hiQ won the hacking question, but it had also used fake accounts to see more than the public could. In late 2022 a court found that broke LinkedIn’s user agreement. hiQ settled with a $500,000 judgment, a ban on scraping LinkedIn and an order to delete the data.
So what about terms you never clicked “I agree” on?
They’re much weaker. The Meta ruling turned on exactly that: a logged-out visitor never accepted the rules that bind logged-in users.
The EU can be stricter. In Ryanair v. PR Aviation (2015), the EU’s top court let a site restrict scraping by contract when its data wasn’t protected as a database.
Planning to scrape a site where you hold an account? Read its terms first. Our LinkedIn scraper tools roundup shows how much data those tools reach, and the account risk that comes with it.
Where the 2026 fights are: getting past the bot checks
The newest lawsuits don’t argue about scraping at all. They target getting around the systems built to stop bots, under the anti-circumvention part of US copyright law, the DMCA.
Here’s the catch. Two federal judges have looked at nearly the same facts this year and gone in opposite directions.
- Google v. SerpApi (California). Google says SerpApi beat SearchGuard, its bot-detection system. In July 2026 the judge threw out the claims covering ordinary search results, because the law only protects copyrighted works and search results are mostly facts. Google refiled over the copyrighted bits, like Knowledge Panel images. That fight is still open.
- Reddit v. SerpApi, Oxylabs, AWMProxy and Perplexity (New York). Reddit says the four scraped its posts through Google by disguising bots as people. In July 2026 the judge let most of the anti-circumvention claims go ahead to discovery.
Oxylabs, a proxy provider, is still in that case. Being named in a lawsuit isn’t the same as losing one. It does show who gets pulled in when bots are accused of breaking through.
What does that mean for you? Solving CAPTCHAs, faking browser fingerprints and rotating thousands of IPs to dodge a ban is now the risky part. It’s the behaviour in the complaint, not the scraping itself.
Public personal data is still personal data
Privacy law doesn’t care that a page was public. In the EU, the GDPR applies the moment you collect anything that identifies a person, including names, work emails and profile photos.
Regulators have fined on exactly that point:
- Bisnode, Poland, 2019. Just over PLN 943,000 for taking business owners’ details from public registers without telling the people involved. The top court upheld that duty in 2023.
- Clearview AI, Netherlands, 2024. €30.5 million for scraping faces from public photos to build a recognition database.
- Meta, Ireland, 2022. €265 million for failing to stop scrapers pulling data on about 533 million users. The site that leaked got fined, not just the scrapers.
The ceiling is €20 million or 4% of worldwide yearly turnover, whichever is higher. A side project that scrapes 10,000 EU emails for outreach sits under the same law as Clearview.
India is moving the same way. The Digital Personal Data Protection Act skips data a person made public themselves, like their own public post. Data visible on someone else’s directory doesn’t get that pass. The Act’s main rules apply from about May 2027, with penalties up to ₹250 crore.
Collecting emails for sales? Our email scraping tools guide covers the tools. Whichever you use, you need a lawful reason to contact each person, an opt-out and a deletion date.
Copyright: facts are free, the writing isn’t
You can scrape facts. You can’t republish someone’s expression of them.
A price, a stock count, a flight time or an address is a fact, and US law has said since 1991 that nobody owns facts. A product description, a review, a news article or a photo is creative work. Copy it wholesale onto your own site and the scraping is no longer the problem; the copying is.
Price tracking across 500 product pages is fine. Pulling those 500 product descriptions into your own store isn’t.
AI training is the open question. US courts are still split on whether training counts as fair use. The EU lets site owners opt out of text and data mining with machine-readable signals, so treat any opt-out as a hard stop for a training dataset.
Does robots.txt make scraping illegal?
No. Robots.txt is a request, not a law. Its own standard, RFC 9309, says the rules aren’t a form of access authorization.
It still matters in two ways. In a dispute, ignoring a clear disallow makes you look like the bad actor. In the EU, a robots.txt block can count as the machine-readable opt-out from data mining mentioned above.
Our rule: if robots.txt disallows the paths you want, ask for permission or skip them. The allowed pages usually cover the job.
Five checks to run before your next scraping job
Run these in order. Any “no” means stop and rethink the job, not add more proxies.
The pre-scrape legal check
Two minutes per job, and it catches nearly every risky one
-
Step 1 of 5
Is the data public without a login?
If you need an account, the site’s terms are a contract. Read them for a scraping ban before you write a line of code.
-
Step 2 of 5
Is your crawl rate polite?
Keep it to roughly what a busy human would do, and back off on errors. A bot that slows a site down invites a trespass claim, the theory that sank Bidder’s Edge against eBay in 2000.
-
Step 3 of 5
Are you getting through without beating a block?
No CAPTCHA solving, no fingerprint faking to dodge a ban. If the site actively stops you, that’s the signal to ask for access or use an official API.
-
Step 4 of 5
Can you skip the personal data?
Strip names, emails and photos you don’t need. If you must keep them, write down why, tell people where the law requires it, and set a deletion date.
-
Step 5 of 5
Are you keeping facts rather than copies?
Store prices, counts and dates. Summarise text instead of republishing it, and respect any opt-out from data mining.
Do proxies or a scraping platform change your legal risk?
No. The tool doesn’t carry your liability, and a proxy doesn’t make a risky job safe.
Proxies are normal plumbing for spreading requests and checking prices by country. Our explainer on proxies in web scraping covers that use. Trouble starts when you rotate IPs because a site has blocked you, since that’s the exact move in the Reddit complaint.
Hosted platforms help with the polite part. Apify lets you schedule runs and cap concurrency, and our Apify Actors tutorial shows those settings. Firecrawl turns public pages into clean text, as our Firecrawl tutorial walks through.
Neither one checks whether your target or your data use is lawful. That part stays on you. If you’re still choosing a tool, our web scraping tools roundup compares the options.
Scraping search results is its own case because of the SearchGuard fight. Our guide to scraping Google search results safely covers the lower-risk routes.
How we put this together
This is a research-only explainer. We read the court orders, regulator decisions and laws named above in October 2026, and we haven’t tested any of it in a courtroom. We’re not lawyers, and this isn’t legal advice.
Scraping personal data or a site that blocked you, for money? An hour with a tech lawyer costs less than the first letter from theirs. Apify and Firecrawl links on this page are affiliate links. We may earn a commission at no extra cost to you, and it doesn’t change what we recommend.
Frequently asked questions
Is web scraping legal in India?
No law bans it outright. The IT Act makes you liable for extracting data from a computer system without the owner’s permission, and dishonest intent can make it criminal. From about May 2027 the data protection act also covers personal data you scrape, unless the person made it public themselves.
Can you go to jail for web scraping?
For public pages, it’s very unlikely in the US since the Van Buren ruling. Criminal cases involve breaking into systems, stolen logins, or fraud and extortion using scraped data. Scraping behind a password you aren’t allowed to use is where criminal risk becomes real, in the US and in India.
Is it legal to scrape Amazon product prices?
Collecting public prices and stock levels, logged out and at a gentle rate, sits at the low end of the risk scale. Amazon’s terms ban automated access, and it blocks bots hard. Your realistic risk is getting your IPs blocked or, if you scrape while signed in, losing your account.
What should I do if I get a cease-and-desist letter?
Pause the scraper that day and keep your logs. A letter isn’t a lawsuit, but carrying on after it weakens most defences, because the site has now clearly told you no. Then speak to a lawyer before replying, especially if personal data or a login is involved.
Is web scraping legal in the UK?
Broadly the same picture as the EU. The UK GDPR still covers scraped personal data after Brexit, and the Computer Misuse Act 1990 makes unauthorised access to a computer a crime. Public pages, logged out, with no blocks beaten, stay low risk. Personal data is where UK projects usually get into trouble.
Does using an official API instead of scraping remove the risk?
Mostly, because the API terms tell you exactly what’s allowed. You trade freedom for clarity: rate limits, a price per call and rules on storing data. Break those terms and you’re back to a contract problem, with your API key showing exactly who did it.
Is web scraping legal for personal projects?
Personal, non-commercial use is the lowest-risk version, and the EU and Indian privacy laws largely exempt purely personal use. The same lines still apply, though: don’t log in to scrape, don’t beat blocks, and don’t publish what you collected. Publishing turns a hobby into a copyright or privacy question.
The bottom line
So, is web scraping legal? For public data, logged out and at a polite pace, yes in most places.
Pricing and market research usually sit on the safe side of every line. Anything with personal data needs a lawful reason and a deletion plan, and anything behind a login needs the terms read first. The one move to avoid outright is beating a site’s bot protection, because that’s where 2026’s lawsuits are aimed.
Your next step: run the five checks on the scraper you’re about to start, before it sends a single request.
