Is web scraping legal? A practical 2026 guide

Ask ten people whether web scraping is legal and you'll get one of two useless answers: "sure, it's public data, scrape away," or "no, that's basically hacking." Both are wrong. Or worse, both are right sometimes, which means the true answer is "it depends," and the parts it depends on are exactly the parts nobody spells out.

The short answer

Scraping publicly available information, the stuff any visitor can see without logging in, is broadly legal in the United States. Courts have repeatedly declined to treat it as hacking. That's the load-bearing fact, and it's genuinely good news.

But legality isn't one question. It's at least five, and they stack:

• Did you break into anything? (the CFAA)
• Did you agree to terms that said no? (contract)
• Did you copy protected content? (copyright)
• Was any of it personal data about real people? (privacy law)
• Did you knock the site over? (trespass)

You can be clean on four and sunk on the fifth. And geography matters as much as the act: the US leans permissive on public data, the EU does not, and "where the person lives" can pull a whole other country's law onto your scraper.

CFAA and "unauthorized access"

The Computer Fraud and Abuse Act is the scary one, because it's a federal crime, not just a lawsuit. It punishes accessing a computer "without authorization" or in a way that "exceeds authorized access." For years, companies argued that scraping their site against their wishes met that bar. That argument has mostly lost.

Two cases did the damage.

hiQ Labs v. LinkedIn. hiQ scraped public LinkedIn profiles to build workforce analytics. LinkedIn sent a cease-and-desist and blocked it. hiQ sued, and the Ninth Circuit sided with hiQ: scraping data that's publicly available, with no login or password gate in front of it, probably isn't "access without authorization" under the CFAA. The court's framing stuck. The CFAA is an anti-intrusion law, closer to breaking and entering than to crossing an open lawn. Public data is the open lawn.

Van Buren v. United States. A police officer with legitimate access to a law enforcement database looked up a plate for a bribe. In 2021, the Supreme Court ruled he hadn't "exceeded authorized access," because that clause is about which files you're allowed into, not what you do with files you're already allowed into. Call it a gates-up-or-down test: either the gate's open to you or it isn't, and your reason for walking through an open gate doesn't turn a permitted entry into a crime. That reading gutted the theory that breaking a site's terms of use is automatically a CFAA violation.

Put together, they're strong cover for scraping public data. But read the fine print, because two things get missed.

First, hiQ won the CFAA question and then lost the war. Back at the trial court, the judge found hiQ had breached LinkedIn's user agreement: its own people had created LinkedIn accounts and clicked "agree" to terms banning scraping. hiQ settled on the losing end. Public-data win, contract loss. The hacking statute didn't get them; the contract did. Hold that thought for the next section.

Second, the CFAA still bites the moment you cross a real barrier. A login you're not authorized past. A password you shouldn't have. A fake account made to get behind the gate. Van Buren's gates-up-or-down cuts both ways: if the gate is down and you go under it, that's the fact pattern where scraping turns into "unauthorized access." Scraping data locked behind a sign-in is a different legal animal from scraping the open web, and it's worth treating it that way. We get into the specifics in scraping a site behind a login.

One genuinely unsettled corner: what happens after a site sends a cease-and-desist and blocks your IP, but the data is still public? hiQ suggests public is public, and the CFAA doesn't switch back on just because you got a nasty letter. But an earlier California case, Craigslist v. 3Taps, went the other way, treating continued access after an explicit ban and IP block as "without authorization." Courts haven't fully squared those two. If you're in that spot, that's a talk-to-a-lawyer spot, not a read-a-blog spot.

Terms of service and contract law

Here's the pivot the "scraping is always legal" takes skip. Breaking a website's terms of service usually isn't a crime. It can still get you sued, and it can still cost you.

After Van Buren, a terms-of-service violation on its own doesn't hand prosecutors a computer-crime case. Good. But terms of service are a contract, and breaching a contract is its own kind of trouble. That's exactly how LinkedIn eventually beat hiQ. Not with hacking law. With plain old breach of contract.

Whether those terms actually bind you turns on how you "agreed" to them, and there's a real split here:

• Clickwrap: you clicked a box or a button that said "I agree" next to a link to the terms. Courts enforce these routinely. You made an account, you clicked agree, you're bound. This is the trap hiQ fell into.
• Browsewrap: the terms are just a link in the footer, and the site claims that by browsing you accepted them. Courts are much cooler on these, because you may never have seen or agreed to anything. It comes down to whether you had reasonable notice, and a buried footer link often isn't enough, especially against someone who never made an account.

The practical read: if you never signed up and only touched public pages, a site's ability to bind you to "no scraping" terms is weaker. Create an account and you've almost certainly clicked into a real contract, and those anti-scraping clauses grow teeth. It's a big reason serious scraping of the open web avoids logging in at all.

Copyright: facts vs. expression

Scraping copies data. Copyright cares about copying. So this bucket is unavoidable, but it's narrower than people fear, because of one durable principle: facts aren't copyrightable.

The Supreme Court settled that in Feist v. Rural Telephone: a phone company couldn't copyright the names and numbers in its white pages, because facts belong to no one, and the effort of collecting them earns no copyright by itself. Prices, addresses, scores, specs, stock levels: raw facts, free to extract.

What is protected is original expression, and the creative selection or arrangement of a compilation. The article text. The photographs. The reviews written in someone's own words. Copy those wholesale and you've got an infringement problem, public or not.

Then there's fair use, a real defense but a slippery one. It's a four-factor, fact-specific test, and "I was only scraping" isn't a magic pass. Courts have, in some cases, treated the intermediate copying involved in indexing and search as fair use when the end result was transformative. They've gone the other way when the copy competed with the original. Nobody can promise you fair use up front; it's argued after the fact, case by case.

Rule of thumb: take the facts, not the finished work.

Personal data and privacy law

This is the bucket growing fastest, and the one that catches people who did everything else right. The counterintuitive part: data being public doesn't make it free to process, once it's about identifiable people.

GDPR (Europe). If you scrape personal data, names, emails, photos, profiles, of people in the EU, you're "processing personal data," and GDPR applies whether or not that data was sitting in the open. Public availability is not, by itself, a lawful basis. You need an actual legal ground (usually "legitimate interests," weighed against the person's rights), plus transparency and deletion duties that are hard to honor when you scraped people silently. GDPR also reaches across borders: target or monitor people in the EU and it can apply to you even if your servers sit in Ohio.

This isn't theoretical. Clearview AI scraped billions of face images off the public web and got hammered by European regulators, with multiple national authorities issuing fines in the 20-million-euro range for doing it without a lawful basis. "It was public" was their whole argument. It didn't work.

CCPA / CPRA (California). California gives residents rights over their personal information too. There's a carve-out for genuinely "publicly available" information, but it's narrower than it sounds, and it doesn't cover inferences you build or data you repurpose beyond how it was originally made public. Biometric and sensitive data get extra protection.

If your scrape touches people, not just prices and products, slow down and get advice. This is where the public-data safe harbor stops covering you, and where the fines have real commas in them.

Trespass to chattels and server load

Last bucket, and it's the one people forget, because it has nothing to do with what the data is. It's about what your scraper does to the server.

Trespass to chattels is an old property tort, dusted off for the web. If you interfere with someone's property (their servers) enough to cause harm, that's actionable, even if you never broke in and never copied a thing. In eBay v. Bidder's Edge, a court blocked a company whose automated queries ate into eBay's server capacity. The load itself was the harm.

Later cases narrowed this. You generally need real, measurable impairment, not just unwanted traffic. But "real impairment" is exactly what you cause when you fire thousands of requests a second at a site and degrade it for everyone else. Do that and you can be liable on this theory alone, with every other bucket clean.

Which makes the fix easy, and also the decent thing to do: don't hammer the server. Rate-limit. Space your requests. Scrape off-peak when you can. Good technical citizenship isn't just etiquette here; it's the line between legitimate data collection and a tort.

Rules of thumb

None of this is legal advice (that's coming again at the bottom, and I mean it). But if you want the boring, defensible middle, here's roughly how people who do this for a living actually operate:

• Prefer public data. The open web, no login, no gate, is where the law is friendliest. Live there when you can.
• Don't cross a login you're not authorized for. This is the single brightest line between "scraping" and "unauthorized access." If it needs a sign-in you weren't given, stop.
• Read the terms, and mind how you agreed. Made an account? You're probably bound by a real contract. Public-only browsing is a weaker hook for the site.
• Take facts, not finished works. Prices, specs, and listings, yes. Wholesale copies of articles, photos, and original text, no.
• Be careful with personal data. The moment your scrape is about people, especially people in the EU, the rules flip against you. Get advice before, not after.
• Keep the volume sane. Rate-limit, back off, don't degrade the site. Respect robots.txt as a signal of intent even where it isn't strictly binding on you.

That last cluster, clean sourcing, sane rate limits, terms-aware collection, is most of what separates a scraper that runs for years from one that draws a letter. We wrote up the technical side in how to avoid bot detection and, for the specific case of Cloudflare, getting past its bot checks. The clean-IP piece lives in the residential proxy guide.

If you'd rather start from something that already behaves itself, our scraping starter kit is a ready-to-run template with rate-limiting and sane defaults wired in. Not required reading. Just a head start.

Once more, because it matters: this is not legal advice. It's a practitioner's map of where the risk sits, not an opinion about your project. Laws differ by country and state, they change, and the facts of your scrape can flip the answer. Before anything high-stakes, personal-data, or login-gated, run it past a qualified lawyer in your jurisdiction.

FAQ

Is it legal to scrape Google, Amazon, or LinkedIn?

Scraping the public pages of big sites like these is broadly legal in the US, and the LinkedIn case (hiQ v. LinkedIn) is why people cite it that way. The catch: each of them bans scraping in its terms of service, so you can be sued for breach of contract or banned even when it isn't a crime, and the moment you log in or cross a rate limit the risk climbs. Public pages, no login, sane volume: defensible. Behind a sign-in, or against terms you clicked agree to: get advice.

Can I get sued for web scraping?

Yes. Even when scraping isn't a crime, a site can sue you for breach of contract (if you agreed to terms banning it), copyright infringement (if you copied protected content), or trespass to chattels (if you overloaded its servers). A lawsuit doesn't need a criminal violation behind it. That's precisely how LinkedIn ultimately beat hiQ.

Is scraping personal data legal?

It's the riskiest kind, and "it was public" is not a defense. Under the EU's GDPR, scraping personal data about people in Europe is regulated whether or not that data was public, and regulators have handed out multi-million-euro fines (Clearview AI is the standout). California's CCPA/CPRA adds its own rules. If your scrape is about identifiable people, treat it as high-stakes and talk to a lawyer.

Does violating a site's terms of service break the law?

Usually it's not a crime. After Van Buren v. United States (2021) and hiQ v. LinkedIn, breaking a site's terms of use, on its own, generally isn't a federal computer-crime. But it can still be a breach of contract you get sued for, and it can get your access cut off. "Not a crime" and "no consequences" are different things.

Is scraping copyrighted content legal?

Facts aren't copyrightable, so scraping raw data like prices, specs, and listings is generally fine. Copying original expression, full articles, photos, reviews, or a site's creative compilation, can infringe, and fair use is a fact-specific defense argued case by case, not a guarantee. Extract the facts, not the finished work.