--- title: "Is Web Scraping Legal? Laws and Cases (2026) | Scrape.ly" description: "Is web scraping legal? What US, EU and UK law says in 2026: CFAA, hiQ, Meta and X v. Bright Data, GDPR, copyright, robots.txt, plus a practical checklist." url: https://scrape.ly/blog/is-web-scraping-legal markdown: https://scrape.ly/blog/is-web-scraping-legal.md --- [Guides](https://scrape.ly/blog/category/guides.md) # Is Web Scraping Legal? US, EU and UK Law, Court Cases and a Checklist (2026) Is web scraping legal? What US, EU and UK law actually says in 2026, from Van Buren and hiQ v. LinkedIn to Meta and X v. Bright Data, GDPR, database rights, robots.txt and the newest SerpApi rulings, plus a practical checklist. [Scrape.ly Team The team behind Scrape.ly](https://scrape.ly/blog/author/scrapely-team.md) - Published Oct 23, 2026 - Reading time 11 min read ![Pixel-art robot with an orange >\_ on its terminal head stands before a pair of balanced golden scales of justice, holding out a data card](https://scrape.ly/media/is-web-scraping-legal.png?w=1080) Is web scraping legal? In the US, the EU and the UK, using a program to collect publicly available web pages is not illegal in itself, and US courts have repeatedly refused to treat scraping of public pages as hacking. What can make a scraping project unlawful is what you collect and how: personal data, copyrighted content you republish, pages behind a login, terms you agreed to, and technical barriers you get around. Below are the rules and the cases that set them, each linked to the court record or the regulator's own page, and a checklist for your next project. Everything was checked on 22 October 2026. This is general information, not legal advice: for a specific project, especially one involving personal data, ask a lawyer in your jurisdiction. ## The short answer, by question | Question | United States | European Union | United Kingdom | | ---------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------------------------------------- | ------------------------------------------------------ | | Is scraping public pages "hacking"? | No under the federal CFAA, per _Van Buren_ (2021) and _hiQ v. LinkedIn_ (2022) | No EU-wide scraping offence; computer-access crimes are national law | Computer Misuse Act 1990 targets _unauthorised_ access | | Is public personal data free to collect? | Depends on state privacy laws | No: GDPR applies to public personal data too | No: UK GDPR applies | | Can website terms forbid scraping? | Yes, if you agreed to them (accounts, clickwrap) | Yes, _Ryanair_ (2015) allows contractual limits | Yes, under ordinary contract law | | Are facts protected? | No (_Feist_, 1991), but expression is | Databases can be, through the sui generis database right | Same database right, now UK-only | | Is robots.txt legally binding? | Not as such (RFC 9309) | Can count as a machine-readable opt-out for text and data mining | Not as such | | Is getting around bot checks risky? | Yes: a July 2026 ruling let DMCA anti-circumvention claims proceed | Regulators expect you to respect CAPTCHAs when training AI | Unauthorised-access risk under the CMA | ## Is web scraping legal in the US? There is no US statute about web scraping. Disputes are fought with the Computer Fraud and Abuse Act (CFAA), contract law, copyright, and state privacy and trespass laws. ### The CFAA after Van Buren v. United States (2021) The CFAA punishes accessing a computer "without authorization" or "exceeding authorized access". Platforms long argued that scraping in breach of their terms or after a cease-and-desist letter crossed that line. On 3 June 2021 the Supreme Court narrowed the law in [Van Buren v. United States](https://www.law.cornell.edu/supremecourt/text/19-783): you exceed authorized access when you enter parts of a system, "such as files, folders, or databases", that are off-limits to you. It "does not cover those who ... have improper motives for obtaining information that is otherwise available to them." The Court called this a "gates-up-or-down inquiry". ### hiQ v. LinkedIn: the CFAA win, and how the case ended hiQ Labs scraped public LinkedIn profiles to sell workforce analytics, and won a preliminary injunction when LinkedIn tried to block it. After _Van Buren_, the Ninth Circuit affirmed that injunction on [18 April 2022](https://law.justia.com/cases/federal/appellate-courts/ca9/17-16783/17-16783-2022-04-18.html): a computer hosting public pages "has erected no gates to lift or lower in the first place", so "the concept of 'without authorization' does not apply to public websites." Two details are often left out. That was a preliminary ruling, and the court itself listed claims a site could still bring, including "breach of contract". And hiQ lost the rest of the case. In an order [signed on 27 October 2022](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/2182242.html), the district court granted LinkedIn summary judgment for breach of its User Agreement over contractors hiQ had told to create fake accounts; the scraping-based breach claim was headed for trial. In December 2022 hiQ settled with a [consent judgment](https://infobytes.orrick.com/wp-content/uploads/pdf/Buckley%20InfoBytes%20-%20hiQ%20Labs%2C%20Inc.%20v.%20LinkedIn%20Corp.%20-%20Stipulation%20and%20%5BProposed%5D%20Consent%20Judgment%20and%20Permanent%20Injunction%202022.12.06.pdf): $500,000 and a permanent injunction against scraping LinkedIn and using fake accounts. The lesson: for public pages the CFAA is rarely the real risk. Terms you accepted, fake identities and logged-in access are. ### Meta v. Bright Data (2024): logged-off scraping On [23 January 2024](https://www.courthousenews.com/wp-content/uploads/2024/01/meta-platforms-v-bright-data-ruling-motion-for-summary-judgment.pdf) a federal court in California granted Bright Data summary judgment on Meta's breach-of-contract claim: Meta's terms "do not apply to Bright Data's logged-off scraping of publicly viewable data." A month later Meta dropped its remaining claim and [waived its right to appeal](https://storage.courtlistener.com/recap/gov.uscourts.cand.406956/gov.uscourts.cand.406956.193.0.pdf). ### X Corp. v. Bright Data (2024–2025): preemption, then server load On [9 May 2024](https://cdn.arstechnica.net/wp-content/uploads/2024/05/X-Corp-v-Bright-Data-Order-Dismissing-Complaint-5-9-24.pdf) Judge Alsup dismissed X's suit, holding that its claims "based on scraping and selling of data are preempted by the Copyright Act"; otherwise X "would entrench its own private copyright system" over posts it does not own. But a [26 November 2024 order](https://cases.justia.com/federal/district-courts/california/candce/3:2023cv03698/415869/156/0.pdf) let X pursue claims based on access to its systems after it alleged that scraper traffic caused intermittent server failures and a "glitchy, lagged user experience". The parties settled, and the court [closed the case on 1 July 2025](https://storage.courtlistener.com/recap/gov.uscourts.cand.415869/gov.uscourts.cand.415869.357.0_1.pdf). How hard you hit a site's servers can matter legally, not just technically. ### Copyright: facts are free, expression is not In [Feist v. Rural Telephone](https://supreme.justia.com/cases/federal/us/499/340/) (1991) the Supreme Court said "there can be no valid copyright in facts." Prices, opening hours, ratings and stock levels are facts. Articles, reviews, photos and long post texts are expression: analysing them is a different act from republishing them, and fair use is decided case by case. ## Web scraping legal news: the 2025–2026 cases to watch The newest fights are about the DMCA's anti-circumvention rule, which forbids getting around a technical measure that controls access to a copyrighted work. - **Google v. SerpApi.** Google sued in December 2025, alleging SerpApi circumvented SearchGuard, its bot-check system, to scrape search results. On [20 July 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.461513/gov.uscourts.cand.461513.42.0.pdf) the court dismissed the claims: without leave to amend for results that "do not contain any copyrighted content", with leave for the rest. Google has amended its complaint, and SerpApi has moved to dismiss again. - **Reddit v. SerpApi, Oxylabs, AWMProxy and Perplexity.** On [31 July 2026](https://law.justia.com/cases/federal/district-courts/new-york/nysdce/1:2025cv08736/651592/104/) a New York federal court let Reddit's DMCA claims against SerpApi and Perplexity go forward and dismissed its state unjust-enrichment and unfair-competition claims. It found it plausible that CAPTCHA and bot-detection challenges count as access controls even though people can see the same content ([Loeb & Loeb summary](https://www.loeb.com/en/insights/publications/2026/08/reddit-v-serpapi-llc)). Neither case has a final judgment. Together they mark the 2026 frontier: collecting public facts is one thing; defeating a protection measure to reach copyrighted text is where the litigation risk now sits. ## Is web scraping legal in the EU? ### GDPR applies to public personal data The GDPR covers "any information relating to an identified or identifiable natural person" ([Article 4(1)](https://www.legislation.gov.uk/eur/2016/679/article/4/adopted)), whether or not it was posted publicly. Scraping names, usernames, photos or contact details of people in the EU needs a legal basis (usually legitimate interest), minimisation and respect for their rights. The worst infringements carry fines of up to €20 million or 4% of worldwide annual turnover ([Article 83(5)](https://gdpr-info.eu/art-83-gdpr/)). Regulators have spelled out what they expect: - **CNIL (France), June 2025.** Its [web scraping guidance](https://cnil.fr/fr/focus-interet-legitime-collecte-par-moissonnage) lists mandatory measures: set collection criteria in advance, exclude data categories you don't need, delete irrelevant data as soon as you spot it, and, when building AI training sets, skip sites that object through robots.txt or CAPTCHAs. - **Global privacy regulators.** A [joint statement](https://www.priv.gc.ca/en/opc-news/speeches-and-statements/2024/js-dc_20241028/) backed by the UK ICO and its counterparts says "personal information that is publicly accessible is subject to data protection and privacy laws in most jurisdictions." - **Clearview AI.** The company scraped faces from the web for a face-search database. France's CNIL fined it [€20 million in 2022](https://www.edpb.europa.eu/news/national-news/2022/french-sa-fines-clearview-ai-eur-20-million_ro), the Dutch authority [€30.5 million in 2024](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition). Since 2 February 2025 the EU AI Act bans building facial-recognition databases "through the untargeted scraping of facial images" ([Article 5(1)(e)](https://artificialintelligenceact.eu/article/5/)). ### Database right and Ryanair v PR Aviation The EU Database Directive protects databases through copyright when their structure is original, and through a sui generis right when someone invested substantially in the contents. Extracting a substantial part of a protected database can infringe even if every entry is a plain fact. In [Ryanair v PR Aviation](https://www.bailii.org/eu/cases/EUECJ/2015/C3014.html) (15 January 2015), a price-comparison site scraped Ryanair's flight data. Visitors had to tick a box accepting terms that banned commercial "screen scraping". The Court of Justice ruled that when a database has neither copyright nor sui generis protection, the directive does not stop its owner "from laying down contractual limitations on its use by third parties". Where database law gives no protection, terms of service can. ### Text and data mining EU copyright law lets anyone with lawful access copy works for text and data mining unless the rightholder reserved that right "by machine-readable means in the case of content made publicly available online" ([Article 4(3)](https://www.legislation.gov.uk/eudr/2019/790/article/4/data.html) of the 2019 copyright directive). Check for such opt-outs before mining copyrighted content, especially for AI training. ## Is web scraping legal in the UK? - **Unauthorised access.** Section 1 of the [Computer Misuse Act 1990](https://www.legislation.gov.uk/ukpga/1990/18/section/1) makes it an offence to access a computer knowing the access is unauthorised. Public pages are a different situation from accounts you have no right to use. - **UK GDPR.** The ICO's [generative AI consultation outcome](https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai/the-lawful-basis-for-web-scraping-to-train-generative-ai-models) treats legitimate interests as the only realistic lawful basis for training on scraped personal data and calls it "high-risk, invisible processing". In the ICO's case against Clearview AI, the Upper Tribunal ruled in [October 2025](https://www.gov.uk/administrative-appeals-tribunal-decisions/the-information-commissioners-office-v-clearview-ai-inc-privacy-international-intervening-2025-ukut-319-aac) that the ICO had jurisdiction and sent the case back to the First-tier Tribunal. - **Database right.** The UK kept it after Brexit, but for databases made from 2021 onward, protection [no longer carries across](https://www.gov.uk/guidance/sui-generis-database-rights) between the UK and the EU. - **Copyright.** [Section 29A](https://www.legislation.gov.uk/ukpga/1988/48/section/29A) of the Copyright, Designs and Patents Act allows copies for computational analysis for non-commercial research only. The government's 2026 [report on copyright and AI](https://www.gov.uk/government/publications/report-and-impact-assessment-on-copyright-and-artificial-intelligence/report-on-copyright-and-artificial-intelligence) dropped its plan for a broad commercial exception with an opt-out. ## Terms of service: when do they bind a scraper? The cases above point the same way in all three jurisdictions: - If you **created an account or ticked a box**, you most likely accepted the terms. _Ryanair_ turned on a ticked box; hiQ's fake accounts cost it the case. - If you **never logged in or accepted anything**, the terms may never have applied to you, as in _Meta v. Bright Data_. - **Terms can't create rights the law doesn't give.** In _X v. Bright Data_, contract claims over public data were preempted by copyright law. ## Does robots.txt make scraping illegal? Not by itself. The robots.txt standard, [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309.html), says: "These rules are not a form of access authorization." It still carries weight: in the EU it can be the machine-readable opt-out from text and data mining, and France's CNIL expects AI developers to respect it. Some platforms say what theirs is for; Reddit's [Data API wiki](https://support.reddithelp.com/hc/en-us/articles/16160319875092-Reddit-Data-API-Wiki) states its robots.txt "is for search engines, not Data API users." Treat robots.txt as the owner's stated wishes and honour it by default. ## Personal data: where scraping projects most often go wrong Most legal trouble comes from scraping people, not prices: - Decide which fields you need before the first run and drop the rest at collection. - Treat reviewers, commenters, private profile owners and job posters as private persons, even when their content is public. - Don't build profiles of individuals without a documented legal basis. - Keep personal data only as long as the purpose needs it. - Never scrape faces to build recognition databases. In our own tutorials, private people appear only as pseudonyms such as `[redditor 1]`; see the sample table in our [Reddit scraping guide](https://scrape.ly/blog/reddit-scraping.md). ## A practical checklist before you scrape 1. **Public?** Can any visitor see the data without logging in or paying? If not, get permission first. 2. **Accounts.** If your scraper logs in or ticks "I agree", read and follow those terms. 3. **No circumvention.** Don't defeat paywalls, authentication, or access controls protecting copyrighted content. 4. **Facts or expression?** Prices and specs carry far less copyright risk than articles, images or reviews you republish. 5. **Databases.** In the EU or UK, avoid extracting a substantial part of a curated database. 6. **Personal data.** Identify it, minimise it, document your legal basis, plan deletion. 7. **Opt-outs.** Check robots.txt and machine-readable text-and-data-mining reservations, especially for AI training. 8. **Load.** Cap concurrency and pages per run, and back off on errors. 9. **Purpose.** Analysis and price comparison differ from rebuilding a competing copy of the site. 10. **Records.** Write down what you collect, why, from where and when. ## How Scrape.ly approaches responsible scraping Scrape.ly can't make a use lawful; our [Acceptable Use Policy](https://scrape.ly/legal/acceptable-use.md) says exactly that. What we can do is make the responsible path the easy one: - **Public data by design.** Actors in the [Scrape.ly Store](https://scrape.ly/store.md) collect only publicly available data, the same data any visitor sees, and the policy forbids using our proxies and browsers to reach non-public accounts or content without authorisation. - **Limits you set per run.** Every run can carry a maximum charge, and it stops when it reaches it. Actors expose their own limits: the [Website Content Crawler](https://scrape.ly/store/querystone/website-content-crawler.md) takes a page cap, a result cap, a maximum concurrency and a switch to respect robots.txt; the [Google Maps Scraper](https://scrape.ly/store/cornerledger/google-maps-scraper.md) takes a number of places per search. - **Clear roles for personal data.** If your runs collect personal data, you are the controller and Scrape.ly is your processor. The policy rules out uses such as stalking, consumer reports and untargeted facial-image scraping. - **Field-level tutorials.** Guides such as [how to scrape Google Maps](https://scrape.ly/blog/how-to-scrape-google-maps.md) list exactly which fields an Actor returns and end with a site-specific legal section. ## FAQ ### Is web scraping illegal in the US? No, not as such. After _Van Buren_ and the Ninth Circuit's 2022 _hiQ_ ruling, scraping pages anyone can open is very unlikely to violate the federal CFAA. Scrapers still lose over contract breaches, fake accounts, server load and copyright, as hiQ's $500,000 consent judgment shows. ### Is it legal to scrape websites for commercial use? A commercial purpose doesn't make scraping illegal; _Meta v. Bright Data_ involved a company selling scraped data. It raises the stakes on everything else: terms you accepted, personal data, EU and UK database rights, and the UK's lack of a commercial text-and-data-mining exception. ### Is it legal to scrape LinkedIn? The CFAA question went hiQ's way at the preliminary stage, but hiQ settled under a permanent injunction after the court found its fake-account conduct breached LinkedIn's User Agreement. Logged-out collection of public pages and logged-in collection are very different risks, and profiles are personal data under the GDPR. ### Can a website ban scraping in its terms of service? Yes, and the terms bind you if you accepted them, for example by creating an account or ticking a box. _Ryanair_ confirms that in the EU, terms can restrict use of a database that has no copyright or database-right protection. Terms you never saw or accepted are much weaker, as _Meta v. Bright Data_ showed. ### Is ignoring robots.txt illegal? Not by itself: RFC 9309 says robots.txt rules are not access authorisation. In the EU it can still work as a text-and-data-mining opt-out, and French guidance expects AI developers to respect it, so honouring it is the safer default. About the author [Scrape.ly Team](https://scrape.ly/blog/author/scrapely-team.md) The team behind Scrape.ly Scrape.ly is the web data platform from TeraShift GmbH in Switzerland, powered by Evomi: ready-made scrapers in the Scrape.ly Store, a cloud runtime, an API with JavaScript and Python SDKs, proxies, a hosted anti-bot browser and an MCP server for AI agents. - [Website](https://scrape.ly/index.md) Keep reading ## More in Guides - [![Pixel-art robot with an orange >\_ on its terminal head pulls a data card out of a browser window showing a web page and drops it into a crate of collected data](https://scrape.ly/media/how-to-scrape-a-website.png?w=750)](https://scrape.ly/blog/how-to-scrape-a-website.md) ### [How to Scrape Data From a Website: 4 Methods, No-Code to Python](https://scrape.ly/blog/how-to-scrape-a-website.md) [How to scrape data from a website four ways: a ready-made scraper with no code, a generic cloud scraper with one extraction function, a Python script you run yourself, and an AI agent over MCP. Each with real runs, exact costs and tested code.](https://scrape.ly/blog/how-to-scrape-a-website.md) - [![Pixel-art robot with an orange >\_ on its terminal head walks past a raised red-and-white boom barrier, carrying a data card from the web page behind it towards a crate](https://scrape.ly/media/web-scraping-without-getting-blocked.png?w=750)](https://scrape.ly/blog/web-scraping-without-getting-blocked.md) ### [Web Scraping Without Getting Blocked: 10 Techniques That Work](https://scrape.ly/blog/web-scraping-without-getting-blocked.md) [Web scraping without getting blocked comes down to ten habits: real headers, pacing, sessions, good IPs, real browsers, clean fingerprints, challenge handling, honeypot checks, robots.txt and caching. Tested Python for each, and how Scrape.ly handles them for you.](https://scrape.ly/blog/web-scraping-without-getting-blocked.md) - [![Pixel-art robot with an orange >\_ on its terminal head reaches for the last empty box on a clipboard checklist whose first four items carry orange ticks, with a web page standing behind it](https://scrape.ly/media/web-scraping-best-practices.png?w=750)](https://scrape.ly/blog/web-scraping-best-practices.md) ### [12 Web Scraping Best Practices for Reliable, Responsible Scrapers](https://scrape.ly/blog/web-scraping-best-practices.md) [Twelve web scraping best practices that keep scrapers polite, unblocked and accurate: robots.txt, rate limits, caching, retries, validation, monitoring, personal data and more. Each with tested Python code and how to do it on Scrape.ly.](https://scrape.ly/blog/web-scraping-best-practices.md) ## The internet is full of data. Start owning yours. Scrape.ly gives you the infrastructure, the tooling, and the team to extract, process, and operationalize web data at any scale. Setup takes minutes. The advantage lasts forever. [Get Started Free](https://my.scrape.ly/register) [Chat with Support](mailto:support@scrape.ly?subject=Question%20about%20Scrape.ly\&body=Hi%2C%20I%20have%20a%20question%20about%20Scrape.ly.) No credit card. No setup calls.