The three questions that actually decide the answer
Instead of asking whether scraping is legal in the abstract, ask three concrete questions about a specific source. Together they shape almost all of the risk.
What you collect
The nature of the data matters most: whether it is publicly visible or gated, whether it includes personal information, and whether it is original, copyrighted content.
How you collect it
The method matters: respecting access controls, rate limits, and a site’s robots.txt and terms, rather than circumventing logins or protections.
Where the data comes from
Jurisdiction matters: whose residents are represented in the data, and which countries’ laws follow that data regardless of where you operate.
The regulations to keep in view
Several independent bodies of law can apply to one dataset at the same time. Clearing one does not clear the rest.
Computer-access law (such as the US CFAA)
These rules focus on how data is accessed, and treat data behind a login very differently from openly visible pages. In the US, the hiQ v. LinkedIn litigation indicated that reading public data may not by itself violate the CFAA, though that addressed one statute only.
Contract and terms of service
A site’s terms can create contractual obligations that may apply even where access law does not. In Meta v. Bright Data (2024), contract and terms questions stayed live even where computer-access claims did not, so terms deserve real attention.
Data protection (GDPR and UK GDPR)
Processing the personal data of EU or UK residents needs a lawful basis, whether or not that data was publicly available. Personal data is the most common way a scraping project drifts into risk.
US state privacy (CCPA and CPRA)
California and a growing list of US states give residents rights over their personal information, so a single dataset can touch several regimes at once.
AI rules and local regimes
Newer laws such as the EU AI Act add transparency and provenance expectations for data that feeds AI, and regimes like India’s DPDP Act add local requirements.
Public data, gated data, and terms
One distinction does a lot of work: was the data openly visible, or behind a barrier? Publicly accessible, non-personal data collected in line with a site’s terms is a lower-risk starting point. Data behind a login or paywall, data that contains personal information, or data collected against a site’s stated terms carries more access, contract, and privacy risk. Public access lowers one specific risk, it does not remove privacy, copyright, or contract obligations. Case outcomes here are fact-specific and still evolving, so treat this as general information, not legal advice.
Vendor due diligence: questions to ask a data partner
You cannot outsource accountability, but you can choose a partner who lowers your risk instead of adding to it. Ask every vendor how they source data and handle gated pages, how they identify and handle personal data, how they assess site terms, whether they can provide audit trails and provenance for every record, what certifications they hold such as ISO 27001, and whether they will put compliance commitments and SLAs in the contract. Clear answers mean the vendor is doing the work; vague answers are the risk you would be buying.
How PromptCloud reduces the risk
PromptCloud collects publicly available web data with compliance built into how data is gathered and delivered, not added at the end. Automated per-domain policy checks review terms, data residency, and sector rules before every extraction; every record carries audit trails with timestamps, extraction method, and policy and schema versions; and a policy team tracks GDPR, CCPA and CPRA, robots.txt, the EU AI Act, and India’s DPDP Act. PromptCloud is ISO 27001:2022 certified and GDPR and CCPA compliant, so the data you receive is something you can put in front of Legal, Security, and Procurement with confidence.
Frequently asked questions
Is web scraping legal?
It depends on what you collect, how you collect it, and whose data it is. Scraping publicly available, non-personal data is generally lower risk than collecting personal data or data behind a login, but privacy, contract, and copyright laws can still apply. This is general information, not legal advice, so confirm your own situation with qualified counsel.
Is it legal to scrape publicly available data?
Publicly available data is generally treated as lower risk. In the US, the hiQ v. LinkedIn case indicated that accessing public data may not by itself violate the main computer-access law, the CFAA. But public availability does not remove privacy, copyright, or contract obligations, so it is a lower-risk starting point, not blanket permission.
Does GDPR apply to web scraping?
Yes, when the data includes personal data of people in the EU or UK. GDPR requires a lawful basis to process personal data whether or not it was publicly available, so scraping that captures names, emails, or other identifiers brings GDPR obligations into play.
Is it legal to scrape data behind a login?
Data behind a login or paywall is higher risk. Accessing it can raise computer-access and contract concerns that public pages do not, and terms of service usually prohibit it. Treat gated data as something to approach only with clear authorization and legal review.
What laws apply to web scraping?
Several can apply at once: computer-access laws such as the US CFAA, contract and terms of service, data-protection laws such as GDPR and UK GDPR, US state privacy laws such as CCPA and CPRA, and newer AI rules such as the EU AI Act. Which ones apply depends on the data and the jurisdictions involved.
