Is Web Scraping Legal in 2026? Clear Answer

Web scraping is generally legal when you collect public data that you can already see, without breaking a login, bypassing technical blocks, or reusing copyrighted or personal data in a way the law restricts. There is no single "scraping law." Whether it is legal depends on what you collect, where you are, and how you do it.

This is a plain-English guide, not legal advice. Below we break down public versus private data, terms of service, the big US court cases, copyright, and privacy rules like GDPR and CCPA.

The short answer: it depends on what, where, and how#

Is web scraping legal? In most cases, yes, when you read public data that is already visible to you and you do not break access controls, copy protected content wholesale, or misuse personal data. The answer changes with the data type, your country's laws, and your method. There is no blanket ban and no blanket permission.

Three questions decide most cases:

• What are you collecting? Public facts differ from copyrighted text and from personal data.
• Where are you and the site located? US, EU, and other laws differ.
• How do you collect it? Reading a public page is not the same as cracking a login or hammering a server.

Keep those three axes in mind and most "is this allowed?" questions get clearer fast.

Is scraping public data different from private data?#

Yes. Collecting data that any visitor can see without a password is treated very differently from data behind a login. Public pages carry the lowest legal risk. The moment you sign in, agree to terms, or defeat a technical barrier to reach data, the risk and the legal questions both rise sharply.

Think of it as a spectrum:

• Fully public: a product grid, a public directory, search results, an open <table>. Anyone can view it without logging in.
• Public but gated: you must accept a cookie banner or pass a soft check, but no account is needed.
• Logged-in / private: the data sits behind authentication. Reaching it usually means agreeing to terms, and sometimes circumventing access controls.

Public data is also not automatically free to reuse. A public phone book of facts is one thing; a public page of copyrighted reviews or personal profiles is another. "Visible" is not the same as "unrestricted."

Do terms of service make scraping illegal?#

Usually not by themselves in the US, but they matter and can expose you to a breach-of-contract claim. Many US courts treat violating a site's terms of service as a contract issue, not a crime. The picture shifts in the EU and other regions, and it shifts again the moment you log in and actively accept those terms.

The leading example is hiQ Labs v. LinkedIn. hiQ scraped public LinkedIn profiles. The dispute ran for years in US courts. The key takeaways that survived:

• Scraping public data that does not require a login was found unlikely to violate the Computer Fraud and Abuse Act (CFAA), because the data was not behind an "authorization" gate.
• The case later turned on breach of contract — LinkedIn's user agreement — rather than the criminal computer-access statute. hiQ faced liability on the contract side.

So terms of service are not toothless. Violating them can mean a contract claim, account bans, and IP blocks, even if no criminal law is broken.

What the CFAA and Van Buren actually say#

The CFAA punishes accessing a computer "without authorization" or "exceeding authorized access." For years, people feared scraping a public site could be a federal crime. Two developments narrowed that fear:

• Van Buren v. United States (2021): the US Supreme Court read "exceeds authorized access" narrowly. It covers accessing areas of a system you are not allowed into — not merely using data you can already reach for a purpose the owner dislikes.
• hiQ v. LinkedIn: reinforced that public, no-login data is generally not "without authorization" under the CFAA.

Net effect: in the US, reading genuinely public data is unlikely to be a CFAA violation. Breaking a login, sharing credentials, or defeating an IP block to get in is a different and riskier story.

A quick comparison of the main legal angles#

Legal angle	What it covers	Higher risk when	Lower risk when
CFAA (US)	Unauthorized computer access	You bypass a login or technical block	Data is public, no login
Terms of service	Contract between you and the site	You accepted terms (logged-in account)	You never agreed; data is public
Copyright	Reuse of creative/expressive content	You copy and republish text, photos	You extract facts only
Database rights (EU)	Substantial reuse of a database	You copy a large share of an EU DB	You take small, factual pieces
Privacy (GDPR/CCPA)	Personal data of identifiable people	You collect names, emails, profiles	You collect non-personal facts

Can I get in trouble for copyright or database rights?#

Yes, if you copy and reuse protected content rather than plain facts. Facts and data points are generally not copyrightable, but the creative expression around them is. Copying and republishing articles, photos, or reviews can infringe copyright. In the EU, a separate "database right" can protect large extractions from a database.

A few practical lines:

• Facts are usually fair game. A price, a date, a star count, a street address — these are data, not authorship.
• Expression is protected. A full review, an article body, a product description written by the site, or original photography can be copyrighted. Re-hosting it is risky.
• Compilation effort matters in the EU. The EU Database Directive grants a sui generis database right to the maker of a database who made a substantial investment. Extracting a "substantial part" can infringe even if the individual facts are not copyrighted.

If your goal is a spreadsheet of facts (titles, prices, links, locations) for your own analysis, you are usually in the safest zone. If you plan to republish someone's creative content, get advice first.

How do GDPR, CCPA, and consent affect personal data?#

Heavily. The moment you collect data about identifiable people — names, emails, photos, profiles — privacy law applies even if that data is public. Under the EU's GDPR, scraped personal data still needs a lawful basis, and people keep rights over it. California's CCPA/CPRA gives similar consumer rights. Public does not mean consent.

Key points for GDPR web scraping and personal data:

• GDPR applies to public personal data too. A public profile is still personal data. You need a lawful basis (often "legitimate interests"), and you must weigh that against the person's rights and expectations.
• People have rights. Access, correction, deletion, and objection rights follow the data. If you hold scraped personal data, you may have to honor those requests.
• Transparency is expected. GDPR generally expects you to tell people you hold their data, with limited exceptions.
• CCPA/CPRA gives California consumers rights to know, delete, and opt out of sale of their personal information, which can cover scraped data.

Regulators have acted on this. Several data protection authorities have fined or warned companies that built databases from scraped personal data without a proper basis. Lead and contact scraping is the highest-sensitivity case — read more in our guide to scraping leads from directories to CSV, where minimizing personal fields matters most.

What are practical rules to scrape responsibly?#

Stay public, stay light, and stay factual. Responsible scraping means collecting only data you can already see, respecting the site's stated wishes, not overloading its servers, and not reusing protected or personal content in ways the law restricts. These habits keep you on the safe side of most lines and are simply good etiquette.

A checklist you can reuse:

1. Prefer public, no-login pages. Avoid scraping behind a password unless you have clear permission.
2. Read robots.txt and any API terms. robots.txt signals what a site prefers bots to avoid. It is not a law, but ignoring it weakens your position and is poor form.
3. Do not bypass technical blocks. Defeating logins, CAPTCHAs, or IP bans moves you toward CFAA-type risk.
4. Throttle your requests. Do not hammer a server. Slow, human-paced collection avoids disruption and looks nothing like an attack.
5. Collect facts, not creative content. Take prices, titles, and links — not full articles or photos to republish.
6. Minimize personal data. Skip names and emails unless you genuinely need them and have a basis to hold them.
7. Honor deletion and opt-out requests if you store personal data.
8. Check the law where you operate. US, EU, UK, and other rules differ.

Following robots.txt deserves emphasis: it is a voluntary standard, not binding law, but courts and regulators look at whether you respected a site's clearly expressed wishes.

Does on-device scraping change the privacy calculus?#

Yes, in your favor on the privacy side. A tool that runs entirely on your device reads only the page you are already viewing and never uploads it to a third-party server. That removes a whole category of risk: you are not handing the site's data — or anyone's personal data — to an outside processor you do not control.

This is why a local browser extension differs from a cloud scraper:

• No third-party processor. Cloud scrapers and "paste it into an AI" tools send the page to a server. Under GDPR, that server becomes another party touching personal data. An on-device tool keeps the data with you.
• You read what you can already see. Reading the live page in your own browser, logged-in or not, is the same data your eyes have access to. You are not reaching past any barrier the browser did not already pass.
• No account, no stored copy. With no backend, there is no remote database of scraped data to breach, subpoena, or leak.

Calquer works this way: it runs locally, auto-detects the repeating list on the page, and exports CSV without any server. That does not make every use legal — the what and how still matter — but it removes the cloud-processor layer entirely. For the mechanics of a clean export, see our guide to exporting any website to CSV without code.

On-device collection does not erase copyright or privacy duties. If you scrape and then republish protected content or build a marketing database of personal data, the rules still apply to what you do with the result.

This is not legal advice — when should I consult a lawyer?#

This article is general information, not legal advice, and it cannot account for your specific facts or jurisdiction. Talk to a qualified lawyer before scraping at scale, scraping personal data, scraping behind logins, or reusing collected content commercially. The cost of an hour of advice is small next to a cease-and-desist or a regulator's fine.

Get professional advice when any of these apply:

• You plan to scrape behind a login or anything that touches access controls.
• You will collect personal data about identifiable people, especially EU or California residents.
• You intend to republish or resell collected content.
• You are building a large, automated, ongoing pipeline against a site that has objected.
• Your project crosses borders and you are unsure which country's law governs.

For a deeper, scenario-based walkthrough of legality, our overview of whether web scraping is legal stays updated as cases evolve. When in doubt, prefer public data, stay light on the server, and keep personal data to a minimum.

FAQ#

Is web scraping legal for personal use?#

For personal use on public data, scraping is generally low-risk: reading prices, titles, or public listings you can already see for your own analysis. Risk rises if you log in, bypass blocks, collect personal data, or republish copyrighted content. Personal use lowers exposure but does not override privacy or contract rules.

Does violating terms of service mean I broke the law?#

Not usually as a crime in the US. Many courts treat a terms-of-service breach as a contract matter, not a CFAA violation, especially for public data — as hiQ v. LinkedIn showed. You can still face a breach-of-contract claim, account bans, and IP blocks, and the rules differ in the EU.

Is scraping public LinkedIn or Google data allowed?#

It is contested. hiQ v. LinkedIn suggested scraping public, no-login profiles is unlikely to break the CFAA, but LinkedIn pursued breach-of-contract claims and blocks scrapers. Public search results face similar tension. Treat these platforms as high-friction: expect blocks, terms enforcement, and added privacy duties on personal data.

Can I scrape real estate or job listings legally?#

Often yes for the public, factual parts — prices, locations, titles, dates — collected lightly for your own analysis. Avoid copying full descriptions or photos to republish, and watch personal data like agent contacts. See our guides to scraping real estate listings to CSV for a concrete, responsible workflow.

Does GDPR apply if the personal data is already public?#

Yes. GDPR treats public personal data as personal data. You still need a lawful basis, you must respect access and deletion rights, and transparency is generally expected. "It was already public" is not consent and is not, on its own, a lawful basis under EU law.

---

Want to collect public, factual data the privacy-first way? Add Calquer to Chrome — it runs 100% on your device, with no account and no server.