Is Web Scraping Legal? A Plain-English Guide (2026)
Is web scraping legal in 2026? The plain-English answer, straight from the court record: what US and EU law allow, where scrapers get sued, what to check.
On this page
hiQ Labs beat LinkedIn in federal court twice, paid LinkedIn a reported $500,000 anyway, and went out of business. Ryanair won a jury verdict against Booking.com for scraping flight prices, and a judge erased it six months later. That tension is the honest answer to whether web scraping is legal in 2026: the law mostly lets you scrape, and lawsuits mostly punish you for scraping anyway.
I read the actual court records and the briefings of the firms that argued these cases, so this page can be specific where most “is it legal” articles hedge. Eight rulings, four bodies of law, one decision table, and the checklist I run before any scrape.
This is not legal advice. Reading court records makes me a well-read scraper, not a lawyer. Nothing on this page creates a lawyer-client relationship. If real money rides on a project, buy an hour of a lawyer licensed where you operate before you send the first request.
Is web scraping legal? The short answer
For genuinely public, non-personal data, reached without breaking through a gate: yes. No US federal ruling since 2021 has held the opposite, and four separate cases ended with the scraper winning outright. hiQ kept scraping public profiles until it settled. Meta dropped its case against Bright Data a month after losing the legal question. X did the same. Booking.com beat Ryanair’s hacking-law claims owing nothing.
Two exceptions do the real damage:
Personal data changes everything. Europe’s GDPR applies to an identifiable person’s data from the first byte you collect, whether or not the profile was public. The facial-recognition company Clearview AI has been fined more than €100 million combined by European regulators for exactly this. If your scrape collects names, emails, photos, or phone numbers of real people, run the GDPR section rules first.
Legal and safe from a lawsuit are different things. When plaintiffs lost the hacking-law route, they moved to contract claims under the terms of service. That route survived its first big test in March 2026, when a federal judge sent Reddit’s scraping suit against Anthropic back to state court. You can be right on the law and still spend five years and a fortune proving it.
Contents: The short answer · Four bodies of law · The scoreboard · Fine, risky, sued · By country · The checklist · FAQ
Four bodies of law, not one scraping statute
There is no web scraping law in the United States. Ask whether a scrape is “legal” and you are really asking four overlapping questions about the same request:
| Body of law | What it actually bans | Who enforces it |
|---|---|---|
| Anti-hacking statutes (the CFAA in the US) | Getting past a technical or permission gate | Federal prosecutors, platforms |
| Copyright | Copying expression (text, photos, code). Facts are free | Rights holders |
| Data protection (GDPR and its cousins) | Processing personal data without a lawful basis | Regulators, with fines that hurt |
| Contract | Doing what a site’s terms forbid | Any platform whose terms you clicked past |
The anti-hacking law draws its line at gates
The Computer Fraud and Abuse Act is the “unauthorized access” statute, and for two decades companies read it as “whatever our terms say.” The Supreme Court closed that reading in June 2021. Van Buren v. United States involved a police sergeant who used a license-plate database he was allowed to use, for a reason he wasn’t. The Court tossed his conviction: misusing permitted access is not a federal crime. Access is gated or it isn’t.
Applied to scraping, the rule becomes almost physical. If a page loads in a logged-out browser, you are not “unauthorized” when your program loads it too. The case law since then confirms it, one loss at a time for the platforms:
- hiQ v. LinkedIn: LinkedIn sued an analytics startup that scraped public profiles. The Ninth Circuit twice blocked LinkedIn from cutting hiQ off, in 2019 and again in April 2022 after the Supreme Court’s Van Buren remand, on the logic that public-profile scraping probably isn’t CFAA access at all. LinkedIn still won in the end: the parties settled in late 2022, hiQ agreed to a permanent injunction, deleted its scraped data and code, and paid a reported $500,000. The company didn’t survive. Winning the legal question and surviving the lawsuit are separate skills. (The full case, here.)
- Meta v. Bright Data (January 23, 2024): a California federal court granted summary judgment that pulling publicly visible Facebook data is not “unauthorized access,” and that Meta’s terms couldn’t create CFAA liability where none existed. Meta dropped the case a month later.
- X Corp v. Bright Data (filed July 2023): same logic, same defendant. In May 2024 the court knocked out X’s claims over scraping public posts; X dropped what remained that summer.
- Ryanair v. Booking.com is the counterweight. Ryanair claimed Booking bypassed its bot defenses (proxies, recycled browser data) to scrape fares. A Delaware jury agreed in the July 2024 trial and awarded damages of exactly $5,000, the statutory minimum for even reaching the statute. On January 22, 2025, the judge granted judgment as a matter of law and erased it: Ryanair never proved $5,000 of loss. Booking.com won. The suit had run from 2020 to 2025.
Notice the pattern across the docket. Public data, no gate, no personal data: the scraper wins every time. The only case that even reached a jury was the one alleging someone punched through technical walls. That’s the theory that gets a plaintiff to a jury, and even it produced zero dollars after five years. Where exactly the gate line sits is the subject of the CFAA explainer.
Copyright protects expression, not facts
The Supreme Court settled the fact question in 1991. Feist v. Rural Telephone held that a phone book’s alphabetical list of names and numbers wasn’t creative enough to copyright. Facts are free. Prices, scores, temperatures, opening hours, job listings, stock levels: copy all you want.
Expression is different. The article written about the price, the photograph of the product, the code: that belongs to someone. Scraping it into a private analysis is one thing. Republishing it is the thing that draws infringement claims, and “I found it on the open web” is not a defense anyone has ever won with. What you can reuse, and the exceptions, live in the copyright guide.
If you’re feeding scraped content to an AI model, that’s the live frontier. In June 2025 a court treated Anthropic’s training on legally purchased books as fair use while still hammering it for copying from pirated libraries. The case settled in September for a reported $1.5 billion, covering roughly 500,000 authors. That article is here.
Personal data is where the fines live
Publicity is not consent. That sentence is most of European data-protection law as it applies to scraping. GDPR regulates personal data: anything that identifies a living person, from a full name to an email to a face. A public profile is still personal data, and collecting it is still “processing” that needs a lawful basis. Clearview AI scraped billions of facial images from the open web to build a search engine for faces. Five European regulators have fined it more than €100 million combined (the Dutch DPA led with €30.5 million in 2024) and ordered the data deleted.
Since February 2, 2025, the EU AI Act also bans untargeted scraping of facial images outright, so the “build a face database” business model is now prohibited in Europe by two laws at once. The UK runs a near-identical regime, and India’s DPDP Rules, notified in November 2025, began phasing its own consent law in. My operating rule, which has kept me out of trouble: emails, phones, faces, and names-at-scale are a stop-and-get-advice signal. Everything else proceeds. The lawful-basis analysis is in the GDPR guide.
Terms of service are the courtroom that’s left
Once the hacking claims fell, platforms sued in contract. That shift is the biggest live development in scraping law. X’s contract claims died where they targeted public data. But on March 30, 2026, Judge Trina L. Thompson sent Reddit’s June 2025 suit against Anthropic back to California state court, holding that the contract and tort claims over scraped data are not swallowed by federal copyright law. Translation: the contract route has independent life, and it will get its day in court.
Three practical points before you dismiss terms of service as unenforceable paper:
- Violating terms is not a crime in the US. The Justice Department’s October 2021 charging policy tells federal prosecutors not to bring CFAA cases that rest on terms-of-service violations alone.
- It is a civil claim, plus an instant ban, plus the evidence file for every other claim a platform might bring. hiQ’s settlement injunction came through contract, not the CFAA.
- Terms you actively clicked carry more weight than terms buried in a footer. Courts have doubted the second kind; nobody has tested the first kind in a scraping case and won.
The full analysis, including when browsewrap holds up, is in the terms-of-service guide.
The scoreboard, in one table
| Case | Ruling | What it settled |
|---|---|---|
| Van Buren v. US (Supreme Court, June 2021) | Conviction reversed | Misusing permitted access isn’t a crime; the “gates up or down” test |
| hiQ v. LinkedIn (9th Cir. Apr 2022; settled Nov 2022) | Scrape allowed, then settled | Public-profile scraping is probably lawful, and can still cost you the company |
| Meta v. Bright Data (N.D. Cal., Jan 23, 2024) | Summary judgment for Bright Data | Browsing public Facebook data isn’t unauthorized access |
| X Corp v. Bright Data (N.D. Cal., May 2024) | Claims over public posts dismissed | Same logic for X; X dropped the case months later |
| Ryanair v. Booking.com (D. Del., trial Jul 2024, reversed Jan 22, 2025) | Jury verdict erased | Even gate-bypass claims can end at $0 after five years |
| Reddit v. Anthropic (remanded Mar 30, 2026) | Back to state court | Contract claims over scraping proceed independently |
What’s fine, what’s risky, what gets you sued
| Green: boring and legal | Yellow: eyes open, advice if money’s involved | Red: expect to lose |
|---|---|---|
| Public prices, stock levels, scores, listings, schedules | Commercial monitoring of one platform at scale, indefinitely | Personal data in bulk: faces, emails, phones, names |
| A page any logged-out human can read, at a polite rate | Scraping content you will republish | Punching past logins, paywalls, or bot walls |
| Public job ads, public events, public research data | Data behind a free login that your own account can see | LinkedIn behind login; anything a court order has already named |
| Metadata: titles, dates, URLs, public stats | Personal data about a handful of people, with a documented lawful basis | Anything you’d have to hide: proxies against bans, spoofed fingerprints |
That last red cell deserves a note, because people argue with it. Proxy rotation and fingerprint spoofing are not crimes by themselves. They change your story, though. “I read a public page” becomes “I defeated the measures keeping me out,” and that is the sentence Ryanair spent five years trying to turn into liability.
One special case deserves its own flag: search-engine results. The facts are public, but the engines sell the same data through paid APIs and enforce their terms harder than anyone else on the web. Scraping Google directly is its own decision tree, covered in the search-results guide.
Ranked by how often each actually hurts someone, from a decade of watching: personal data at scale first (regulators act without being sued), gates second, contract suits third, copyright a distant fourth unless you republish. Scale is the multiplier in every category. One request is research. A million requests a month is a business, and businesses get sued like businesses.
Where you’re located changes the answer
- United States. The friendliest major jurisdiction after 2021. No scraping statute, a narrowed hacking law, and contract as the main residual risk.
- European Union. GDPR from the first byte of personal data, plus a separate database right that protects substantial extractions from structured databases even where copyright doesn’t.
- United Kingdom. Mirrors the EU regime post-Brexit (UK GDPR, retained database right), with its own regulator and fine schedule. Country breakdown here.
- India. No dedicated scraping law; the analysis runs through the IT Act, contract, and copyright, now with DPDP consent rules layered on top. Country breakdown here.
If your question was really “what is scraping” before it was “is it legal,” start with what data scraping is, because half the legal analysis depends on which of the four techniques you’re using.
The checklist I run before every scrape
- Can a logged-out human see this data in a plain browser? If no, it’s behind a gate, and gates are where scraping claims become real. Stop or get advice.
- Is it personal data? Names, emails, faces, phones, anything identifying: run the GDPR analysis or drop the field.
- Will I republish it, or only analyze it? Facts are free; expression isn’t. Analysis is the safe use.
- What does robots.txt say, and can I hold to a polite rate? Neither is law. Both are the record you’ll want to show if anyone ever asks how you behaved.
- How central is my use to this platform’s business? Volume aimed at one company’s core asset (fares, feeds, listings) is what summons lawyers.
- Is money riding on any yellow answer? Buy the lawyer hour. It’s the cheapest line item most data projects have.
A note on tools, since people ask. My own scraper respects robots.txt, throttles itself per host, and runs entirely on my machine, so the data never leaves it. That’s hygiene, not a legal defense; no tool makes scraping legal, and any that claims to is selling you something. The full politeness setup is in the best-practices guide, and the robots.txt specifics in its own explainer.
Five questions people ask next
Can you go to jail for web scraping? Not for reading public pages. US CFAA prosecutions target intrusion: gates, credentials, or hacking bundled with other crimes. The Justice Department’s 2021 policy also rules out prosecuting terms-of-service violations alone. Bypassing technical barriers is where criminal exposure theoretically returns.
Is it legal to scrape publicly available data? In the US, every federal ruling since 2021 that faced the question squarely said yes. In the EU, public data is still personal data if it identifies people, so GDPR applies. Copyright covers the expression, never the facts.
Does robots.txt make scraping legal or illegal? Neither. It’s a convention, not a law, and courts rarely treat it as decisive. It matters as evidence of good behavior, and because ignoring it alongside other aggression looks bad in front of a judge.
Is it illegal to scrape a site behind a login? Not automatically. If your own legitimate account can see the data, the hacking claim is weak after Van Buren, but the contract claim is live, and hiQ’s fate shows how settlements go. If you’d have to break a wall, everything worsens.
What happens if I violate a website’s terms of service? Nothing automatic, at first: you risk a ban, then a civil breach-of-contract suit, and the violation becomes evidence supporting every other claim. It is not a crime in the US by itself, per the DOJ’s charging policy.
Where this goes deeper
Every section above has a full-length companion: the CFAA and the gate test, what actually happened in hiQ, terms of service, copyright, GDPR, AI-training data, robots.txt, and the UK and India breakdowns.
And the honest closing move, which is the one the plan row asked for: this page is information, not legal advice, and it ages like all court reporting. The docket above is current as of October 2026. If your project has revenue attached, or names attached, or more traffic than a laptop can generate, pay a lawyer licensed in your jurisdiction for one hour and walk them through the six-question checklist above. I’ve watched people spend six figures on scraped-data lawsuits and regret not spending the $500.
