Scraping data from websites is legal in many cases, but three things decide whether you’re in the clear or in the crosshairs: what you collect, how you access it, and what you do with it afterward. No single federal law bans web scraping outright. That said, people have faced lawsuits, fines, and even criminal referrals for doing it the wrong way.
Here’s what surprises most people: Google scrapes billions of web pages every day. That’s the foundation of how search engines work. Web scraping itself isn’t the problem. The problem is when scrapers ignore access controls, harvest private data, or violate a binding contract they agreed to.
This article covers every major legal angle on web scraping in 2026. You’ll get the key court cases, the actual laws that apply, a state-by-state breakdown, real penalty figures, and a clear picture of what’s safe and what isn’t.
Is It Legal to Scrape Data From Websites?
Web scraping is legal when you collect publicly accessible, non-personal data without bypassing access controls, in a way that does not harm the website, and in compliance with applicable laws. That’s the short answer courts and legal analysts have settled on in 2026.
No government has passed any law explicitly legalizing or making web scraping illegal. Instead, courts rely on the verdicts of lawsuits between web scrapers and website owners to determine what crosses a legal line.
The legal risk almost never sits in the act of scraping itself. It lives in three places: the type of data you collect, the method you use to get it, and what you do with it afterward. Get those three wrong and you can face civil lawsuits, hefty fines, or worse.
Key Quick Fact: The US has no federal law that specifically bans web scraping. Courts rely on existing statutes: the Computer Fraud and Abuse Act, copyright law, contract law, and state privacy regulations.
Is Web Scraping Legal?
Web scraping is generally legal if you scrape data that is publicly available on the internet. However, some kinds of data are protected by terms of service or national and even international regulations, so take care when scraping data behind a login, personal data, intellectual property, or confidential data.
Think of it like visiting a public library. Walking in, reading the books on open shelves, and taking notes is perfectly fine. Breaking into the back office, copying the librarian’s private records, or dismantling the shelves because you’re pulling data too fast is not.
Web scraping isn’t automatically illegal. But it’s not automatically legal either. Three specific factors determine whether you’re on solid ground or potentially crossing a line: the type of data, the access method, and the impact on the website.
| Factor | Low Risk | High Risk |
|---|---|---|
| Data type | Public, factual, non-personal | Personal, copyrighted, behind login |
| Access method | Open HTML, no authentication | Bypassing CAPTCHA, fake accounts |
| Impact on site | Normal traffic pace | Overloading servers, DDoS-like behavior |
| Use of data | Internal analysis, research | Republishing, training AI without consent |
Web Scraping Laws in the US
There is no single “web scraping law” in the United States. There are no federal laws against web scraping as long as the scraped data is publicly available and the scraping activity does not harm the website being scraped.
Instead, scrapers can run into trouble through a patchwork of existing statutes. The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the most cited. Copyright law under the Digital Millennium Copyright Act (DMCA) is another. Contract law applies when someone has agreed to a site’s Terms of Service. State privacy laws add another layer on top.
The trend in 2024 and 2025 has moved toward companies using contract law and copyright claims instead of the CFAA, especially after rulings reinforced that scraping public-facing sites is generally lawful.
- CFAA (18 U.S.C. § 1030): Anti-hacking statute. Applies when a scraper bypasses authentication.
- DMCA: Applies when a scraper circumvents technical protection measures like CAPTCHAs.
- Contract law: Applies when the scraper has agreed to Terms of Service that ban bots.
- State privacy laws: Apply when personal data is involved. CCPA, VCDPA, and 2026 state laws all have reach here.
Computer Fraud and Abuse Act and Web Scraping
The CFAA is an anti-hacking law, not an anti-scraping one. As long as scrapers focus on information that is truly public and aren’t breaking down digital doors to get it, they’re on solid legal ground under this statute.
The law targets “unauthorized access” to protected computers. For years, big platforms argued that sending a cease-and-desist letter withdrew authorization, making any further scraping a federal crime. Courts pushed back hard on that theory.
The Ninth Circuit found that on a publicly available website, there are no rules or access permissions to prevent access, and therefore accessing that publicly available data cannot violate the CFAA. That ruling still stands as the lead precedent in 2026.
Key Takeaway: The CFAA does not protect publicly accessible websites from scrapers. If anyone can see the data without a password, scraping it likely does not trigger the CFAA’s “without authorization” clause.
Where the CFAA does apply: fake accounts used to access login-required data, bypassing authentication systems, and scraping data from servers that require credentials to access.
The hiQ v. LinkedIn Web Scraping Ruling
The hiQ Labs v. LinkedIn case is the single most cited precedent in web scraping law, and it’s worth knowing exactly what happened and what it actually decided.
In the hiQ Labs v. LinkedIn lawsuit, a six-year litigation concluded with a confidential settlement. The key takeaway is that while data scraping of publicly available information may not violate the CFAA, it can lead to liability for breach of contract if prohibited by a website’s user agreement.
Here’s the short version of the timeline:
| Year | Development |
|---|---|
| 2017 | LinkedIn sends cease-and-desist to hiQ Labs |
| 2019 | Ninth Circuit rules hiQ’s scraping of public data likely doesn’t violate the CFAA |
| 2021 | Supreme Court vacates and remands in light of Van Buren v. United States |
| 2022 | Ninth Circuit reaffirms: public data scraping is not a CFAA violation |
| 2022 | LinkedIn wins summary judgment on breach of contract |
| 2022 | Settlement: hiQ pays $500,000, destroys all data, ceases all scraping |
The case addressed several issues related to breach of contract and the Computer Fraud and Abuse Act that may inform future cases involving scraping.
The takeaway: hiQ “won” the CFAA argument but still lost the case. Contract law killed them. Scraping public data is legally defensible under federal hacking law. It is not a free pass against breach of contract claims.
Scraping Publicly Available Data: What’s Legal?
Straightforward factual business data is the safest zone. Product prices, business hours, company addresses, public reviews, and availability status are information published for people to see and use. Facts themselves cannot be copyrighted under US law.
This is the “idea-expression dichotomy” from copyright law. The idea or fact itself isn’t protected. The specific creative expression of it is. So scraping a product price is fine. Copying the 500-word product description word for word crosses into copyright territory.
Common examples of low-risk public data scraping:
- Price comparison tools (Honey, CamelCamelCamel)
- Job listing aggregators
- Real estate listing platforms
- Public government records
- SEO keyword and metadata audits
- News headline aggregators
Google’s search engine crawls billions of web pages daily. The Wayback Machine scrapes and archives over 866 billion web pages for historical preservation. Price comparison tools scrape e-commerce sites to track pricing history and find better deals, saving consumers billions annually.
Key Takeaway: Scraping publicly visible, factual, non-personal data is the lowest-risk form of web scraping. Courts have consistently protected it under the CFAA. Other legal risks (contract, copyright, privacy) still apply depending on how you use it.
Is Scraping Behind a Login Illegal?
Scraping behind a login is a much riskier legal position than scraping public data. Web scraping is NOT legal when you scrape behind logins, collect personal data without a lawful basis, bypass technical protections, or violate a site’s Terms of Service after explicitly agreeing to them.
When you create an account and agree to Terms of Service, you’ve formed a contract. Deploying bots to extract data that only logged-in users can see breaks that contract. And if you used fake accounts to gain that access, you may have triggered CFAA liability too.
In the hiQ v. LinkedIn settlement, hiQ stipulated that LinkedIn could establish liability under the CFAA for accessing password-protected pages with fake accounts and under California state computer access laws.
In the 2024 Meta v. Bright Data ruling, the court found that Bright Data could only violate Meta’s terms of service if Meta proved that Bright Data scraped data while logged into a Meta account. When Meta could not prove this, the case collapsed.
The distinction is that clear: public access, generally safe. Login-required access, legally exposed.
Terms of Service and Web Scraping Law
Terms of Service (ToS) agreements are where most modern web scraping litigation happens. The CFAA has largely been taken off the table for public data. So platforms now sue scrapers for breach of contract.
Courts are often skeptical of browsewrap agreements, where the ToS is just a link tucked away in the website’s footer. For a browsewrap agreement to be enforced, the site owner must show that a user had “actual or constructive knowledge” of the terms.
Clickwrap agreements are different. If you checked a box that said “I agree to the Terms of Service,” that’s a binding contract. Any scraping the ToS prohibits is now a breach you can be sued for.
| Agreement Type | What It Is | Legal Strength Against Scrapers |
|---|---|---|
| Browsewrap | ToS linked in footer; implicit agreement by use | Weak; hard to enforce without proof of notice |
| Clickwrap | User checks box or clicks “I Agree” | Strong; creates binding contract |
| API Terms | Explicit terms for programmatic access | Very strong; courts routinely enforce these |
Courts have reached different conclusions about the enforceability of ToS provisions against scrapers in different contexts. The hiQ case indicated that ToS violations alone may not give rise to CFAA liability, but the Meta v. Bright Data case suggests contract-based claims may still be viable.
Robots.txt: Is It a Legal Requirement for Scrapers?
The robots.txt standard has existed since 1994 as a way for websites to communicate crawling preferences. Violating it isn’t automatically illegal in most jurisdictions, but respecting it demonstrates good faith and responsible operation.
Robots.txt is not a law. It’s a technical protocol. Ignoring it doesn’t automatically land you in court. But courts do look at whether a scraper respected it as a sign of good faith or bad behavior.
In the Reddit v. Perplexity AI lawsuit filed in late 2025, the complaint invokes DMCA Section 1201, alleging circumvention of technological measures including rate limits and anti-bot systems. This is a newer legal theory: treating robots.txt enforcement systems as “technological protection measures” under the DMCA.
Ignoring robots.txt now has a second legal risk beyond just looking bad in court. If a website uses technical systems to enforce its robots.txt and you circumvent those systems, you might face an anti-circumvention claim under the DMCA.
Key Takeaway: Robots.txt isn’t legally binding on its own. But bypassing the systems a site uses to enforce it may trigger DMCA anti-circumvention claims, a newer and increasingly tested legal theory.
Is Scraping Personal Data Legal?
Scraping personal data is one of the most legally dangerous things you can do online, regardless of whether that data is publicly visible.
Personally identifiable information (PII) is any data that could be used to directly or indirectly identify a specific individual. With the introduction of GDPR in 2018 and the California Consumer Privacy Act, the issue of personal data has become a hot topic that every web scraper must think about carefully.
The logic is this: the data may be sitting on a public page. But the person that data belongs to never consented to you harvesting it and storing it in a database. Privacy laws protect the individual’s rights over their information, not just the website’s rights over their server.
- Names, emails, phone numbers: PII
- Photos: PII (especially under biometric laws)
- Job titles linked to full names: PII
- Usernames tied to real identities: PII
- Plain product prices with no personal link: Not PII
The French data protection authority fined KASPR €240,000 for collecting LinkedIn data without appropriate consent. The decision indicates that publicly visible data may still be subject to privacy regulations when it contains personal information.
GDPR and Web Scraping
GDPR is a European regulation, but it has reach that extends well beyond Europe’s borders. The most common GDPR misconception is that it only governs private or sensitive information. GDPR applies to all personal data, regardless of whether it’s publicly available. If you scrape someone’s publicly visible LinkedIn profile, that’s personal data under GDPR.
If you’re based in the US but scraping data about EU residents, GDPR applies to you. The regulation requires a lawful basis for collecting, storing, and processing personal data. Most scraping use cases (lead generation, sales intelligence) don’t satisfy any of those lawful bases.
In the EU and UK, web scraping of publicly available, non-personal, and non-copyrighted content is generally legal, but scraping personal data without a lawful basis is prohibited under GDPR.
GDPR fines can reach €20 million or 4% of annual global revenue, whichever is higher. The KASPR case at €240,000 was a relatively modest enforcement action. Larger-scale scraping operations have faced far bigger penalties.
Key Takeaway: GDPR applies to personal data regardless of whether it’s on a public page. If your scraped dataset contains names, emails, or other individual identifiers of EU residents, GDPR compliance is not optional even from the US.
CCPA and Web Scraping in 2026
California’s Consumer Privacy Act is the most powerful US privacy law affecting scrapers. California’s revised CCPA regulations became effective January 1, 2026, adding new rules for automated decision-making technology, risk assessments, and data broker obligations.
If you scrape personal data about California residents and store or sell it, the CCPA treats you as a data broker or a business with compliance obligations. That means you may need to provide opt-out rights, maintain privacy disclosures, and respond to consumer data requests.
The 2026 update specifically targets automated decision-making. If you use scraped data to power algorithms that make decisions about people (credit, employment, insurance), new risk assessment requirements now apply.
| CCPA Obligation | Who It Applies To | 2026 Update |
|---|---|---|
| Right to opt out of data sale | Businesses selling personal data | Expands to automated profiling |
| Data broker registration | Anyone selling consumer data | Stricter enforcement |
| Privacy risk assessments | Businesses using ADMT | New requirement effective 2026 |
| Consumer data requests | CA residents’ data | Unchanged; 45-day response window |
State Web Scraping Laws in 2026
Three new comprehensive state privacy laws took effect in 2026. Indiana, Kentucky, and Rhode Island enacted comprehensive privacy laws effective in 2026, joining California, Virginia, Colorado, and several others with broad consumer data protections.
These laws don’t ban web scraping directly. But they create obligations when personal data of state residents is collected, regardless of where the scraper operates.
| State | Law Effective | Key Impact for Scrapers |
|---|---|---|
| California | Ongoing; 2026 CCPA update | Expanded ADMT rules; data broker registration |
| Virginia | 2023 | VCDPA; opt-out rights for data sale |
| Colorado | 2023 | CPA; universal opt-out mechanism |
| Indiana | 2026 | New comprehensive privacy law |
| Kentucky | 2026 | New comprehensive privacy law |
| Rhode Island | 2026 | New comprehensive data protection act |
| Illinois | Ongoing | BIPA applies to biometric data scraped from images |
Illinois deserves a separate note. Clearview AI faced multiple lawsuits for scraping billions of images from social media platforms. In 2025, Clearview settled a class action lawsuit, agreeing to pay approximately $51 million. Those cases were driven by Illinois’s Biometric Information Privacy Act (BIPA), which requires consent before collecting biometric identifiers like facial images.
Web Scraping Penalties and Fines
Here are real numbers from actual cases. These are not hypothetical risks.
The French data protection authority fined KASPR €240,000 for collecting LinkedIn data without appropriate consent.
LinkedIn was awarded $500,000 in damages from hiQ Labs, along with a permanent injunction requiring hiQ to destroy all scraped data and source code.
Clearview AI settled a class action for approximately $51 million and agreed to award plaintiffs 23% of company equity.
Anthropic settled a major class action for $1.5 billion in 2025, related to mass scraping of copyrighted content to train its AI models.
| Case | Year | Outcome | Amount |
|---|---|---|---|
| hiQ Labs v. LinkedIn | 2022 | Damages + permanent injunction | $500,000 |
| KASPR (France/CNIL) | 2024-2025 | GDPR fine | €240,000 |
| Clearview AI class action | 2025 | Settlement | $51 million + 23% equity |
| Anthropic content scraping | 2025 | Class action settlement | $1.5 billion |
| Facebook v. Power Ventures | 2009 | Court-ordered fiscal penalty | Undisclosed |
Key Takeaway: The days of scraping without financial consequence are over. Real enforcement actions have produced penalties ranging from hundreds of thousands to billions of dollars, depending on the scale of the operation and the type of data involved.
Can a Website Sue You for Scraping?
Yes. A website can sue you for scraping, and they don’t need a specific anti-scraping law to do it. Web scrapers may face legal challenges under state unfair competition statutes and unfair and deceptive acts and practices (UDAAP) laws, which have been adopted in various forms in all 50 states.
The legal theories a website can use against you:
- Breach of contract: If you agreed to their ToS and it bans bots.
- Copyright infringement: If you copied original creative content.
- Trespass to chattels: If your scraping overloaded or damaged their servers.
- DMCA anti-circumvention: If you bypassed technical access controls.
- CFAA (limited): If you accessed password-protected data without authorization.
- State privacy laws: If you collected personal data of state residents without a lawful basis.
Sometimes, scraping a website can be perfectly legal, but how you intend to use the data can make it illegal. The final use case of the data often has a significant impact on whether or not the overall activity is legal.
Web Scraping for AI Training: Legal in 2026?
This is the hottest legal question in tech right now, and courts haven’t fully resolved it yet.
In the United States, scraping publicly accessible data to train foundational AI models is generally considered to fall under fair use, provided the model does not reproduce exact copies of copyrighted works verbatim. The key test is transformativeness: does the AI model transform the input data into something new, or does it simply reproduce it?
Two headline-grabbing class actions led by Clarkson Law Firm against OpenAI and Google were both dismissed by federal judges in 2024 due to concerns over the breadth and vagueness of the complaints. The plaintiffs refiled their claims, and both proceedings are currently in the discovery phase as of early 2026.
The EU AI Act, with full enforcement beginning in 2026, requires AI developers to disclose training data sources, respect copyright opt-outs under the Copyright Directive’s text and data mining (TDM) exception, and labels AI-generated content. It also bans AI systems that scrape facial images from the internet.
A proposed US law called the AI Accountability for Publishers Act, introduced in February 2026, would require AI companies to get permission and pay publishers before scraping their content. That bill had not passed as of early 2026, but its introduction signals where Congress is heading.
If you’re scraping to train an AI model, the legal exposure is real. Document your sources, your purpose, and your data handling processes carefully.
How to Scrape Websites Legally
Legal web scraping comes down to a few consistent principles courts and regulators have reinforced over time.
If scraping involves bypassing authentication, ignoring robots.txt, or manipulating URLs to extract hidden or gated content, it raises red flags. Courts and regulators may view those tactics as unauthorized access, especially when combined with large-scale or commercial scraping.
Practical checklist for staying on the right side of the law:
- Only collect data that’s visible to any user without logging in.
- Check and respect the site’s robots.txt file before scraping.
- Read the Terms of Service. If it bans automated collection, don’t proceed without legal review.
- Never use fake accounts to access login-required data.
- Limit your request rate: reasonable rate limiting of 1 to 2 seconds between requests minimum shows you’re not causing harm.
- Don’t harvest personal data (names, emails, photos) without a clear legal basis.
- If you’re storing or using personal data of EU or California residents, review GDPR and CCPA compliance.
- If you’re feeding scraped data into an AI model, consult the EU AI Act and monitor the AI Accountability for Publishers Act.
- Document your traffic patterns, log scraping decisions, and keep a record of the endpoints you access. Doing that doesn’t just keep you safe; it shows that you’re serious about compliance.
The cleanest alternative: use an official API. Many platforms (Google, Twitter/X, Reddit, LinkedIn) offer API access for developers. API terms are explicit, enforceable, and far easier to stay compliant with than trying to interpret whether a browsewrap ToS is legally binding.
Frequently Asked Questions
Can I get arrested for web scraping?
Criminal charges for web scraping are rare but possible. The CFAA, a federal statute, does carry criminal penalties for accessing protected computers without authorization. Courts have consistently held that scraping publicly accessible data does not trigger the CFAA. Where criminal exposure exists is in scraping behind logins using fake accounts, bypassing authentication systems, or causing significant damage to servers. Most scraping enforcement actions result in civil lawsuits and financial damages, not criminal charges.
Does violating a website’s robots.txt make scraping illegal?
Violating robots.txt is not automatically illegal. It is a technical protocol, not a law. Courts do consider whether you respected robots.txt as evidence of good faith. The newer legal risk is bypassing the systems a website uses to enforce its robots.txt, which may constitute DMCA anti-circumvention under Section 1201. The Reddit v. Perplexity lawsuit filed in late 2025 is testing this exact theory.
Is it legal to scrape Google search results?
Scraping Google search results violates Google’s Terms of Service. Google actively detects and blocks scrapers, and the ToS explicitly prohibits automated access. While scraping public data is generally defensible under the CFAA, Google’s ToS creates a contract-based liability risk. Google also uses technical protection measures to block bots, and circumventing those could raise DMCA anti-circumvention issues. The safe alternative is Google’s official Search API.
Can websites detect and block scrapers legally?
Yes, websites can legally detect and block scrapers. Courts have upheld a website operator’s right to deny access and implement technical blocks, even against scrapers collecting only public data. In the hiQ v. LinkedIn case, the court did find that LinkedIn’s technical blocking was lawful. What websites cannot do is use the CFAA to criminally prosecute scrapers who were only accessing genuinely public data. Detection and blocking is a right. Using it as a basis for a federal criminal charge against a public-data scraper is not.
Is web scraping legal for academic research?
Web scraping for academic research occupies more favorable legal territory than commercial scraping. The fair use doctrine under US copyright law weighs purpose heavily, and non-commercial research or educational use gets significant credit. The EU Copyright Directive’s text and data mining (TDM) exception explicitly permits scraping for non-commercial scientific research purposes. That said, academic researchers still need to respect privacy laws when scraping personal data. Institutional review boards at universities often provide guidance on whether a proposed scraping project satisfies both legal and ethical standards.
Web scraping law in 2026 is not a simple yes or no question. It’s a matrix of what you collect, how you access it, where the data subjects live, and what you do with the results.
Bookmark this page. The legal environment around scraping is shifting fast, especially with AI training lawsuits, new state privacy laws, and proposed federal legislation all landing in the same year. What’s safe today can become a liability tomorrow.
