Scraping data from websites is not automatically illegal, but it can become illegal quickly depending on what you’re scraping, how you’re doing it, and what you do with the data afterward. No single law bans web scraping outright, but several federal and state laws create serious exposure for scrapers who cross specific lines.
The legal picture in 2026 is more complex than it was three years ago. AI companies scraping content to train large language models have accelerated litigation, and courts are actively reshaping the law around data collection, copyright, and unauthorized access. What was a gray area in 2022 now has more direct legal consequences.
This article covers the full legal framework: the Computer Fraud and Abuse Act, copyright law, privacy regulations including CCPA and GDPR, robots.txt legal significance, terms of service, and the specific circumstances where scraping crosses from legal research into criminal conduct.
Every legal reference here is current for 2026.
Is It Illegal to Scrape Data in the United States
Scraping data from websites is not categorically illegal in the United States, but it sits in a legal framework where several laws can apply depending on the specific facts. The legality depends on whether the target site restricts access, what type of data is collected, whether the data is protected by copyright or privacy law, and how the scraped data is used.
The most common legal exposure comes from three separate legal frameworks operating simultaneously: the Computer Fraud and Abuse Act (18 U.S.C. § 1030) for unauthorized computer access, copyright law (17 U.S.C. § 106) for reproduction of protected content, and privacy laws (CCPA, GDPR, and state equivalents) for collection of personal data.
Scraping publicly available, non-personal, non-copyrighted data for research, journalism, or competitive intelligence has historically been treated as legally permissible. The 9th Circuit’s 2022 ruling in hiQ Labs v. LinkedIn affirmed that scraping publicly accessible data generally does not violate the CFAA. But “generally” isn’t “always,” and the specifics matter enormously.
Quick Facts:
- Scraping publicly available data: generally legal after hiQ (2022)
- Scraping behind a login or paywall: high CFAA risk; likely unauthorized access
- Scraping personal data (names, emails, addresses): triggers privacy law compliance obligations
- Scraping copyrighted content for commercial use: copyright infringement risk
- Scraping while violating terms of service: civil breach of contract; not automatically criminal
- Scraping for AI training without license: active legal battleground in 2026
When Is Web Scraping Illegal Under US Law
Web scraping becomes illegal in the United States when it involves unauthorized access to computer systems under the CFAA, reproduction of copyrighted content without fair use justification, collection of personal data in violation of privacy laws, or deliberate circumvention of technical access controls.
The clearest illegal scenario is scraping data from behind a login, paywall, or authentication system where the scraper either bypasses authentication or uses credentials obtained improperly. Courts have consistently treated this as “unauthorized access” under the CFAA, and it can result in both civil lawsuits and federal criminal prosecution.
A second clear category is scraping copyrighted content, such as articles, images, books, or software, and reproducing it commercially without authorization. This doesn’t require unauthorized access to trigger liability; it’s a straight copyright infringement claim that any website owner can bring.
Scenarios where web scraping is illegal:
| Scenario | Primary Legal Exposure | Type |
|---|---|---|
| Scraping behind a login without authorization | CFAA § 1030 unauthorized access | Criminal and civil |
| Circumventing CAPTCHA or bot detection | CFAA; possibly DMCA § 1201 | Criminal and civil |
| Scraping and republishing copyrighted articles | Copyright Act 17 U.S.C. § 106 | Civil infringement |
| Collecting personal data of EU residents without lawful basis | GDPR violation | Civil; regulatory fine |
| Collecting personal data of California residents without disclosure | CCPA violation | Civil; regulatory fine |
| Scraping at scale that disrupts server performance | CFAA; possibly civil nuisance | Criminal and civil |
The gray area shrinks considerably when specific prohibited conduct is involved. If you’re breaking a lock to get in, you’re in illegal territory. If you’re reading what’s publicly posted in a park, you’re generally not.
Computer Fraud and Abuse Act and Web Scraping
The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary federal statute applied to web scraping cases. The CFAA makes it a crime to access a computer “without authorization” or in a manner that “exceeds authorized access.” For years, courts disagreed sharply about whether scraping a publicly accessible website constituted unauthorized access.
The Supreme Court clarified this in Van Buren v. United States (2021), holding that the “exceeds authorized access” language refers to access of areas of a computer that the person is not permitted to access at all, not to misuse of information obtained through otherwise permitted access. This narrowed interpretation made CFAA liability harder to establish for general public website scraping.
The CFAA applies with full force when a scraper bypasses technical controls: breaking through login requirements, circumventing CAPTCHAs, using credential stuffing to gain unauthorized access, or continuing to access a system after receiving a cease-and-desist and IP block. These are clearly “without authorization” under any interpretation.
CFAA application to web scraping scenarios:
- Public website, no login, no technical blocks, no prior cease-and-desist: CFAA likely does not apply (hiQ; Van Buren)
- Website requires login that scraper bypasses: CFAA likely applies
- Website sends cease-and-desist and blocks IP; scraper circumvents: CFAA likely applies
- Scraper uses fake credentials to access: CFAA likely applies
- Scraper accesses only what any browser would see: CFAA likely does not apply
The CFAA still matters because any scraping operation that involves even minimal technical circumvention moves from the gray area into the clearly illegal zone.
hiQ Labs v. LinkedIn and What It Means for Web Scraping
The hiQ Labs v. LinkedIn case is the most important US court ruling on web scraping legality, and its 2022 Ninth Circuit outcome significantly defined the legal boundaries. The case centered on whether LinkedIn could use the CFAA to stop hiQ from scraping publicly accessible LinkedIn profiles.
LinkedIn tried to stop hiQ by sending a cease-and-desist and blocking hiQ’s scrapers. hiQ argued that scraping public data didn’t violate the CFAA because the data was publicly accessible without any login or authentication requirement. The Ninth Circuit agreed with hiQ on remand after the Van Buren decision, holding that scraping publicly available data does not constitute “without authorization” under the CFAA.
The case’s practical significance is significant but limited. It applies in the Ninth Circuit (California, Washington, Oregon, and several other western states). Other circuits haven’t adopted the same analysis. And the ruling specifically addressed publicly accessible data; it doesn’t protect scraping that involves any form of access restriction.
What hiQ established and what it didn’t:
| What hiQ Established | What hiQ Did NOT Establish |
|---|---|
| Scraping publicly accessible data is not CFAA violation | Right to scrape data behind any login |
| CFAA “authorization” requires technical access restriction | Right to ignore cease-and-desist letters |
| LinkedIn cannot use CFAA alone to ban public data scraping | Protection from copyright claims |
| Public data scraping is lawful under CFAA in 9th Circuit | Protection from GDPR or CCPA violations |
| Scraping may still face other legal theories | Protection from ToS breach claims |
Key Takeaway: The hiQ ruling protects scraping of genuinely publicly accessible data from CFAA liability in the 9th Circuit, but it provides no protection against copyright infringement, privacy law violations, or ToS breach claims, and it doesn’t apply nationally.
CFAA Criminal and Civil Penalties for Illegal Scraping
CFAA violations carry both civil and criminal penalties that scale significantly based on the severity of the offense and the intent of the violator. Understanding the penalty structure helps assess actual legal risk from illegal scraping activities.
Criminal penalties under 18 U.S.C. § 1030(c) range from misdemeanor charges (one year) for basic unauthorized access with no aggravating factors to felony charges of up to 20 years in prison for violations involving damage to critical infrastructure, national security systems, or fraud causing substantial financial harm.
For most web scraping scenarios that don’t involve national security or critical infrastructure, the realistic criminal penalty for a first offense is five years under 18 U.S.C. § 1030(c)(2)(B) when the offense involves interstate commerce and causes damage exceeding $5,000 within a year.
CFAA penalty structure for web scraping violations:
| Violation Category | Maximum Criminal Penalty | Civil Liability |
|---|---|---|
| Basic unauthorized access (no damage) | 1 year (misdemeanor) | Actual damages + attorney fees |
| Unauthorized access with intent to defraud | 5 years | Damages + injunctive relief |
| Causing damage over $5,000 | 5 years | Actual or liquidated damages |
| Unauthorized access to protected computer (serious) | 10 years | Significant civil exposure |
| Critical infrastructure or national security | Up to 20 years | Maximum civil exposure |
| Repeat offender | Double maximums | Enhanced damages |
Civil suits under the CFAA allow affected parties to recover actual damages, lost profits, costs of damage assessment and restoration, and attorney’s fees. Many CFAA claims are brought as civil cases by companies whose websites were scraped, not as criminal prosecutions by the government.
Copyright Law and Scraped Data
Copyright law creates a separate and significant layer of legal exposure for web scrapers, independent of CFAA issues. The question isn’t whether you can access the data; it’s whether you can reproduce, distribute, or create derivative works from data that’s protected by copyright.
Copyright protects original works of authorship fixed in a tangible medium, including text articles, photographs, music, software code, and certain database compilations. Scraping and storing copyrighted text or images from websites reproduces them, which requires authorization from the copyright holder under 17 U.S.C. § 106 unless a fair use defense applies.
The fair use analysis under 17 U.S.C. § 107 considers four factors: the purpose and character of the use (commercial vs. educational, transformative vs. reproductive), the nature of the copyrighted work, the amount taken relative to the whole, and the effect on the market for the original. Research, commentary, and journalism uses tend to favor fair use; commercial reproduction and AI training are more contested.
Copyright protection for web content and scraping:
- Factual data (stock prices, weather, sports scores): generally not copyrightable; freely scrapable
- Original articles, blog posts, creative writing: copyrighted; requires license or fair use
- Photographs and images: copyrighted; requires license or fair use
- Database compilations with creative selection: potentially protected under compilation copyright
- Raw facts in a database (phone book): not copyrightable after Feist Publications v. Rural Telephone (1991)
- Code and software: copyrighted; scraping source code raises separate issues
Is Scraping Personal Data Illegal Under Privacy Laws
Scraping personal data is not automatically illegal, but it triggers compliance obligations under a growing body of federal and state privacy laws, and failing to comply with those obligations creates regulatory and civil liability.
Personal data in the privacy law context means any information that identifies or can reasonably be used to identify a specific individual: names, email addresses, phone numbers, social media profiles, IP addresses, location data, and in some contexts, employment information. When a scraper collects this type of data about real people, privacy law frameworks apply.
The key legal question is whether the scraper has a legitimate legal basis for collecting and processing the personal data, and whether the scraper is complying with the notice, disclosure, and security requirements that apply to whoever collected the data originally.
Privacy law triggers for personal data scraping:
| Data Type | Privacy Law Risk | Applicable Framework |
|---|---|---|
| Names and email addresses | High | CCPA, GDPR, state laws |
| Social security numbers | Very high | Identity theft statutes; GLBA |
| Health information | Very high | HIPAA (if covered entity context) |
| Financial information | High | GLBA; state consumer protection |
| Location data | High | CCPA; emerging state laws |
| IP addresses | Medium to high | GDPR; some state laws |
| Job titles and employer info | Medium | CCPA; GDPR in EU context |
The practical risk profile for personal data scraping depends heavily on who the individuals are, where they’re located, and what you plan to do with the data.
GDPR and Web Scraping Data From EU Users
The General Data Protection Regulation applies to any processing of personal data belonging to individuals in the European Union, regardless of where the scraper is located. If you’re a US developer scraping personal data about EU residents, GDPR applies to you.
GDPR requires a lawful basis for processing personal data under Article 6. For web scraping, the most commonly attempted bases are legitimate interests and consent. Scraping publicly posted personal data might qualify as legitimate interests processing in some cases, but the data subject’s interests, rights, and freedoms must not override those interests, and the GDPR “right to be forgotten” under Article 17 means individuals can request deletion of their data.
GDPR violations carry financial penalties up to 20 million euros or 4% of annual global turnover, whichever is higher. Enforcement has been active: European data protection authorities have fined companies and individuals for scraping personal data without adequate legal basis.
GDPR compliance requirements for web scrapers:
- Identify a lawful basis (Article 6) for each category of personal data collected
- Provide privacy notices if collecting data directly from individuals
- Respect data subject rights: access, rectification, erasure, restriction, portability
- Implement appropriate technical security measures for collected data
- Maintain records of processing activities
- Conduct Data Protection Impact Assessments for high-risk processing
- Do not transfer data outside the EU/EEA without adequate safeguards
The extraterritorial reach of GDPR means that US-based scrapers targeting European individuals face European enforcement, which has increased in frequency and penalty severity since 2018.
Key Takeaway: GDPR applies to US-based scrapers collecting personal data about EU residents, with fines reaching 4% of global annual turnover; legitimate interests processing of publicly available EU personal data is possible but requires a documented balancing test and must respect data subject rights.
CCPA and Scraping California Residents’ Personal Data
The California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), strengthened by the California Privacy Rights Act (CPRA) effective 2023, creates specific compliance obligations when scrapers collect personal information about California residents. This applies regardless of where the scraper is located.
The CCPA/CPRA grants California residents the right to know what personal information is collected about them, the right to delete personal information, the right to opt out of the sale or sharing of their personal information, and the right against discrimination for exercising those rights. Businesses that scrape and then sell or share California residents’ personal data are squarely within CCPA’s reach if they meet the thresholds.
The CCPA/CPRA applies to for-profit businesses that collect consumers’ personal information and: have annual gross revenues over $25 million, buy/sell/receive/share the personal information of 100,000 or more consumers or households annually, or derive 50% or more of annual revenue from selling consumers’ personal information. Many data brokers and large-scale scrapers hit these thresholds.
CCPA/CPRA penalties for scraping violations:
| Violation Type | Penalty Per Record | Maximum Per Incident |
|---|---|---|
| Unintentional violation | Up to $2,500 | Depends on records affected |
| Intentional violation | Up to $7,500 | Depends on records affected |
| Data breach of sensitive PI | Up to $750 per consumer per incident | Depends on breach size |
| Child data violation (under 16) | Enhanced penalties | Up to $7,500 per violation |
The California Privacy Protection Agency (CPPA) enforces CCPA/CPRA and has issued guidance specifically addressing the scraping of personal information from public sources.
robots.txt Legal Status and Web Scraping
A robots.txt file is a text file that website operators use to communicate instructions to web crawlers about which parts of the site should not be accessed. It has zero binding legal force under US law by itself. Ignoring a robots.txt file is not a CFAA violation, a copyright violation, or any other specific statutory crime.
However, robots.txt carries significant practical and legal significance in litigation. Courts treat it as evidence in establishing whether a scraper had notice that access was restricted. If a robots.txt file explicitly prohibits scraping and a scraper proceeds anyway, that’s evidence supporting a finding that the scraper was aware access was not authorized, which strengthens a CFAA claim in cases where other access restrictions also exist.
The Ninth Circuit in hiQ v. LinkedIn specifically noted that LinkedIn’s use of IP blocking, cease-and-desist letters, and technical measures to restrict access were relevant to the authorization analysis. robots.txt functions similarly: it establishes that the site owner communicated unwanted access, even if it doesn’t have independent legal force.
robots.txt legal significance summary:
- Not legally binding: no court has held robots.txt violation alone is a CFAA offense
- Evidential value: strong evidence that scraper had notice of unwanted access
- Relevant to authorization analysis: strengthens CFAA claims when combined with other restrictions
- IP blocking: much stronger evidence than robots.txt; actively enforcing access restriction
- Cease-and-desist letter: strongest notice evidence; continuing access after C&D is high-risk
- API terms: sites with APIs often expressly limit scraping in favor of API use
Think of robots.txt like a “No Trespassing” sign on public land. The sign doesn’t create legal authority by itself, but ignoring it is evidence you knew you weren’t welcome.
Terms of Service Violations and Web Scraping
Violating a website’s terms of service when scraping creates civil liability for breach of contract in most cases, but it does not automatically make the scraping illegal under criminal statutes. The key legal question after Van Buren v. United States (2021) is whether ToS violation alone constitutes “unauthorized access” under the CFAA.
Van Buren held that violating ToS while otherwise having technical access to a system does not constitute CFAA liability. A police officer who accessed a license plate database for personal reasons (violating ToS) but who had legitimate technical access to the system was not guilty of “exceeding authorized access” under Van Buren. This reasoning significantly reduced CFAA exposure for scrapers who violate ToS on publicly accessible sites.
The civil liability from ToS violation is still real. Website operators can sue for breach of contract, unjust enrichment, and in some cases tortious interference. The damages in ToS breach cases are typically the actual harm caused, which can be substantial when scraping is large-scale or commercially damaging.
ToS violation consequences for web scrapers:
| Consequence | Applies When | Severity |
|---|---|---|
| Account termination | Scraping with credentials | Immediate; no legal process needed |
| Civil lawsuit for breach of contract | ToS is a valid contract | Actual damages; injunction |
| CFAA civil claim | ToS violation + technical access restriction | Civil damages; not usually criminal |
| CFAA criminal claim | ToS violation + circumventing technical controls | Criminal exposure; 1 to 10 years |
| Copyright infringement claim | ToS violation + copying protected content | Statutory damages up to $150,000 per work |
Scraping with an account (logged in) after ToS clearly prohibit it is more dangerous than scraping publicly accessible pages without authentication, because the former involves using authorized credentials in a way that was explicitly forbidden.
AI Training Data Scraping Legal Issues in 2026
Scraping data to train AI models is the most legally contested form of web scraping in 2026, with multiple major lawsuits actively litigating questions that courts have not yet fully resolved. The intersection of copyright law, terms of service, and the commercial use of scraped content has created a legal battleground.
The core copyright question is whether scraping and using copyrighted content to train an AI model constitutes copyright infringement. Copyright owners argue it does because the model “ingests” protected expression. AI developers argue it falls under fair use because the training process is transformative, doesn’t reproduce specific expression, and doesn’t substitute for the original market.
Active 2026 litigation shaping this area includes The New York Times v. OpenAI and Microsoft (filed December 2023, ongoing), Getty Images v. Stability AI (ongoing), and multiple class actions by authors against large language model developers. The outcome of these cases will define the legal framework for AI training data scraping for years.
AI training data scraping legal risks:
- Copyright infringement: highest risk; multiple pending cases; potential statutory damages per work
- CFAA: lower risk for publicly accessible data post-hiQ; higher risk if paywalled content scraped
- ToS breach: most AI companies’ ToS prohibit training data scraping; civil breach liability
- Contract claims: some publishers have licensing agreements that preclude scraping for AI
- State law claims: unjust enrichment and conversion theories being tested in litigation
The safest approach for AI training data in 2026 is obtaining explicit licenses from content owners, using public domain or open-license content, or relying on datasets assembled by organizations that have obtained proper permissions.
Key Takeaway: Scraping data for AI training is the most legally contested form of web scraping in 2026, with copyright infringement as the primary risk; pending litigation against major AI companies will determine how courts apply fair use doctrine to large-scale training data collection.
Scraping Social Media Platforms: Legal Risks
Scraping social media platforms creates among the highest legal risks in the web scraping space because these platforms have comprehensive terms of service prohibiting scraping, aggressive technical countermeasures, substantial legal resources to enforce their rights, and in many cases contain personal data covered by privacy laws.
LinkedIn, Facebook, Twitter/X, Instagram, and TikTok all explicitly prohibit scraping in their terms of service. These platforms also employ technical measures (bot detection, rate limiting, CAPTCHAs, IP blocking) that, when circumvented, can convert a ToS breach into a CFAA violation.
Facebook’s parent company Meta has been particularly aggressive in pursuing scrapers legally. In Facebook v. Power Ventures (9th Cir. 2016), the court found that continuing to access Facebook after receiving a cease-and-desist violated the CFAA, even though the access was technically enabled by user credentials. This remains good law.
Social media scraping risk by platform:
| Platform | ToS Prohibition | Technical Barriers | Legal Enforcement History |
|---|---|---|---|
| Yes; explicit | IP blocking; CAPTCHA | hiQ litigation; ongoing enforcement | |
| Facebook/Meta | Yes; explicit | Aggressive bot detection | Power Ventures; multiple suits |
| Twitter/X | Yes; explicit | Rate limits; API restrictions | Ongoing enforcement |
| Yes; explicit | Bot detection | Multiple enforcement actions | |
| TikTok | Yes; explicit | Rate limiting | Emerging enforcement |
The hiQ case is the exception that proves the rule: it was specifically about publicly accessible LinkedIn profiles scraped for employment analytics. Most social media scraping involves far more complex interactions with platform systems, and the hiQ protection doesn’t extend broadly.
State Privacy Laws and Web Scraping Compliance
Beyond California’s CCPA/CPRA, multiple states have enacted comprehensive privacy laws that create compliance obligations for web scrapers who collect personal data about residents of those states. These state laws vary in scope, thresholds, and penalty structures.
Virginia’s Consumer Data Protection Act (CDPA, effective January 2023), Colorado’s Privacy Act (CPA, effective July 2023), and Texas’s Data Privacy and Security Act (TDPSA, effective July 2024) all impose obligations on controllers and processors of personal data, which can include web scrapers who collect, use, or sell personal information about state residents.
These laws generally require a lawful purpose for processing personal data, provide consumer rights to access and delete their data, prohibit selling sensitive personal data without consent, and require data security measures. Web scrapers who operate at scale collecting personal data from multiple states need a multi-state compliance approach.
State privacy law comparison for web scrapers:
| State | Law | Effective Date | Revenue/Volume Threshold | Penalty Per Violation |
|---|---|---|---|---|
| California | CCPA/CPRA | 2018/2023 | $25M revenue or 100K records | Up to $7,500 (intentional) |
| Virginia | CDPA | January 2023 | 100K consumers annually | Up to $7,500 |
| Colorado | CPA | July 2023 | 100K consumers annually | Up to $2,000 |
| Texas | TDPSA | July 2024 | 100K+ consumers; no revenue threshold | Civil penalties vary |
| Connecticut | CTDPA | July 2023 | 100K consumers | Up to $5,000 |
A scraper operating across state lines who collects personal data from residents of all these states faces simultaneous compliance obligations under multiple frameworks with different requirements, making multi-state privacy compliance one of the most practically complex aspects of web scraping in 2026.
When Web Scraping Is Legal: Public Data Exceptions
Web scraping is clearly legal in specific scenarios, and understanding these helps define the safe operating space for legitimate data collection projects. The clearest protected category is scraping genuinely public, non-personal, non-copyrighted factual data from publicly accessible websites.
Government data portals, public court records, regulatory filings, weather data, and similar public information sources are generally safe to scrape. These sources typically contain factual information that lacks copyright protection, are specifically intended for public access, and don’t involve personal data about identifiable individuals.
Academic and research scraping has historically received more favorable legal treatment, particularly when the data is used for non-commercial research, limited amounts of copyrighted content are used under fair use, and no personal data is collected or published.
Scenarios where scraping is generally legal:
- Scraping public government data and regulatory filings (no copyright; intended for public)
- Scraping factual price information from public retail sites (facts not copyrightable; Feist)
- Scraping news headlines (not full articles) for linking and indexing (minimal taking; common practice)
- Scraping your own website to test performance or content integrity
- Scraping with explicit permission from the website operator
- Scraping data that the website explicitly designates as freely available for collection
- Academic research scraping with limited commercial application and strong fair use argument
The safest web scraping in every case is scraping done with the explicit permission of the website owner, ideally through an API or data licensing agreement. If the site offers an API, use it; ignoring an available API in favor of scraping is evidence that the scraper was trying to circumvent access controls.
How to Scrape Data Legally in 2026
Scraping data legally in 2026 requires addressing four distinct legal frameworks simultaneously: CFAA (access authorization), copyright (content protection), privacy law (personal data), and contractual obligations (terms of service). Meeting all four requires intentional design of the scraping operation.
Start by confirming whether the target website offers an API. If it does, using the API is both the safest legal approach and demonstrates respect for the site’s technical infrastructure. API terms are typically more clearly defined than ToS provisions about scraping, and compliance is straightforward.
If no API is available, review the site’s robots.txt, ToS, and any explicit scraping policy before proceeding. Document that review. If the ToS prohibit scraping, you face civil breach of contract liability if you proceed. If robots.txt blocks your scraper path, document your decision about whether to proceed and why. These records help establish good faith if a dispute arises.
Legal scraping compliance checklist for 2026:
- Check for and use the site’s official API if available
- Review robots.txt and honor restrictions to minimize legal exposure
- Review ToS for explicit scraping prohibitions; assess breach risk
- Avoid scraping behind any login or authentication system without explicit permission
- Do not circumvent CAPTCHA, IP blocks, or bot detection
- Collect only the minimum data necessary for your stated purpose
- For personal data: identify a lawful basis under applicable privacy law
- For copyrighted content: assess fair use or obtain a license
- Limit request rate to avoid server strain (aggressive scraping can support CFAA damage claims)
- If cease-and-desist received: stop immediately; continuing after notice is high-risk
- Document your legal analysis and compliance decisions
The practical reality of legal compliance in web scraping is that the safer your operation looks when examined by a court, the less likely anyone is to sue you and the better your defenses are if they do.
Frequently Asked Questions
Is it illegal to scrape data from websites in the United States?
Scraping data from websites is not categorically illegal in the US, but several laws can apply depending on the specifics.
The Computer Fraud and Abuse Act prohibits scraping that involves unauthorized access, such as bypassing logins or technical controls.
Scraping copyrighted content without authorization violates copyright law, and scraping personal data without compliance with privacy laws creates regulatory liability.
Does violating a website’s terms of service make scraping illegal?
Violating a website’s terms of service makes scraping a civil breach of contract but does not automatically make it a federal crime under the CFAA.
The Supreme Court’s Van Buren v. United States decision (2021) significantly limited the use of CFAA to criminalize ToS violations where the scraper otherwise had technical access.
However, civil liability for ToS breach is real, and courts can award injunctions and actual damages against scrapers who violate ToS agreements.
Is scraping personal data from websites illegal?
Scraping personal data is not automatically illegal, but it triggers compliance obligations under GDPR, CCPA, and multiple state privacy laws.
Collecting personal information about California residents without proper disclosures and consumer rights compliance violates the CCPA, with penalties up to $7,500 per intentional violation.
GDPR applies to EU residents’ data regardless of where the scraper is located, with fines reaching 4% of global annual turnover for serious violations.
Can you legally scrape publicly available data?
Scraping genuinely publicly available data with no login, no technical access controls, and no personal data is generally legal under the CFAA after the hiQ Labs v. LinkedIn ruling (9th Circuit 2022).
This protection applies in the 9th Circuit and covers only the CFAA question; copyright and privacy law still apply to what you collect and how you use it.
Scraping public data that is copyrighted (like news articles) or that contains personal information still requires separate legal analysis under copyright and privacy frameworks.
What are the penalties for illegal web scraping under the CFAA?
CFAA criminal penalties range from one year for basic unauthorized access to 20 years for violations involving national security or critical infrastructure.
The most common criminal exposure for web scraping is five years under 18 U.S.C. § 1030(c)(2)(B) when access is unauthorized and causes damage exceeding $5,000 within one year.
Civil CFAA claims allow the affected party to recover actual damages, lost profits, and costs of remediation, plus attorney’s fees in certain circumstances.
Closing
The legal status of web scraping in 2026 is more defined than it was five years ago, with court rulings on CFAA authorization, evolving state privacy laws, and active AI training data litigation drawing clearer lines around what is and isn’t permissible. The legal framework rewards scrapers who plan carefully and penalizes those who ignore obvious warning signs.
Bookmark this article and share it with developers, researchers, and data teams who need to understand their actual legal exposure. The cases and statutes cited here are current for 2026 and will remain the governing framework until Congress or the courts reshape it further.
