The legal landscape for web scraping in 2026
Where the law has actually settled, where it has not, and the practical rules that keep you on the right side of it.
Tomas Halvorsen
Head of trust & safety
07 Jul 2026 · 10 min read
Not legal advice
This is a practitioner's summary written by a trust and safety team, not by lawyers. Jurisdictions differ, facts matter enormously, and if the stakes are real you need counsel.
The question people want answered is whether scraping is legal. The honest answer is that scraping is a technique, not an act, and the legality depends almost entirely on what you collect, from where, and what you do with it afterwards.
Public data, roughly settled
In the United States, the hiQ v. LinkedIn line of cases established that scraping publicly accessible data does not by itself violate the Computer Fraud and Abuse Act, because there is no access to circumvent. That is a meaningful protection and a narrow one: it concerns one statute, and it evaporates the moment authentication is involved.
Where it stops being settled
- Behind a login: you accepted terms of service, and breaching them is a contract question regardless of what the CFAA says.
- Personal data: GDPR applies to scraped personal data exactly as it applies to any other. Collecting it without a lawful basis is unlawful even where the collection method is fine.
- Copyrighted content: facts are not copyrightable; expression is. Republishing scraped articles is a copyright problem no proxy solves.
- Database rights: the EU sui generis right protects substantial investment in compiling a database, independently of copyright.
- Volume: a crawl that degrades a target's service can constitute an attack in several jurisdictions, whatever your intent.
Practical rules
- 1Prefer public data. If you need to log in, read the terms you accepted and take them seriously.
- 2Do not collect personal data unless you have a lawful basis and can honour deletion requests.
- 3Rate-limit yourself to something the target would not notice. This is both polite and legally protective.
- 4Respect robots.txt where you reasonably can, and document your reasoning where you cannot.
- 5Keep records of what you collected and why. Being able to demonstrate a defensible process matters if you are ever asked.
What we do about it
Our acceptable use policy prohibits credential stuffing, fraud, CSAM, traffic aimed at critical infrastructure, and circumvention of authentication you do not own. We enforce it by suspending accounts, and we do so without a great deal of ceremony. That is not a moral posture — a network with a reputation for hosting abuse gets its address ranges blocked wholesale, which degrades the product for everyone using it legitimately.