Introduction
Is web scraping legal? Generally speaking, yes but it depends on where you are, what you're scraping, and how you do it. There is no universal "web scraping law", instead, legality is different from country to country. It's shaped by privacy regulations, copyright rules, computer fraud statutes, and contract law.
As of 2026, most countries in the world have a data privacy law, and the rise of AI has accelerated enforcement more than before. Regulators handed Clearview AI over €100 million in fines for scraping facial images. Under the EU AI Act, providers of general-purpose AI models must publish summaries of their training data and respect copyright opt-outs. Those rules have applied since August 2025 and have been enforced since August 2026. Meanwhile, in the US, the courts have largely ruled that scraping public (public is the important keyword here) data doesn't break anti-hacking law. The fight there has shifted to Terms of Service and to whether getting past anti-bot systems is illegal, which is what the 2026 rulings against Anthropic and SerpApi are about.
The result is a global legal landscape that ranges from broadly permissive to effectively prohibited. You can hover on any country to see exactly where it stands on the interactive map above, so you can conduct ethical and legal web scraping.
Interactive Map Guide
Every country on the map falls into one of four categories based on how its legal framework treats web scraping.
Legal with Restrictions (Green)
Countries like the US, Canada, Japan, South Korea, and Taiwan. Scraping publicly available, non-personal data is broadly permitted. In the US, the famous hiQ v. LinkedIn (2022) case established that scraping public profiles doesn't violate the Computer Fraud and Abuse Act, and in Meta v. Bright Data (2024) a court held that Meta's terms didn't cover scraping done while logged out. Japan goes even further, its Copyright Act includes one of the world's most permissive text-and-data-mining exceptions, allowing scraping for AI training even commercially. That said, "legal with restrictions" still means restrictions: copyright, personal data, and terms of service limits apply everywhere. Contract claims are the main risk in the US: in 2026 a court let Reddit's breach-of-contract claims against Anthropic proceed. Circumventing anti-bot systems is being tested under the DMCA in Reddit v. SerpApi.
Gray Area (Yellow)
India, Pakistan, Bangladesh, and much of Africa and Central Asia. These countries have no specific scraping law and often lack comprehensive data protection legislation. Legality depends entirely on how general privacy, copyright, and computer crime laws are interpreted, which means outcomes are unpredictable. India is the one to watch. The rules implementing its Digital Personal Data Protection Act (2023) were published in November 2025, and most obligations phase in over 18 months, through mid-2027. Notably, the Act doesn't apply to personal data that people have made public themselves, which gives scrapers of public profiles more room than GDPR does.
Restrictive (Orange)
The entire EU/EEA (all 30 countries under GDPR), the UK, Brazil, Australia, Singapore, UAE, and Saudi Arabia. These countries have strong data protection laws that tightly regulate any collection of personal data even if it's publicly visible. Scraping non-personal, public data may be permissible with caution, but the legal burden is on you to prove compliance. Europe is a clear example, the EU layers GDPR on top of the Database Directive and Copyright Directive, meaning even public non-personal data in a database may be protected. Although the Database Directive is harder to enforce, you still need to exercise caution. Fines reach €20 million or 4% of global revenue. The EU's proposed "Digital Omnibus" amendments to GDPR could ease some rules for AI training, but they're still being negotiated and aren't law yet. The UK is also following with almost the same rules, In March 2026 the government dropped its plan for a commercial text-and-data-mining exception, so mining copyrighted content there is still only allowed for non-commercial research. In 2025 a UK tribunal also confirmed that UK data protection law reaches foreign companies that scrape data on UK residents, reopening the regulator's case against Clearview AI. Brazil's LGPD mirrors GDPR closely, and Australia's Privacy Commissioner has explicitly stated in regard to publicly available personal info that public availability does not exempt data from privacy obligations.
Highly Restrictive (Red)
China, and Russia. Nearly all scraping carries significant legal risk here. China's PIPL imposes similar penalties with personal executive liability, and since October 2025 its revised Anti-Unfair Competition Law explicitly bans obtaining another company's data by improper means, such as bypassing technical protections. Russia aggressively blocks bots and requires data localization. If you're scraping in these jurisdictions, assume you need explicit legal clearance or evaluation on a per-site basis.
Best Practices for Ethical Web Scraping
Regardless of which color your target country sits in, having these web scraping legal considerations into mind helps you to follow the law more closely.
-
Respect robots.txt. It's not legally binding everywhere, but it's getting closer. In the EU, robots.txt is the kind of machine-readable opt-out that counts under copyright law: a German appeals court ruled in Kneschke v. LAION (2025) that an opt-out written in plain language doesn't count. AI providers that signed the EU's code of practice for AI models must use crawlers that obey it, and since July 2026 Google's own Terms of Service forbid scraping its services in violation of robots.txt, turning a robots.txt rule into a contract term (though whether that binds logged-out scrapers is untested). Ignoring it has also been used as evidence of bad faith in court. It takes seconds to check and signals good intent.
-
Never bypass access controls. CAPTCHAs, login walls, rate limits, and IP blocks exist for a reason. Circumventing them crosses the line from scraping to unauthorized access in most jurisdictions. It's exactly what the Reddit v. Perplexity AI lawsuit (2025) is testing under the DMCA.
-
Minimize personal data collection. If you don't need names, emails, or anything that identifies a person, don't collect it. If you must, make sure you have a lawful basis under whatever privacy law applies. This single rule eliminates the majority of legal risk.
-
Use APIs when they exist. If a site offers a public API, use it. It's the operator's intended access method, and scraping around it when one is available weakens any "good faith" argument.
-
Check the Terms of Service. Especially in Europe, where the Ryanair v. PR Aviation ruling gave ToS real legal force even when no copyright or database right applies. A ToS violation may not be criminal, but it can still get you sued.
-
Rate-limit your requests. Don't hammer servers. Space out requests, back off on 429/503 responses, and use a descriptive User-Agent string with contact info. Aggressive scraping that degrades service for real users is how cases usually start.
-
Think about jurisdiction. Three locations matter: where you are, where the server is, and where the data subjects are. GDPR applies based on the data subject's location, not yours — so scraping a French user's data from a US server still triggers EU law.
keeping track of all this, It sounds a lot. Datarama can take care of these for you and be configured to scrape with these considerations in mind: built-in rate limiting, robots.txt awareness, and clean data extraction that helps you focus on the data you actually need without the compliance headaches.
Web Scraping and AI Training: The 2026 Frontier
The hottest topic of web scraping law is AI training data. Every major LLM is built on scraped web content, and regulators are catching up.
The EU AI Act requires providers of general-purpose AI models to publish summaries of their training data and respect copyright opt-outs. Those rules have applied since August 2025 and have been enforced since August 2026; the July 2026 "Digital Omnibus" delayed other parts of the Act, not these. Combined with the Copyright Directive's text-and-data-mining (TDM) rules, which let rights holders opt out of commercial mining under Article 4, this means scraping for AI training in Europe requires checking every source for opt-out signals. Those signals must be machine-readable: in Kneschke v. LAION (December 2025), a German appeals court held that building an AI training dataset fell under the TDM exception, and that a plain-language opt-out in a website's terms didn't count.
Courts disagree on what happens once the model is trained. In GEMA v. OpenAI (November 2025), a Munich court found that a model memorizing song lyrics is a copy the TDM exception doesn't cover (appeal pending). In the UK, the High Court in Getty Images v. Stability AI (November 2025) found that the model itself is not an infringing copy (on appeal). The EU's top court is set to give the first Europe-wide answer in Like Company v. Google.
Japan stands at the other end. Its Article 30-4 is the most permissive text-and-data-mining exception in the world. It allows scraping for computational analysis, including commercial AI training, without the rights holder's consent. This has made Japan a strategically attractive jurisdiction for AI companies building training datasets.
In between, the US is still working it out, but late 2026 brought the first answers. In Thomson Reuters v. Ross (September 2026), the Third Circuit became the first US appeals court to rule on AI training. It found that training a competing legal-research tool on Westlaw's content was not fair use, though it limited the ruling to non-generative AI. On the scraping side, Reddit's anti-circumvention claims against Perplexity and SerpApi survived dismissal in July 2026, and its contract claims against Anthropic survived in September 2026.
The trend is to expect more restrictions on scraping for AI in the coming years. If your scraping feeds a model, the legal bar is rising fast.
Landmark Court Cases That Shaped Web Scraping Law
These are the rulings that define where the legal lines are drawn today.
hiQ v. LinkedIn (US, 2022)
The Ninth Circuit ruled that scraping publicly accessible LinkedIn profiles does not violate the Computer Fraud and Abuse Act. The Supreme Court sent it back after Van Buren, and the Ninth Circuit reaffirmed. But the catch was that in late 2022 the district court found hiQ had breached LinkedIn's User Agreement, including by using fake accounts, and the case ended in a court-entered judgment with hiQ paying $500,000 and agreeing to stop scraping. Scraping was not the crime, but the contract claims stuck.
Van Buren v. United States (US Supreme Court, 2021)
The Supreme Court narrowed the CFAA's "exceeds authorized access" to a simple gates-up-or-down test: can you access that part of the system or not? Violating a policy or ToS alone doesn't count. This ruling effectively removed the threat of criminal prosecution for scraping publicly accessible websites in the US.
Meta v. Bright Data (US, 2024)
Meta sued Bright Data for scraping and reselling public Facebook and Instagram data, arguing it breached Meta's terms. In January 2024 Judge Edward Chen ruled for Bright Data. Meta's terms covered users while they were logged in, and there was no evidence Bright Data scraped anything that wasn't publicly visible while logged out. Meta dropped the case soon after. It's the leading ruling on logged-out scraping: public pages you can see without an account are far safer to scrape than anything behind a login you've agreed to.
Thomson Reuters v. Ross Intelligence (US, Third Circuit, 2026)
The first US appeals court ruling on whether training AI on copyrighted content is fair use. ROSS built an AI legal research tool trained on material derived from Westlaw's headnotes after Thomson Reuters refused to license them. The trial court ruled against ROSS in February 2025, and in September 2026 the Third Circuit affirmed. It found the use wasn't transformative and harmed Westlaw's market, including the growing market for licensing AI training data. When your training data comes from a competitor and your product competes with it, fair use is a hard argument.
Clearview AI (EU-wide, 2022–2025)
Clearview scraped billions of facial images from social media to build a recognition database. Every European regulator that looked at it found GDPR violations. France: €20M. Italy: €20M. Greece: €20M. The Netherlands: €30.5M. This is the largest single fine on this topic. The UK added £7.5M+. Total: over €100 million, counting the UK fine and a €5.2M French penalty for non-payment. Clearview hasn't paid most of it, but the precedent is set that mass scraping of personal biometric data is illegal across Europe, full stop.
Ryanair v. PR Aviation (CJEU, 2015)
The case that gave Terms of Service teeth in Europe. Ryanair's flight data didn't qualify for copyright or database rights but the CJEU ruled that didn't matter. Website operators can contractually prohibit scraping through their ToS, even without IP protection. If you click "I agree" and then scrape, you're liable.
Reddit v. Perplexity AI (US, 2025 — Pending)
The one to watch. Reddit alleges Perplexity and its scraping partners masked identities, rotated IPs, and bypassed rate limits to harvest billions of search results containing Reddit content. The case is framed as DMCA Section 1201 anti-circumvention and not copyright infringement. In July 2026 the court largely denied the motions to dismiss. Most of the DMCA claims and a civil conspiracy claim go forward, while one DMCA claim and the unjust enrichment and unfair competition claims were dropped. If Reddit wins, it could establish that bypassing technical access controls at industrial scale is illegal even when the underlying data is public.
Kneschke v. LAION (Germany, 2024)
The first court ruling on the EU Copyright Directive's text-and-data-mining exception. Photographer Robert Kneschke sued LAION for scraping his images into an AI training dataset. The Hamburg court ruled LAION could rely on the TDM research exception for non-commercial scientific purposes as no consent needed. A win for open AI research, but the ruling is narrow: it only covers non-commercial use.
Korean Supreme Court, Case 2021Do1533 (South Korea, 2022)
Asia's answer to hiQ. A travel agency scraped a competitor's publicly available pricing data. The Supreme Court ruled this violated neither the Copyright Act nor the Information Protection Act. The competitor's API had no technical access restrictions, and the scraper copied individual data points rather than a substantial part of the database. The court confirmed that data scraping is merely a technology and is not illegal per se, establishing an important precedent for the Asia-Pacific region. But like hiQ, there was a catch: in a separate civil case, the scraper was ordered to pay roughly KRW 1 billion in damages under Korea's Unfair Competition Prevention Act for free-riding on its competitor's database. Not a crime, but still expensive.
Conclusion
Web scraping isn't inherently legal or illegal but rather a tool, and the law cares about how you use it. The global trend is that more countries are regulating, fines are growing, and the "it was publicly available" defense is losing its power everywhere except a handful of jurisdictions.
2026 made one thing clearer: the question is shifting from what you scrape to how you scrape it. Courts are increasingly focused on whether you agreed to a site's terms, whether you got around its anti-bot measures, and whether you respected machine-readable opt-outs like robots.txt. Logged-out scraping of public, non-personal data that respects robots.txt is still the safest place to be.
Use the interactive map above as your starting point. Know what color your target country is before you write a single line of scraping code. Follow the best practices. And when in doubt, consult legal counsel in the relevant jurisdiction.