Is Web Scraping Legal?

24 min read Updated November 1, 2026

Last reviewed: November 2026

Yes. In most countries it is generally legal to scrape publicly available web data, meaning pages anyone can see without logging in. It stays legal when you do not get around technical barriers, do not overload the site, respect copyright and database rights, and follow privacy law (such as the GDPR) whenever the data is about identifiable people. Scraping becomes risky or illegal when it involves logins or fake accounts, getting around anti-bot measures, breaking terms you agreed to, copying protected content to compete with the source, or collecting personal data without a lawful basis.

Why web scraping matters

Web scraping (also called crawling, data extraction or, in French regulatory language, moissonnage) is the automated collection of information from web pages. Much of the web depends on it. Search engines index pages this way. Price and travel comparison sites, job aggregators, academic researchers, journalists, review-monitoring tools and AI developers all rely on automated collection of public pages.

Because it is so common, the law rarely asks whether scraping as such is allowed. Courts and regulators look at how data is accessed, what data is collected and what you do with it. The rest of this guide follows that structure.

Is web scraping legal? The short answer

Scraping publicly available data is generally lawful in the United States, the European Union, the United Kingdom and most other jurisdictions, provided that:

• the data is visible to anyone without a login, paywall or other access control;
• you do not bypass technical barriers such as CAPTCHAs, IP blocks or anti-bot systems;
• you do not create fake accounts or scrape while bound by terms that forbid it;
• your traffic does not impair the website’s operation;
• you respect copyright and database rights in what you reuse; and
• you comply with privacy law when the data concerns identifiable people.

Is web scraping legal in the United States?

Yes, for public data. The main US risks come from four bodies of law: the federal anti-hacking statute (CFAA), contract law (terms of service), property-based tort claims (trespass to chattels) and copyright (including the DMCA’s anti-circumvention rules). State privacy laws such as the CCPA add obligations when personal information is involved.

The Computer Fraud and Abuse Act after Van Buren

The CFAA makes it a crime, and a civil wrong, to access a computer “without authorization” or to “exceed authorized access.” For years, companies argued that violating a website’s terms of service made access unauthorized.

On June 3, 2021, the US Supreme Court narrowed the statute in Van Buren v. United States (6–3, opinion by Justice Barrett). The Court adopted what it called a “gates-up-or-down inquiry”: a person either can or cannot access certain areas of a computer system. Misusing information you were entitled to access is not a CFAA violation.^[1] The Court expressly left open whether the “gates” must be technical barriers or can also come from contracts or policies.^[1]

Even before Van Buren, a federal court in Washington, D.C. held in March 2020 (Sandvig v. Barr) that violating a consumer website’s terms of service cannot by itself make someone a criminal under the CFAA.^[16]

hiQ Labs v. LinkedIn: public pages have no gates

hiQ, a workforce-analytics start-up, scraped public LinkedIn profiles. LinkedIn sent a cease-and-desist letter and blocked it. hiQ sued and won a preliminary injunction. In September 2019, the Ninth Circuit affirmed that injunction.^[17] After the Supreme Court sent the case back in light of Van Buren, the Ninth Circuit affirmed again on April 18, 2022:

“applying the ‘gates’ analogy to a computer hosting publicly available webpages, that computer has erected no gates to lift or lower in the first place.”^[2]

Two points are often lost. First, the rulings were made at the preliminary-injunction stage: hiQ had raised “serious questions” on the CFAA issue, which is not a final judgment on the merits.^[2] Second, the court stressed that scraping victims still have other options, including trespass to chattels, copyright, misappropriation, unjust enrichment and breach of contract.^[2]

The rest of the story matters just as much. In November 2022, the district court held that LinkedIn’s user agreement provisions prohibiting scraping and fake profiles were enforceable against hiQ. In December 2022, the parties agreed to a consent judgment. hiQ accepted a $500,000 judgment and a permanent injunction, and agreed to destroy the data and code built from scraped profiles. The claims covered included using fake accounts to reach password-protected pages.^[3]

Meta and X v. Bright Data: terms only bind users

On January 23, 2024, Judge Edward Chen of the Northern District of California granted summary judgment to Bright Data on Meta’s breach-of-contract claims. Facebook’s and Instagram’s terms bound “users”, and Bright Data’s logged-off scraping of public data was not use of the services under those terms. The court also refused to read the survival clause as a perpetual promise after Bright Data closed its accounts. By choosing not to put this data behind a login, Meta had in effect left the gate open.^[4] On February 23, 2024, Meta dropped its remaining claim and waived its right to appeal.^[18]

On May 9, 2024, Judge William Alsup dismissed X Corp.’s claims against Bright Data. Because X’s users, not X, own the copyright in their posts, the Copyright Act preempted X’s attempt to use contract and related state-law claims to control copying of public content. The judge noted that state claims protecting users’ privacy would not be preempted, because “privacy protection is not a function of copyright law.”^[19] The dismissal allowed X to amend its complaint, so this was not the end of the case.^[19]

Ryanair v. Booking.com: a CFAA verdict that did not survive

In July 2024, a Delaware jury found Booking.com liable under the CFAA for scraping-related access to Ryanair’s website, setting the loss at exactly the $5,000 statutory minimum. On January 22, 2025, the court granted Booking.com judgment as a matter of law. Ryanair had not proved at least $5,000 of qualifying “loss” attributable to Booking.com. Only about $2,457 of anti-bot costs counted.^[20] The case shows that CFAA claims against scrapers are still being brought, especially where the scraped area sits behind a login or account.

Trespass to chattels: when your bot hurts the server

In May 2000, in eBay v. Bidder’s Edge, a federal court in California granted eBay a preliminary injunction against an auction aggregator’s crawlers on a trespass to chattels theory. The court reasoned that if the crawling continued, other aggregators would follow, which could degrade eBay’s system.^[12] In June 2003, the California Supreme Court narrowed this theory in Intel v. Hamidi (4–3). Electronic contact that neither damages a computer system nor impairs its functioning is not a trespass.^[21] In practice, the more your traffic burdens a site, the stronger a trespass claim becomes.

Anti-bot circumvention and the DMCA

On December 19, 2025, Google sued SerpApi in the Northern District of California. Google claimed that defeating its “SearchGuard” anti-bot system violated the DMCA’s anti-circumvention provisions (17 U.S.C. § 1201). It alleged techniques such as spoofing device and location data and automated CAPTCHA solving.^[13] In July 2026, Judge Yvonne Gonzalez Rogers dismissed the claims. Claims over ordinary search results were dismissed without leave to amend. Claims over third-party content such as knowledge panels were dismissed with leave to amend.^[22] The case is not over, but it shows how platforms are trying new legal theories against scrapers that defeat technical defences.

Is web scraping legal in the EU and UK?

Yes, but Europe regulates what you collect more closely than the US does. There is no general ban on scraping. Instead, three sets of rules apply: data protection law (the GDPR and UK GDPR), database rights, and copyright exceptions for text and data mining.

GDPR: public personal data is still personal data

If scraped data relates to an identifiable person (a reviewer’s name, a profile photo, a username linked to other data), the GDPR applies in full, even if the page is public. The CNIL, France’s data protection authority, put it plainly in its April 30, 2020 guidance on reusing online data for commercial prospecting: this data, “although publicly accessible, is personal data” (our translation). That guidance also says that if a website’s terms prohibit scraping or commercial reuse, the practice is not permitted.^[6]

Scraping personal data requires a lawful basis. For private companies, that is usually legitimate interests under Article 6(1)(f), which applies unless the interests are “overridden by the interests or fundamental rights and freedoms of the data subject.”^[23] Article 14 also requires informing people when data was not collected from them, with an exception where that “proves impossible or would involve a disproportionate effort.”^[24]

What European regulators expect from scrapers

Regulatory guidance has become much more specific since 2024:

• EDPB Opinion 28/2024 (adopted December 17, 2024) on AI models lists scraping-specific safeguards. They include excluding sensitive sources, excluding websites that “clearly object to web scraping” (for example by respecting robots.txt or ai.txt), and offering opt-out lists, including before collection begins.^[15]
• CNIL’s June 19, 2025 guidance on legitimate interest and web scraping for AI recommends defining precise collection criteria in advance and filtering out unnecessary data. It also recommends excluding sites that oppose scraping through robots.txt or CAPTCHAs, collecting only content accessible without an account, and pseudonymising data soon after collection.^[25]
• EDPB Guidelines 03/2026 on web scraping in the context of generative AI (version 1.0, adopted July 7, 2026 for public consultation) say the GDPR applies whenever scraping involves personal data. Controllers must apply purpose limitation, transparency and data minimisation. They should exclude websites that “clearly oppose the scraping”, and legitimate interest requires the three-step test.^[26]

United Kingdom

The UK applies the UK GDPR, which has the same lawful-basis structure. In its generative AI consultation outcomes (December 2024), the Information Commissioner’s Office (ICO) kept legitimate interests as the relevant basis for web scraping. It added that developers must show why alternatives such as licensed data are not suitable, and that transparency must be meaningful.^[27] UK copyright law allows text and data analysis only “for the sole purpose of research for a non-commercial purpose” (CDPA section 29A). Contract terms cannot override that exception.^[28]

What makes web scraping illegal?

Across jurisdictions, the same patterns turn lawful collection into a legal problem:

Practice	Main legal risk	Example
Scraping behind a login, or with fake accounts	Breach of contract; CFAA and similar computer-misuse laws	hiQ’s consent judgment covered fake accounts used to reach password-protected pages[3]
Defeating CAPTCHAs, IP blocks or anti-bot systems	Computer-misuse claims; DMCA anti-circumvention claims (still being tested)	Google v. SerpApi[13]
Traffic that degrades the site	Trespass to chattels; computer-misuse damage	eBay v. Bidder’s Edge[12]
Republishing protected content to compete with the source	Copyright; EU/UK database right	Thomson Reuters v. Ross[29]; CV-Online[10]
Collecting personal data with no lawful basis, or sensitive data	GDPR fines and deletion orders	Clearview AI fines in France, Italy and the Netherlands[30][31][32]
Ignoring terms you actually agreed to (clickwrap)	Breach of contract	LinkedIn v. hiQ (2022 ruling on the user agreement)[3]

Personal data and privacy laws

Privacy law is now the biggest scraping risk in Europe and much of the world. On August 24, 2023, twelve data protection authorities, including those of the UK, Canada and Australia, issued a joint statement on data scraping:

“Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions.”^[5]

The same statement warned that mass scraping of personal information “can constitute a reportable data breach in many jurisdictions.”^[5] A concluding statement, published in October 2024 after engagement with social media companies, added that “contractual terms cannot in and of themselves render data scraping lawful”. It also said organisations using scraped data to train AI must comply with privacy law.^[33]

Enforcement: the Clearview AI fines

Clearview AI built a facial-recognition database from billions of images scraped from public websites. European regulators found no lawful basis for it:

• Italy (March 9, 2022): the Garante imposed a €20 million fine and ordered deletion of data on people in Italy. It found no valid legal basis, inadequate information to individuals and no retention limits.^[31]
• France (decision of October 17, 2022): the CNIL imposed the maximum €20 million fine. It rejected legitimate interest because of the intrusive collection and people’s lack of awareness.^[30]
• Netherlands (September 2024): the Dutch DPA imposed a €30.5 million fine over a database of about 30 billion scraped photos.^[32]
• United Kingdom: the ICO’s 2022 penalty was overturned on jurisdiction grounds in 2023. In October 2025, the Upper Tribunal held that the ICO did have jurisdiction and sent the case back for a decision on the merits.^[34]

Platforms can be liable too. In November 2022, Ireland’s Data Protection Commission fined Meta €265 million under GDPR Article 25 (data protection by design and by default). The case followed the scraping of Facebook user data through search and contact-import features.^[35]

California and US privacy law

The California Consumer Privacy Act gives residents rights to know, delete, correct and opt out of the sale or sharing of personal information. The California Attorney General notes that personal information “does not include publicly available information,” a defined category. Data that falls outside that definition is still covered.^[36] Several other US states have passed comprehensive privacy laws with similar structures, so check the laws where your data subjects live.

Copyright and databases

Facts versus expression

In Feist v. Rural Telephone (March 27, 1991), the US Supreme Court held that “Facts, whether alone or as part of a compilation, are not original and therefore may not be copyrighted.”^[7] A business’s name, address, opening hours, star rating or review count are facts. The text of a review, an article or a photo is original expression, protected “the moment it is created and fixed in a tangible form.”^[8] Under X Corp.’s 2024 ruling, that copyright generally belongs to the user who wrote the content, not the platform hosting it.^[19]

Fair use

Copying protected expression may be fair use, but not when it builds a competing substitute. On February 11, 2025, Judge Stephanos Bibas held in Thomson Reuters v. Ross Intelligence that copying Westlaw headnotes to train a competing legal-research tool was not fair use. Market effect was the decisive factor. The judge stressed that only non-generative AI was at issue.^[29] In September 2026, the Third Circuit affirmed.^[37]

The EU database right

EU law (and UK law, which kept a mirror right) gives the maker of a database a sui generis right where there has been “a substantial investment in either the obtaining, verification or presentation” of its contents. This lets the maker prevent extraction or re-use of all or a substantial part of it.^[9] Two CJEU rulings define its reach for scrapers:

• Ryanair v. PR Aviation (C-30/14, January 15, 2015): if a database is protected by neither copyright nor the sui generis right, the Directive does not stop its owner from restricting use by contract, subject to national law.^[38]
• CV-Online Latvia v. Melons (C-762/19, June 3, 2021): a specialised search engine that copies and indexes a freely accessible database infringes only if it risks depriving the maker of income needed to recover its investment. The Court weighed this against the benefits aggregators bring to competition and access to information.^[10]

Text and data mining exceptions (DSM Directive)

The 2019 Copyright in the Digital Single Market Directive created two exceptions. Article 3 covers research organisations and cultural heritage institutions doing scientific research. Article 4 covers everyone else, including commercial users, for “reproductions and extractions of lawfully accessible works.” Article 4 applies only if rightholders have not reserved their rights “in an appropriate manner, such as machine-readable means in the case of content made publicly available online.”^[11]

In September 2024, the Hamburg Regional Court (Kneschke v. LAION) applied Germany’s scientific-research TDM exception to the creation of an image dataset. In non-binding remarks, it suggested that an opt-out written in natural language in website terms may count as “machine-readable”.^[39]

Terms of service and contracts

Most large platforms prohibit scraping in their terms. LinkedIn’s user agreement forbids using “software, devices, scripts, robots or any other means or processes” “to scrape or copy the Services”.^[40] Google’s terms prohibit “using automated means to access content from any of our services in violation of the machine-readable instructions” on its pages, such as robots.txt.^[41] Whether those terms bind you depends on how you agreed to them:

• Clickwrap (you click “I agree”, for example when creating an account) is generally enforceable. hiQ was bound by LinkedIn’s agreement.^[3]
• Browsewrap (terms only linked somewhere on the page) binds you only if you had actual or constructive notice. In Nguyen v. Barnes & Noble (August 18, 2014), the Ninth Circuit refused to enforce browsewrap terms even though the link was conspicuous.^[42] A cease-and-desist letter quoting the terms can give actual notice.
• Logged-out access may fall outside terms that only bind “users”, as in Meta v. Bright Data.^[4]
• In the EU, contract terms can restrict use of unprotected databases (Ryanair v. PR Aviation),^[38] and the CNIL treats a ban on scraping in the terms as decisive for reusing personal data for prospecting.^[6]

Does robots.txt make scraping illegal?

Not by itself. The Robots Exclusion Protocol, standardised by the IETF as RFC 9309 in September 2022, states: “These rules are not a form of access authorization.”^[14] Still, ignoring robots.txt has consequences. Google’s terms incorporate machine-readable instructions such as robots.txt.^[41] EU regulators list respecting robots.txt as a safeguard when scraping personal data.^[15][25] A robots.txt opt-out can also be a valid TDM rights reservation under the DSM Directive.^[11]

Web scraping laws by jurisdiction

Jurisdiction	Public data scraping	Key laws	Main risks
United States	Generally lawful; public pages have “no gates” under the CFAA[2]	CFAA, contract law, copyright and DMCA, trespass to chattels, state privacy laws (CCPA)	Logged-in scraping, fake accounts, circumvention, server harm, copying expression
European Union	Lawful if GDPR, database and copyright rules are met	GDPR, Database Directive 96/9/EC, DSM Directive 2019/790	Personal data without lawful basis, sensitive data, ignoring opt-outs, substantial extraction harming a database maker
United Kingdom	Similar to EU	UK GDPR, Data Protection Act 2018, CDPA 1988 (s. 29A TDM for non-commercial research), database right	Personal data processing, commercial TDM without permission
Canada and Australia	Public personal information still regulated	National privacy laws; both regulators signed the 2023 joint statement[5]	Mass scraping of personal information; possible data-breach notification duties for platforms

Landmark web scraping court cases

Case	Court	Year	Holding	Why it matters
eBay v. Bidder’s Edge	N.D. Cal.	2000	Preliminary injunction against crawler on trespass to chattels[12]	Heavy bot traffic can be a tort
Intel v. Hamidi	California Supreme Court	2003	Trespass requires damage or impairment of the system[21]	Limits trespass claims against low-impact access
Feist v. Rural Telephone	US Supreme Court	1991	Facts are not copyrightable[7]	Factual data points are free to extract under US copyright law
Ryanair v. PR Aviation (C-30/14)	CJEU	2015	Unprotected databases can be restricted by contract[38]	EU terms of use can matter even without IP rights
Sandvig v. Barr	D.D.C.	2020	ToS violations are not CFAA crimes[16]	Protects researchers and journalists
Van Buren v. United States	US Supreme Court	2021	“Gates-up-or-down” reading of the CFAA[1]	Narrowed the US anti-hacking statute
CV-Online Latvia v. Melons (C-762/19)	CJEU	2021	Aggregator infringes only if it harms the maker’s investment[10]	Narrowed the EU database right for aggregators
hiQ Labs v. LinkedIn	9th Cir.; N.D. Cal.	2019, 2022	Public pages likely not “without authorization”; hiQ later liable on contract[2][3]	The leading US scraping case, with a nuanced ending
Meta v. Bright Data	N.D. Cal.	2024	Logged-off scraping not barred by Meta’s terms[4]	Terms that bind “users” do not reach logged-off scrapers
X Corp. v. Bright Data	N.D. Cal.	2024	Copyright Act preempts contract claims over public user content[19]	Platforms cannot use terms of service as their own copyright law
Kneschke v. LAION	Hamburg Regional Court	2024	Dataset creation covered by research TDM exception[39]	First major EU ruling on TDM and AI datasets
Ryanair v. Booking.com	D. Del.	2024–2025	Jury CFAA verdict overturned for lack of $5,000 loss[20]	CFAA claims against scrapers face strict loss requirements
Thomson Reuters v. Ross	D. Del.; 3d Cir.	2025, 2026	Copying headnotes to build a competitor is not fair use[29][37]	Limits on reusing scraped expression
Google v. SerpApi	N.D. Cal.	2025–2026	DMCA claims over plain search results dismissed[22]	Tests whether anti-bot systems are DMCA “technological measures”

Checklist for compliant web scraping

1. Collect only public pages. No logins, paywalls or fake accounts.
2. Do not circumvent technical barriers. Treat CAPTCHAs, IP blocks and anti-bot challenges as a “no”.
3. Know which terms you have accepted. If you hold an account on the target site, assume its terms bind you.
4. Respect robots.txt and other machine-readable opt-outs, especially in the EU and for AI or TDM uses.
5. Limit your load. Rate-limit, cache, back off on errors and scrape off-peak.
6. Minimise personal data. Define fields in advance, drop what you do not need, and avoid sensitive categories and minors.
7. Document your lawful basis. In the EU and UK, record a legitimate interests assessment and how people are informed.
8. Honour objections and deletion requests, and keep data accurate and up to date.
9. Separate facts from expression. Analyse freely, but do not republish protected text or images as a substitute for the source.
10. Attribute and link back when you display third-party content, and do not alter its meaning.
11. Respond to cease-and-desist letters with legal advice rather than ignoring them.

What a legitimate interests assessment for scraping usually covers

Regulators describe a three-step test.^[23][26] (1) Purpose: a specific, lawful interest, such as monitoring public feedback about a business. (2) Necessity: scraping personal data is actually needed, and less intrusive options (aggregated data, licensed data, no names) would not work.^[27] (3) Balancing: people’s reasonable expectations, the sensitivity of the data, the scale of collection and the safeguards in place, such as minimisation, pseudonymisation, source exclusion lists and opt-out mechanisms.^[25][15]

How Zembra approaches compliance

Zembra is a reviews and business-data API that collects publicly available data, such as reviews and business listings, from 137 platforms. Our approach follows the principles above:

• Public data only. We collect information that anyone can see on the open web. We do not use logins, credentials or fake accounts, and we do not bypass paywalls or access controls.
• Respect for platforms. Collection rates are kept within reasonable limits, and caching reduces repeated requests, so that collection does not affect website performance.
• Faithful content. Review text is kept as published, with a link to the source platform, and is not rewritten in a way that changes its meaning.
• Data minimisation. We process only what is needed and, on request, can limit or remove personal data such as reviewer names. We honour valid removal requests.
• Shared responsibility. Customers remain responsible for how they use the data, including having a lawful basis under privacy laws and respecting copyright when displaying review content.

Frequently asked questions

Is web scraping legal?

Generally yes, for publicly available data collected without logging in, without bypassing technical barriers and without overloading the site. It becomes illegal when it breaks contracts you agreed to, circumvents access controls, infringes copyright or database rights, or processes personal data without a lawful basis.

Is it legal to scrape Google reviews?

Collecting public Google reviews for analysis is generally lawful, but three points apply. Google’s terms prohibit automated access that violates its machine-readable instructions such as robots.txt. Review text is copyrighted by its authors, so republishing it in full needs care. Reviewer names are personal data under the GDPR. In July 2026, a court dismissed Google’s DMCA claims against SerpApi over ordinary search results, but the case continues on other content.

Is scraping LinkedIn legal?

Scraping public LinkedIn profiles without logging in is unlikely to violate the US CFAA after hiQ v. LinkedIn (2022). However, LinkedIn’s user agreement bans scraping, and hiQ ultimately accepted a $500,000 judgment and a permanent injunction because it had accepted those terms and used fake accounts. LinkedIn profiles are also personal data, so the GDPR applies to EU and UK residents.

Does robots.txt make scraping illegal?

No, not by itself. The official standard (RFC 9309) says robots.txt rules are not a form of access authorization. Ignoring robots.txt can still matter: some terms of service incorporate it, EU regulators expect scrapers of personal data to respect it, and it can serve as a machine-readable text-and-data-mining opt-out under EU copyright law.

Is web scraping legal in the EU?

Yes, with conditions. The GDPR applies whenever the data relates to identifiable people, usually requiring a legitimate interests assessment, minimisation and transparency. The EU database right protects substantial investments in databases, and the DSM Directive lets rightholders opt out of commercial text and data mining with machine-readable signals.

Is web scraping legal in the UK?

Yes, with conditions similar to the EU. The UK GDPR governs personal data, and the ICO expects scrapers relying on legitimate interests to show necessity and meaningful transparency. UK copyright law allows text and data analysis only for non-commercial research, and the UK keeps a database right.

Can I scrape personal data?

Only with a lawful basis and appropriate safeguards. Data protection authorities agree that publicly accessible personal information is still protected by privacy law. Clearview AI was fined €20 million in Italy, €20 million in France and €30.5 million in the Netherlands for scraping public photos without a lawful basis.

Is it legal to scrape a website that prohibits scraping in its terms of service?

It depends on whether you agreed to the terms. Clickwrap terms accepted when creating an account are usually enforceable. Terms that merely sit on a page (browsewrap) bind you only with notice. In Meta v. Bright Data, logged-off scraping was not covered by Meta’s terms. In the EU, terms can restrict use of unprotected databases, and the CNIL treats an anti-scraping clause as decisive for reusing personal data for commercial prospecting.

Is scraping data for AI training legal?

It is unsettled and depends on the jurisdiction. In the EU, commercial text and data mining is allowed unless rightholders opt out in a machine-readable way, and the GDPR applies to personal data, with detailed EDPB and CNIL guidance on scraping. In the US, fair use is decided case by case. In 2025 and 2026, courts rejected fair use for copying Westlaw headnotes to build a competing (non-generative) AI tool.

Can a website sue me for scraping even if it is legal?

Yes. Companies sue scrapers under contract, trespass, copyright, DMCA and computer-misuse theories, even when they lose. Keeping to public data, avoiding circumvention, limiting load and minimising personal data greatly reduces both the risk of being sued and the chance of losing.

References

1. Van Buren v. United States, No. 19-783 (slip opinion), Supreme Court of the United States, June 3, 2021.
2. hiQ Labs, Inc. v. LinkedIn Corporation, No. 17-16783 (opinion on remand from the Supreme Court), U.S. Court of Appeals for the Ninth Circuit, April 18, 2022.
3. LinkedIn’s Data Scraping Battle with hiQ Labs Ends with Proposed Judgment, Kyle R. Dull and Julia B. Jacobson (Squire Patton Boggs), The National Law Review, December 19, 2022.
4. Game On! Bright Data Scores Major Victory in Web-Scraping Dispute with Meta (Guest Blog Post), Kieran McCarthy, Technology & Marketing Law Blog (on Meta Platforms, Inc. v. Bright Data Ltd., N.D. Cal., January 23, 2024), January 25, 2024.
5. Joint statement on data scraping and the protection of privacy, Office of the Privacy Commissioner of Canada and 11 other data protection authorities, August 24, 2023.
6. La réutilisation des données publiquement accessibles en ligne à des fins de démarchage commercial, CNIL (French data protection authority), April 30, 2020.
7. Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340, Supreme Court of the United States (via Cornell Legal Information Institute), March 27, 1991.
8. Copyright in General (FAQ), U.S. Copyright Office, accessed November 2026.
9. Directive 96/9/EC of the European Parliament and of the Council on the legal protection of databases, Article 7, Official Journal of the EU (text as adopted, via legislation.gov.uk), March 11, 1996.
10. CJEU ruling narrows the scope of EU database rights, Mishcon de Reya (on CJEU Case C-762/19, CV-Online Latvia v Melons, June 3, 2021), July 5, 2021.
11. Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market, Article 4, Official Journal of the EU (text as adopted, via legislation.gov.uk), April 17, 2019.
12. eBay, Inc. v. Bidder’s Edge, Inc., No. C-99-21200 RMW (order granting preliminary injunction), U.S. District Court for the Northern District of California (via Berkman Klein Center, Harvard), May 24, 2000.
13. Google Sues SerpApi for ‘Parasitic’ Scraping and Circumvention of Protection Measures, Rose Esfandiari, IPWatchdog, December 26, 2025.
14. RFC 9309: Robots Exclusion Protocol, M. Koster, G. Illyes, H. Zeller, L. Sassman, Internet Engineering Task Force (IETF), September 2022.
15. Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, European Data Protection Board, adopted December 17, 2024.
16. Federal Judge Rules It Is Not a Crime to Violate a Website’s Terms of Service, Naomi Gilens and Jamie Williams, Electronic Frontier Foundation (on Sandvig v. Barr, D.D.C., March 27, 2020), April 6, 2020.
17. hiQ Labs, Inc. v. LinkedIn Corporation, No. 17-16783 (opinion), U.S. Court of Appeals for the Ninth Circuit, September 9, 2019.
18. Meta drops lawsuit against web-scraping firm Bright Data that sold millions of Instagram records, Sarah Perez, TechCrunch, February 26, 2024.
19. Can You Prevent AI From Scraping Your Website Data? District Court Says Answer Lies in Copyright Law, Danielle W. Bulger and Elizabeth H. Denning, ArentFox Schiff AI Law Blog (on X Corp. v. Bright Data Ltd., N.D. Cal., May 9, 2024), July 31, 2024.
20. Court Overturns a Bad Jury Verdict Against Scraping–Ryanair v Booking (Guest Blog Post), Kieran McCarthy, Technology & Marketing Law Blog, March 2, 2025.
21. Intel Corporation v. Hamidi: Spamming Is Not a Trespass in California, Holland & Knight (on the California Supreme Court’s decision of June 30, 2003, 30 Cal. 4th 1342), October 13, 2003.
22. Google Lawsuit Against SerpApi Over Scraping Search Results Dismissed, Barry Schwartz, Search Engine Roundtable, July 22, 2026.
23. Art. 6 GDPR: Lawfulness of processing, Regulation (EU) 2016/679, text via gdpr-info.eu, April 27, 2016.
24. Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject, Regulation (EU) 2016/679, text via gdpr-info.eu, April 27, 2016.
25. La base légale de l’intérêt légitime : fiche focus sur les mesures à prendre en cas de collecte des données par moissonnage (web scraping), CNIL (French data protection authority), June 19, 2025.
26. Guidelines 03/2026 on web scraping in the context of generative AI, version 1.0 (for public consultation), European Data Protection Board, adopted July 7, 2026.
27. ICO Publishes Outcomes of GenAI Consultation, Skadden, Arps, Slate, Meagher & Flom (on the ICO outcomes report of December 13, 2024), January 7, 2025.
28. Copyright, Designs and Patents Act 1988, section 29A: Copies for text and data analysis for non-commercial research, legislation.gov.uk (UK National Archives), in force since June 1, 2014.
29. Thomson Reuters v. Ross Intelligence: Copyright, Fair Use, and AI (Round One), Davis Wright Tremaine (on the D. Del. ruling of February 11, 2025), February 14, 2025.
30. CNIL Fines Clearview AI 20 Million Euros for Unlawful Use of Facial Recognition Technology, Hunton Andrews Kurth, Privacy & Cybersecurity Law Blog, October 24, 2022.
31. Riconoscimento facciale: il Garante privacy sanziona Clearview per 20 milioni di euro, Garante per la protezione dei dati personali (Italian data protection authority), March 9, 2022.
32. Dutch privacy watchdog fines Clearview €30.5m for database, DutchNews.nl, September 3, 2024.
33. Concluding joint statement on data scraping and the protection of privacy, Office of the Privacy Commissioner of Canada and co-signatory data protection authorities, October 28, 2024.
34. Upper Tribunal hands down Clearview v ICO judgment on territorial and material scope of GDPR ([2025] UKUT 319 (AAC)), 11KBW, October 14, 2025.
35. Data Protection Commission fines Meta €265m in Facebook ‘data scraping’ inquiry, Irish Legal News, November 28, 2022.
36. California Consumer Privacy Act (CCPA), State of California Department of Justice, Office of the Attorney General, page updated August 28, 2026.
37. 3rd Circuit Rules For Thomson Reuters In Its Copyright Fight Against Legal Research Startup ROSS, Bob Ambrogi, LawSites (LawNext), September 30, 2026.
38. BREAKING: CJEU says that owner of an online database not protected by copyright or sui generis right may restrict its use by contract, Eleonora Rosati, The IPKat (on CJEU Case C-30/14, Ryanair v PR Aviation), January 15, 2015.
39. Robert Kneschke v. LAION e.V., Case No. 310 O 227/23, Hamburg Regional Court (Landgericht Hamburg), case summary via WIPO Lex, September 27, 2024.
40. User Agreement (section 8.2, Don’ts), LinkedIn Corporation, effective November 3, 2025.
41. Google Terms of Service, Google LLC, effective July 30, 2026.
42. Nguyen v. Barnes & Noble Inc., No. 12-56628 (opinion), U.S. Court of Appeals for the Ninth Circuit, August 18, 2014.