Is Web Scraping Legal In 2026? What The Courts Have Actually Said

Is web scraping legal? It is the first question legal teams ask when a business wants to collect prices, reviews, listings or search results at scale, and the answer has shifted more in the last five years than in the twenty before. Courts in the United States have narrowed the main anti-hacking statute, rejected some of the contract theories platforms relied on, and opened a new front around copyright and anti-circumvention rules. In Europe, regulators have focused on personal data rather than on scraping as a technique.

The quick answer: scraping publicly available data is not illegal in itself in the US, the EU or the UK. Legal risk comes from how and what you collect: getting around logins or technical barriers, breaching terms you agreed to, collecting personal data without a lawful basis, copying copyrighted content, or putting a damaging load on someone else’s servers. Each ruling below is narrow and tied to its facts, so none of them is a blanket permission.

This guide, Is Web Scraping Legal In 2026? What The Courts Have Actually Said, walks through the US case law, the cases still being fought this year, the European and UK rules, and a practical checklist for ethical web scraping. If you are new to the technique itself, start with our beginner’s guide to web scraping.

This article is general information, not legal advice. Web scraping laws vary by country and change quickly, and the outcome of any dispute depends on its specific facts. Speak to a qualified lawyer before you start a scraping project that touches personal data, logged-in areas or copyrighted material.

Web Scraping Legality At A Glance

Most disputes turn on the same five questions. The table summarizes where courts and regulators have tended to draw the lines.

Web Scraping Laws In The United States

There is no single US statute about scraping. Instead, plaintiffs combine several theories: the federal Computer Fraud and Abuse Act (CFAA), breach of contract, trespass to chattels, copyright, and the anti-circumvention rules in the Digital Millennium Copyright Act (DMCA). Each has moved in a different direction.

The Computer Fraud And Abuse Act After Van Buren

For years, the CFAA was the heaviest weapon against scrapers because it carries both criminal and civil liability for accessing a computer “without authorization” or in a way that “exceeds authorized access.” In Van Buren v. United States (June 2021), the Supreme Court read the second phrase narrowly. It asked whether a person enters parts of a system that are off limits to them, a “gates-up-or-down” test, rather than whether they use information they were allowed to see for a purpose the owner dislikes.

Van Buren was not a scraping case, and the Court left open whether the gates must be technical barriers or can be set by contract or policy. But it removed the argument that violating a website’s purpose restrictions alone turns a visitor into a computer criminal.

hiQ v. LinkedIn: Public Data And The Limits Of A Win

The best-known scraping case applied that reasoning to public web pages. In April 2022, the Ninth Circuit held in hiQ Labs v. LinkedIn that scraping profiles anyone could view without logging in was likely not access “without authorization” under the CFAA, because there was no gate to lift on a public page.

The story did not end there. Later in 2022 the district court found that hiQ had breached LinkedIn’s User Agreement, including through the use of fake accounts, and the case closed with a settlement and a consent judgment that barred hiQ from scraping LinkedIn. The lesson most lawyers draw is that the CFAA risk on public pages is now low in the Ninth Circuit, while contract risk remains very real once you have agreed to terms.

Contract Claims: Meta v. Bright Data And X Corp v. Bright Data

With the CFAA weakened, platforms leaned on their terms of service. Two 2024 rulings in the Northern District of California, both against the data provider Bright Data, showed the limits of that approach.

In Meta v. Bright Data, Judge Edward Chen granted summary judgment to Bright Data on Meta’s breach of contract claim in January 2024. As Quinn Emanuel’s analysis explains, the court read Meta’s terms as governing users while they are logged in, not logged-off collection of data visible to anyone. Meta later dropped its remaining claims rather than take the case further.

In X Corp v. Bright Data, Judge William Alsup dismissed X’s scraping claims in May 2024, holding that X could not use state contract law to create what amounted to a private copyright system over posts it does not own and only licenses from users. Skadden’s summary notes the court also found that selling proxy access is not inherently deceptive, and that X had not shown real harm to its servers. A later order let X try again with a narrower trespass theory focused on server burden, so the dispute was not a clean sweep.

Neither ruling says terms of service are unenforceable. Both turned on how specific terms were drafted and whether the scraper was bound by them. If you hold an account and accepted terms that prohibit automated collection, a contract claim is still the most likely way a dispute reaches court.

Trespass, Anti-Circumvention And Damage Claims

Older cases such as eBay v. Bidder’s Edge (2000) established that heavy automated traffic can support a trespass to chattels claim when it burdens a server. Modern courts usually require evidence of actual harm, and that bar is not trivial. In Ryanair v. Booking.com, a Delaware jury found Booking liable under the CFAA in 2024 over scraping of Ryanair’s site, but in January 2025 the judge set the verdict aside because Ryanair had not proven the $5,000 minimum loss the statute requires, as this case analysis sets out.

The newest theory is the DMCA’s anti-circumvention rule, 17 U.S.C. § 1201, which bans getting around a technological measure that controls access to a copyrighted work. Both of the pending cases below rely on it, which is why the way a scraper deals with bot detection now matters legally, not only technically.

Copyright And AI Training

Facts are not protected by copyright, which is why scraping prices or product attributes carries little copyright risk. Copying expressive content such as articles, reviews, photos or code is different, and AI training has turned that into the most active area of scraping law.

In June 2025, two judges in the Northern District of California found that training large language models on books was fair use on the records before them (Bartz v. Anthropic and Kadrey v. Meta), although the Anthropic ruling treated a library of pirated copies separately and the case later settled. On September 29, 2026, the Third Circuit went the other way on different facts in Thomson Reuters v. Ross, holding that copying Westlaw headnotes to train a competing, non-generative legal research tool was not fair use. Akin Gump’s tracker stresses how much that outcome depended on the product competing directly with the source.

The practical takeaway: if scraped content will train a model or appear in a product, the copyright question is separate from whether the scraping itself was lawful, and it needs its own review.

The Cases To Watch In 2026

Two lawsuits filed in late 2025 test whether getting around search engine bot detection can be treated as circumvention under the DMCA. Their status below is current as of October 21, 2026.

Google v. SerpApi (N.D. Cal.)

Google sued SerpApi, which sells structured Google search results through an API, in December 2025, alleging it bypassed SearchGuard, Google’s system for detecting automated queries. Google’s claims were brought under the DMCA’s anti-circumvention provisions rather than as ordinary copyright infringement.

On July 20, 2026, Chief Judge Yvonne Gonzalez Rogers granted SerpApi’s motion to dismiss in part. According to the published order, claims based on search results that contain no copyrighted material were dismissed without leave to amend, because the DMCA only protects copyrighted works. Claims tied to copyrighted content in results were dismissed with leave to amend, because Google had not alleged that SearchGuard was put in place with the authority of the copyright owners. The court did find Google had adequately alleged circumvention itself. Google filed an amended complaint in August 2026, SerpApi moved to dismiss again, and as of this writing no ruling on that second motion has been reported. Discovery remains stayed.

Reddit v. SerpApi, Oxylabs, AWMProxy And Perplexity (S.D.N.Y.)

In October 2025, Reddit sued SerpApi, the proxy providers Oxylabs and AWMProxy, and the AI search company Perplexity in New York. Reddit’s theory is that the defendants collected Reddit content from Google search results at industrial scale by getting around Google’s access controls, and it also brings DMCA anti-circumvention claims.

On July 31, 2026, Judge Paul Engelmayer largely denied the motions to dismiss, finding Reddit had plausibly alleged that SerpApi supplied a product for getting around Google’s controls and that Perplexity paid for it, as RightsTech reported. At a conference on October 1, 2026, the judge allowed discovery to proceed, including on antitrust counterclaims SerpApi has raised over Reddit’s data licensing deals, and indicated he was unlikely to dismiss Oxylabs. The case is in discovery, with further conferences scheduled into 2027.

Neither case has produced a ruling on the merits. What they show is that the legal fight has moved from “may you read a public page” to “how did you get past the system designed to stop automated access, and whose content was behind it.”

Web Scraping Legality In The EU And UK

European law has no direct equivalent of the CFAA debate. The two questions that matter most are whether the data includes personal data and whether you are extracting a substantial part of a protected database.

GDPR: Personal Data Is The Main Risk

Under the GDPR and the UK GDPR, publicly available personal data is still personal data. Names, usernames, photos, profile text and anything that identifies a person needs a lawful basis, usually legitimate interests, along with transparency, data minimization and a way for people to exercise their rights. Regulators have fined scrapers heavily when this goes wrong: Clearview AI, which built a facial recognition database from scraped images, was fined 20 million euros by France’s CNIL in 2022 and 30.5 million euros by the Dutch data protection authority in 2024.

If your project only collects non-personal business data, such as product prices, stock levels or company information that does not identify individuals, the GDPR largely falls away. That is why scoping the data you collect is the single most effective legal control in Europe.

Regulator Guidance: CNIL, ICO And The EDPB

Three sets of guidance shape how European regulators view scraping today:

• CNIL (France), June 2025: recommendations on legitimate interest and a focus sheet on web scraping for AI development, summarized by Covington’s Inside Privacy. Expected measures include precise collection criteria, excluding certain data categories, deleting irrelevant data quickly, and keeping a list of sites that object to scraping.
• ICO (UK), December 2024: the outcome of its generative AI consultation confirmed that legitimate interests is the realistic lawful basis for training on scraped data, and the ICO told developers to be far clearer with people about how their information is used.
• EDPB, July 2026: the European Data Protection Board adopted draft Guidelines 03/2026 on web scraping in the context of generative AI, open for consultation until October 30, 2026. The draft treats signals such as robots.txt and login walls as relevant to what people can reasonably expect, which means ignoring them can weigh against you under the GDPR, not only under contract or copyright law.

The Database Right And Text And Data Mining Rules

The EU and UK also protect databases that required substantial investment through a sui generis database right. Extracting or reusing a substantial part of such a database, or repeatedly taking small parts, can infringe it. In CV-Online Latvia v. Melons (2021), the Court of Justice held that a job search aggregator could infringe if its reuse put the database maker’s investment at risk. In Ryanair v. PR Aviation (2015), the same court held that where a database is not protected by copyright or the database right, its owner can still restrict use by contract.

For text and data mining, the EU Digital Single Market Directive allows commercial mining of lawfully accessed content unless the rightsholder has opted out in a machine-readable way, such as through robots.txt or metadata. The UK’s exception is narrower and covers non-commercial research only. For AI projects, those opt-outs are now a compliance requirement, not a courtesy.

Ethical Web Scraping: A Practical Low-Risk Checklist

None of this means scraping is off limits. Price intelligence, market research, SEO monitoring, ad verification, travel aggregation and academic research all rely on it every day. The following checklist reflects the patterns that keep projects on the lower-risk side of the case law and regulator guidance.

1. Prefer an official API or data feed. If the site offers an API, a licensed dataset or a partner program, use it. You get cleaner data, clear permission and no argument about access.
2. Stick to public pages and stay logged out. Do not scrape behind a login unless you have explicit permission, and never use fake or borrowed accounts. Stop if access is revoked or you receive a cease and desist letter, and get advice.
3. Do not get around technical barriers. Avoid defeating CAPTCHAs, paywalls or bot-detection systems. After the 2026 rulings, how you deal with these controls is a legal question as well as a technical one.
4. Leave out personal data, or establish a lawful basis first. Scope fields so you collect business facts, not people. If personal data is unavoidable, document a legitimate interests assessment, minimize what you keep and set retention limits.
5. Read the terms of service. Know whether you have agreed to them and what they say about automated access. Note any licensing terms for the content you plan to reuse.
6. Respect robots.txt and rate limits. The Robots Exclusion Protocol, standardized as RFC 9309, is not a law in itself, but courts and regulators treat it as evidence of what a site owner expects. Crawl slowly, cache responses and avoid peak hours.
7. Identify yourself. Use a user agent that names your organization and gives a contact address, so site owners can reach you instead of blocking you or calling their lawyers.
8. Think about how you will use the output. Analyzing data is lower risk than republishing it. Copying expressive content into a product or a training dataset needs a separate copyright review.
9. Choose vendors carefully. If you buy data or infrastructure, ask providers how they source their IP addresses and what consent their network participants gave. Our roundups of web scraping APIs and proxy-backed data extraction services are a starting point for that due diligence.
10. Keep records. Log what you collected, from where, when and under which policy. If a dispute arises, a documented, good-faith process is your best evidence.

Teams that use scraping for search visibility work, such as rank tracking and competitor content audits, will find more practical detail in our guide to web scraping for SEO.

Frequently Asked Questions

Is scraping legal if the data is public?

Usually, yes, as far as the act of collecting it goes. US courts have held that scraping public, logged-out pages is unlikely to violate the CFAA. Public availability does not remove copyright in the content, contract terms you have accepted, or data protection duties if the data identifies people.

Is it illegal to ignore robots.txt?

Ignoring robots.txt is not a crime on its own in the US, the EU or the UK. It can still hurt you: it can support contract and trespass arguments, it can count against you under the GDPR legitimate interests balancing test, and in the EU it can be the machine-readable opt-out that removes the text and data mining exception.

Can a website’s terms of service stop me from scraping?

They can if you are bound by them, typically because you created an account and accepted them. Meta v. Bright Data shows that terms written for logged-in users may not reach logged-off collection, but hiQ v. LinkedIn shows that once you agree to terms, breaching them can end a scraping business.

Is it legal to scrape data to train AI models?

It depends on the content and the jurisdiction. US courts have reached different fair use results depending on the facts, and European regulators expect a documented lawful basis, opt-out handling and safeguards for personal data. Treat AI training as its own legal review, separate from the scraping.

Is scraping Google search results legal?

That question is being litigated now. Google v. SerpApi and Reddit v. SerpApi both focus on whether getting around Google’s bot detection is unlawful circumvention under the DMCA. Until those cases are resolved, businesses that need search data at scale often prefer licensed or official sources.

Conclusion

So, is web scraping legal? Collecting public, non-personal data at a polite rate is broadly lawful across the US, the EU and the UK, and the courts have steadily rejected attempts to treat it as hacking. The real exposure sits elsewhere: accepted terms, logins and technical barriers, personal data, copyrighted content and, as the 2026 cases show, anti-circumvention claims. Every ruling discussed here is narrow and fact-specific, so use the checklist to design a careful process and bring in a lawyer when your project touches any of the higher-risk areas.

This article provides general information only and is not legal advice.

Related Reading

• Web Scraping Best Practices: How To Collect Data Without Getting Blocked
• Web Crawler vs Web Scraper: What’s The Difference?
• Top SERP APIs In 2026
• Web Scraping & Proxies hub: every list, guide and comparison in one place