Is Web Scraping Legal? a 2026 Guide

In the United States, web scraping isn't automatically illegal because a site objects, and it isn't automatically lawful because a page is public. The CFAA, the federal law at the center of a leading public-data case, governs unauthorized access to computers, but whether you can reach a page and whether you can lawfully use the personal data you pull from it are separate questions.

The popular advice that "public data is fair game" skips the part that often matters most to a business: what happens after collection. A public email address becomes a prospecting record the moment a team extracts it, enriches it, uploads it to a CRM, and sends an offer. Getting onto the page is one legal question. The file you build and the campaign you run from it are several more, and that's where most real exposure sits.

A practical review looks at five gates, in order. Access method and federal hacking law ask how you reached the information. Personal-data rules, contract and platform terms, and downstream use govern what else may apply, including after access has ended. The table below summarizes each gate, but the distinctions behind each row matter when you're deciding whether a real workflow is defensible.

Table of Contents

• Whether Web Scraping Is Legal Depends on Five Gates

- Start with the way you get in - Then assess the file and the campaign

• What US Courts Have Said About Public Pages

- What the ruling doesn't approve

• Public Contact Data Still Needs a Lawful Basis

- Treat collection as processing - Make the purpose and safeguards concrete

• Where the Law Changes Across Jurisdictions

- Turn the lookup into a project check

• What Changes When You Buy a Scraped List

- Demand a usable record of provenance

• Controls That Keep a Public Scrape Defensible
• Decide Your Use Before You Collect Contacts

Whether Web Scraping Is Legal Depends on Five Gates

Public availability is a relevant fact, not a complete legal answer. In the United States, a court's view of access under one federal statute doesn't settle contract, privacy, or marketing questions. A careful operator checks the collection path and the intended use together, because a workflow can have a relatively narrow access risk and still create substantial risk in its contact file or outreach.

Start with the way you get in

A page that loads in an ordinary browser without authentication is different from a private account, a login-only page, or an endpoint available only after a technical restriction is overcome. Avoiding password bypass, CAPTCHA circumvention, and attempts to get around a block reduces one category of risk. It doesn't grant permission for every use of the resulting data.

The White & Case analysis of web scraping and the CFAA describes the limited reach of the public-page reasoning and the practical value of rate limits, collection logs, and records of source URLs and timestamps. A system that stops when a target blocks it is easier to defend than one that treats a block as a technical hurdle to defeat.

Then assess the file and the campaign

If the output contains names, usernames, email addresses, or phone numbers linked to people, privacy law may apply even when the source page was openly visible. Terms may also create contractual or platform-enforcement concerns. And a sales team's later use of a list raises a different question from the act of viewing a profile.

For a useful example of how platform access disputes can affect marketers, read what founders should know about Reddit scraping. The practical lesson isn't that every scrape has the same outcome. It's that a defensible project identifies the platform rules, access boundaries, data categories, and intended use before collection starts.

What US Courts Have Said About Public Pages

The key U.S. case is hiQ Labs v. LinkedIn, but its lesson is narrower than the popular shorthand suggests. hiQ scraped publicly visible LinkedIn profiles, and LinkedIn tried to stop it. After the U.S. Supreme Court's 2021 decision in Van Buren v. United States, the Ninth Circuit in 2022 reaffirmed that accessing those publicly visible profiles generally didn't constitute unauthorized access under the Computer Fraud and Abuse Act.

The court's reasoning focused on the access boundary. A public website is available to anyone using an ordinary browser, so it lacks the authentication “gate” contemplated by the CFAA. The statute, enacted in 1986, prohibits certain unauthorized access to protected computers. The Goodwin account of the Ninth Circuit's decision explains why the ruling matters for public pages, while also emphasizing that it doesn't establish a universal right to scrape.

“public is not the same as authorized for every purpose.”

What the ruling doesn't approve

The case doesn't bless password cracking, bypassing authentication, circumventing CAPTCHAs, ignoring technical blocks, or reaching restricted areas through a different route. Nor does a finding about CFAA liability wipe out possible claims under contract, copyright, trespass to chattels, misappropriation, unjust enrichment, conversion, privacy, or state law.

That distinction is easy to miss when a cease-and-desist letter arrives. The letter alone doesn't automatically turn access to public information into a CFAA violation, but it can matter to other claims or prompt platform enforcement. Terms of service, robots directives, rate limits, the scale of collection, and the load imposed on a website all deserve separate attention.

For a public Instagram profile, the narrow takeaway is that a profile visible without logging in is legally different from login-protected information. It doesn't mean every field can be collected, republished, or used for sales without further analysis. Treat the case as a boundary around one legal theory, not as a permission slip for a whole business process.

Public Contact Data Still Needs a Lawful Basis

Think of an open-shelf library. Being allowed to read a book doesn't mean you can photocopy every address inside it and mail those people a sales pitch. A public webpage works similarly: visibility answers something about access, but it doesn't settle whether collecting and reusing personal contact details is lawful.

Treat collection as processing

Access asks whether the page is public or whether you crossed a technical barrier, such as a login wall or a block. Use asks what happens next. Extracting, cleaning, organizing, storing, enriching, or uploading a public email address or phone number into a CRM can be a separate personal-data processing activity.

Under the GDPR, personal data can remain regulated even when it appears on a public webpage. A lawful basis under Article 6 is required, and a commonly considered option is legitimate interests under Article 6(1)(f). The European Data Protection Board's web-scraping guidance emphasizes that collection, storage, organization, and retrieval can all be processing. A documented assessment should account for people's rights and reasonable expectations, not just the business reason for building a list.

Make the purpose and safeguards concrete

Compare reading one public business profile with pulling thousands of contacts into a prospecting file, enriching them, transferring them across borders, and retaining them without an end date. The latter calls for much closer scrutiny. “Public” doesn't mean “consented to marketing,” and calling a list business development data doesn't remove privacy obligations.

A defensible workflow limits fields to what the stated purpose requires and sets a retention period before the file is used. It also plans for a transparency notice, security measures, and a process for people to object or request deletion. Separate public business contact details from personal contact details, and avoid collecting sensitive or inferred attributes when the purpose doesn't require them. Their processing is generally restricted, so they shouldn't be treated as harmless enrichment.

A 2023 joint statement by global privacy regulators says information described as publicly available or accessible remains subject to data-protection and privacy laws. The regulators' joint statement on data scraping reinforces the operational point: visibility doesn't remove the organization's responsibility to handle personal information lawfully.

Here's a short explainer to help frame the difference between access and reuse:

Where the Law Changes Across Jurisdictions

A workflow that passes an access review in one country may still create privacy or marketing obligations elsewhere. Start with the rules that govern the people in the file, then check the sender's location and where the outreach will be received. A U.S. analysis of public access doesn't decide the privacy treatment of a European contact, and an EU privacy assessment doesn't settle computer-misuse rules in another country.

Turn the lookup into a project check

Before collection, make three decisions and keep a record of them:

1. Locate the people in the file. Their location can determine which privacy rules apply to their personal data.
2. Locate the sender and the audience. The sender's establishment and the country receiving the outreach can affect marketing requirements. For a closer look at how email marketing intersects with GDPR obligations, use this guide to GDPR and email marketing.
3. Log the analysis and date. Record which jurisdictions you checked, what rules you considered, and when you made that assessment. Revisit it if the audience, use, or collection method changes.

For the UK, check current guidance rather than assuming every EU interpretation maps over unchanged. For other countries, don't infer that the U.S. or EU position answers the question. Local privacy, computer-misuse, and marketing rules need their own review before collection or outreach.

What Changes When You Buy a Scraped List

Paying a vendor doesn't transfer the buyer's legal responsibilities. If your team decides why it wants a list and how it will use the information, your own processing may still need to be justified even when another company did the collection. The vendor's right to gather fields and your right to prospect with them are distinct questions.

Consider an agency that orders public Instagram business emails, uploads them into a client's CRM, enriches the records, and asks sales representatives to send a campaign. The fact that the original profiles were public doesn't resolve whether each later step is appropriate. Sharing with the client, adding data, retaining it, and contacting people all deserve attention on their own.

The European Data Protection Board guidance on scraping and accountability points to the possibility that a scraper and customer can each be responsible for their own processing when each determines its purposes and essential means. A contract, indemnity, or “GDPR-conscious” label can't replace the customer's own assessment, notices, opt-out handling, and marketing-law review.

Demand a usable record of provenance

Before a file enters a CRM, verify that the supplier can show:

1. Source URL for each record or source group.
2. Collection date so the team can assess freshness.
3. Access method, including confirmation that login walls and technical controls weren't bypassed.
4. Data categories captured, including whether the list contains personal emails or phone numbers.
5. Geographic scope of the people represented.
6. Lawful-basis analysis relevant to the stated use.
7. Deletion path for records that must be removed.
8. Accuracy evidence that supports validation before outreach.

These details let a buyer assess what the vendor collected and what the buyer intends to do with it. If the list will be shared across sales teams or exported to multiple tools, preserve those records alongside the file rather than leaving them behind in a procurement thread. For a broader view of how the sector's responsibilities are evolving, see this discussion of data broker industry oversight.

If the supplier can't document where the records came from, how they were collected, or how they can be deleted, don't upload the file. A low-cost list without provenance can leave the buyer unable to explain its decisions when a person objects or asks for their information to be removed.

Controls That Keep a Public Scrape Defensible

Build compliance into the job brief before anyone runs a collector or buys a file. The collector can control the source, method, fields, and collection logs. The sender still has to justify the purpose, assess the audience, and handle the campaign lawfully. A tool can gather public fields; it can't choose your business purpose or make your message compliant.

1. Write the purpose in one sentence. For example, contact public businesses in a named niche about a service relevant to that audience. Reject work intended for surveillance, harassment, or raw-data resale; vague purposes make it harder to justify why the fields were needed.

1. Check the target sources. Confirm that each URL is public and relevant to the purpose. Don't log in, solve CAPTCHAs, or route around a block. If the target blocks collection, stop rather than treating the restriction as an invitation to try another access path.

1. Limit the fields. Collect only what the task needs, such as a username, a public business email or phone number, and a category or website. Don't collect sensitive or inferred traits just because the source makes them visible.

1. Separate business and personal contacts. Review the output before anyone exports it to a CRM. A public business contact and a personal email or mobile can raise different expectations and deserve different handling.

1. Record source and time. Keep the source URL and collection timestamp with each row so the record's origin survives a spreadsheet handoff or CRM import. This makes it easier to validate, investigate, and remove a record later.

1. Set retention and deletion first. Choose when the file should be reviewed or deleted, and decide who will action removal requests. A retention policy with no owner or deletion route is only a sentence in a document.

1. Review the planned outreach. Check the rules for the recipient's location and the sender's location before sending. In the United States, assess CAN-SPAM requirements for the email; for EU and UK contacts, assess the relevant marketing rules and how a lawful basis and objections affect the plan.

1. Apply suppression before launch. Compare the audience with your suppression list before the first send, then keep that list available for future jobs. Waiting for a complaint to exclude someone can create avoidable risk and repeated contact.

1. Rate-limit and respect blocks. Keep request volumes controlled and stop when a target blocks the process. This reduces unnecessary server burden and avoids escalating a collection job into an access-control dispute.

If an API offers the data you need, compare it with scraping before you launch. This guide to web scraping versus APIs can help you assess which route fits the project. Whichever method you choose, keep the purpose, source, fields, retention, and sending plan in the same review.

Decide Your Use Before You Collect Contacts

Use a short go-or-no-go test before ordering or collecting a contact file:

1. Is the audience a public business or creator profile rather than a private person?
2. Can you state the purpose, the required fields, and the delete-by date on one page?
3. Have you checked whether the outreach rules where you'll send require consent, opt-out handling, or a suppression list?

If you can't answer all three, stop and resolve the gap before collection. If you can, keep the project bounded to that audience and use. A public page may narrow the access question; it doesn't hand off responsibility for what you do with the record.

HarvestMyData extracts publicly available contact information from social media profiles and other public sources, without accessing private accounts or protected content. Users remain responsible for lawful use, including compliance with applicable anti-spam laws, avoiding harassment and stalking, not reselling or redistributing raw data, and honoring opt-out requests. Before building an audience, write down the purpose and suppression rule, then order only public contacts that fit them; this guide to building an email list can help you plan a focused audience.

HarvestMyData provides publicly listed email and phone extraction from public social profiles, with structured files for defined audiences. If your access method and intended use pass the checks above, visit HarvestMyData to explore a public-data workflow, and set your purpose, retention, and opt-out process before using any contacts.