Is web scraping legal in 2026? What scrapers need to know

Which laws can apply to a web scraper?

Ask five questions about every project:

1. Access. Did you get past a login, a paywall or another gate? Computer-misuse laws care about authorisation; public pages are treated differently from protected ones.
2. Circumvention. Did you defeat a technical measure, such as an anti-bot system? In the US, section 1201 of the DMCA is now being tested against scrapers.
3. Contract. Did you accept the site's terms, for example by creating an account? Breaching terms can be a contract claim even when access was lawful.
4. Content. Are you copying protected text, images or a database? Copyright and, in the EU, the database right protect more than facts.
5. People. Does the data identify anyone? Then data-protection law, such as the GDPR or US state privacy laws, applies, public or not.

What is the legal position in the United States?

• Computer Fraud and Abuse Act. After the Supreme Court's Van Buren decision (2021), the Ninth Circuit held in hiQ v. LinkedIn (April 2022) that scraping publicly available data is not access "without authorization". The same case ended with a finding that hiQ breached LinkedIn's user agreement, and a settlement.
• Terms of use. In Meta v. Bright Data (N.D. Cal., January 2024), the court found that Meta's terms did not bar logged-off scraping of public data; Meta dropped the case. X Corp's claims against Bright Data were dismissed in May 2024 and later settled.
• Anti-circumvention. Two 2026 cases test whether getting past an anti-bot system breaks section 1201 of the DMCA. In Google v. SerpApi the first complaint was dismissed in July 2026 and an amended one is pending. In Reddit v. SerpApi, Oxylabs, AWMProxy and Perplexity, on 31 July 2026 the court largely denied SerpApi's and Perplexity's motions to dismiss; Oxylabs' motion was still pending in October 2026. No defendant has been found liable, and the courts have not decided the merits.
• Copyright and AI. In September 2026 the Third Circuit held in Thomson Reuters v. Ross that training a non-generative legal search tool on Westlaw headnotes was not fair use.

What is the legal position in the EU and the UK?

• Text and data mining. EU copyright law allows text and data mining of lawfully accessible content, unless the rights holder reserved that use, for online content in a machine-readable way. In Kneschke v. LAION (December 2025), the Hamburg Higher Regional Court held that LAION, a non-commercial research association, could rely on the scientific-research TDM exception, and that a plain-language reservation was not machine-readable with the technology available in 2021. It said this could change as technology evolves, and a further appeal to the Federal Court of Justice (BGH) was allowed. Commercial crawlers should treat plain-language reservations in terms of use as binding today.
• AI Act. Providers of general-purpose AI models must have a policy to identify and respect those reservations (Article 53). The 2025 code of practice commits signatories to crawlers that follow robots.txt.
• Database right. The EU's sui generis database right protects substantial investment in a database. The Court of Justice held in CV-Online Latvia v. Melons (2021) that re-using a database can infringe it when it harms that investment.
• Personal data. The GDPR applies to public personal data. The EDPB's Opinion 28/2024 says legitimate interest can be a legal basis for AI development, case by case; the CNIL issued recommendations on scraping for AI in June 2025.
• United Kingdom. In Getty Images v. Stability AI (November 2025), the High Court rejected the secondary copyright claim over the model; Getty was given permission to appeal.

How do I lower the legal risk of a scraping project?

• Public pages only. No logins, no paywalls, no accounts you do not own.
• Respect robots.txt and AI opt-outs. Apply RFC 9309, honour ai-train=no style signals for training data, and record what you checked and when.
• Do not circumvent. No CAPTCHA solving, no tools built to defeat bot detection, no retries designed to get past a refusal. See how to respond to 403, 429 and CAPTCHAs.
• Read the terms of sites you depend on, especially if you hold an account there.
• Minimise personal data, document your legal basis and keep a way to honour objections.
• Use what you collect fairly: facts and analysis are safer than republishing whole texts or images.
• Keep records: URLs, dates, robots.txt versions and your crawler's identity.

For anything with real exposure, ask a lawyer in the countries involved.

Does using a proxy change whether scraping is legal?

No. A proxy changes where your request appears to come from; it does not change what you collect or how. The same five questions apply with or without one. Two things do change. First, your proxy provider's own rules: CrawlRelay's Acceptable Use Policy allows public data only and forbids circumvention and fraud. Second, the provider's sourcing: in 2026 Google and US authorities disrupted the IPIDEA and NetNut networks over devices recruited without proper consent, so ask where a provider's IPs come from. Ours are covered on the sourcing page.