Is Web Scraping Legal?
Short answer: scraping publicly available data is generally lawful in most places, and courts — especially in the US — have repeatedly declined to treat it as hacking. The longer answer is that "legal" depends on three separate questions people tend to blur together: what you scrape, how you get it, and what you do with it afterward. This guide walks through all three in plain English. It's general information from a scraping company, not legal advice — for decisions that matter, talk to a lawyer in your jurisdiction.
$5.00 free to start · no card required · failed runs are free
The principle that decides most cases: public vs private
Nearly every scraping question resolves against one line: was the data available to anyone with a browser, or was it behind a gate? A public Google Maps listing, a public TikTok bio, a public Instagram profile — anyone on earth can read those without an account or a password. Collecting them faster than a human could is, in most analyses, doing a legal thing efficiently.
Private is different in kind, not degree. Data behind a login, a paywall, a private account, or a "members only" wall carries an access restriction, and bypassing one is where scraping stops looking like reading and starts looking like intrusion. The cleanest legal posture in scraping is also the simplest one: never log in, never bypass, never touch what a person or platform has gated.
What US courts have actually said
The best-known fight is the hiQ v. LinkedIn line of cases, which ran for years through the federal courts. LinkedIn argued that scraping public profiles violated the Computer Fraud and Abuse Act — the US anti-hacking statute. The Ninth Circuit disagreed, twice, reasoning that a law about breaking into computers doesn't fit data the owner left open to everyone. The Supreme Court's Van Buren decision pointed the same direction, reading the CFAA around a gates-up-or-gates-down idea: the statute is about passing a closed gate, not about what you do with information sitting past an open one.
But the same saga carries the second lesson people skip: hiQ still lost in the end — not on hacking, but on contract. It had used logged-in accounts that had agreed to LinkedIn's terms, and the court found that agreement enforceable. The arc, in one sentence: scraping public data isn't hacking in the US, and a terms-of-service agreement you've actually entered can still bind you. That's a general description of how the cases went, not a prediction about any particular situation.
Terms of service vs the law — two different things
A platform's terms of service are a contract, not a statute. Most platforms' terms say they prohibit automated collection; breaking a contract is a civil matter between you and the platform, not a crime — but it's a real matter: platforms can close accounts, block access, and in serious commercial disputes, sue. Whether a site's terms even bind someone who never made an account and never clicked "agree" is one of the genuinely contested questions in this area, and it's precisely why logged-out scraping of public pages sits on much firmer ground than scraping through an account.
The practical division of labor: the law decides whether scraping is permitted at all; a platform's terms decide whether the platform is upset with you. Those are different risks with different consequences, and honest scraping tools are built to keep you out of the first kind entirely.
Privacy law: what you do with the data matters most
Here's the turn most guides miss: modern privacy law cares less about the act of collecting and more about what happens next. Under the EU and UK GDPR, personal data — a name, an email, anything tied to an identifiable person — stays protected even when it's public. You need a lawful basis to process it, people retain rights over it, and "it was on their public profile" is the start of a compliance argument, not the end of one. California's CCPA runs on similar fuel. Business data — a restaurant's phone number, a company's contact email — carries far less of this weight than data about private individuals.
Then outreach law takes over: CAN-SPAM in the US, PECR in the UK, and their equivalents elsewhere govern the emails and calls you make with a scraped list — identify yourself honestly, make unsubscribing work, honor every opt-out. A clean scrape can still become a legal problem three steps later if the outreach is spam. The uncomfortable, useful truth: the riskiest part of scraping usually isn't the scraping.
How 1Scrape stays on the right side of the line
1Scrape is built around the settled part of the law: it collects public data only, from TikTok, Instagram, and Google Maps. It never logs into accounts, never touches private profiles or gated content, and never bypasses an access control — the contact details in your CSV are the ones people and businesses chose to publish on pages anyone can see. If someone published nothing, their column is empty; the tool doesn't guess or dig.
What happens after the download is yours to keep clean: respect the privacy laws that apply to your prospects, keep outreach relevant and honest, and honor opt-outs. Scrape public data, treat people decently, and you're operating the way the tools that last operate.
Frequently asked questions
Is web scraping legal in the US?
Scraping publicly available data is generally lawful in the US — the courts in the hiQ v. LinkedIn line held that the anti-hacking statute doesn't cover data left open to everyone. Scraping behind logins is where trouble lives: it can violate the terms you agreed to and, depending on the facts, the law. How you use the data — outreach, resale, republishing — carries its own rules like CAN-SPAM. General information, not legal advice.
Is web scraping legal in the UK?
There's no law against scraping as such, but the UK GDPR applies to personal data even when it's public, database rights can protect substantial extractions from some databases, and PECR governs the marketing emails you send afterward. Public business data collected politely and used for relevant, honest outreach sits at the low-risk end. General information, not legal advice.
Is web scraping legal in the EU?
Similar shape to the UK: no blanket prohibition, but the GDPR is the main constraint — personal data about identifiable people needs a lawful basis to process, public or not, and EU database rights can protect some collections. Data about businesses rather than individuals carries much less privacy weight. General information, not legal advice.
Does violating a website's terms of service make scraping illegal?
Breaking a site's terms is a contract issue between you and the site, not a crime — courts in the hiQ cases treated the two very differently. The platform can block or ban you, and an agreement you actually entered (like a signed-in account) can be enforced against you. That's the practical case for only ever scraping public pages while logged out, which is the only way 1Scrape operates.
Can I scrape data from behind a login?
Don't. Logged-in scraping means you've agreed to terms that almost certainly prohibit it, and gated data is exactly what intrusion laws exist to protect. This is the clearest line in the whole area, which is why 1Scrape never logs in, never accesses private accounts, and never collects gated content.
Is it legal to scrape emails for outreach?
Collecting emails that people and businesses published on public pages is the lawful end of the pool — but the outreach you send is regulated separately by CAN-SPAM, GDPR, PECR, and friends. Identify yourself, keep it relevant, make unsubscribing easy, honor every opt-out. The list is rarely the legal risk; the spam is. General information, not legal advice.