Is AI Scraping Legal?

The scraping itself is judged as any scraping is: public pages, terms you accepted, logins and blocks (is web scraping legal). What makes AI different is what happens next. Training copies works at scale, models can memorize and repeat them, and datasets mix in personal data from millions of people. Each step brings in a body of law: copyright, data protection and, in the EU, the AI Act. How to build a training dataset is covered in web scraping for AI training; this page covers the law.

In the US, training on copyrighted works is a fair use question decided case by case, and the 2025 rulings went both ways.

• February 11, 2025, Thomson Reuters v. Ross Intelligence. Judge Stephanos Bibas held that copying Westlaw headnotes to build a competing legal research tool was not fair use (district docket). The tool was not generative AI, which limits how far the ruling reaches.
• September 29, 2026, Thomson Reuters v. Ross Intelligence on appeal. The Third Circuit heard Ross's interlocutory appeal on June 11, 2026 and decided it on September 29, 2026 in a precedential opinion (No. 25-2153); the court first filed the opinion under seal, and the parties agreed that it can be made public without redactions (appeal docket). Read the opinion for the holding before you rely on the district ruling.
• June 2025, Bartz v. Anthropic. Judge William Alsup found training on lawfully acquired books to be fair use, but not building a library from pirated copies; the case later settled (docket).
• June 2025, Kadrey v. Meta. Judge Vince Chhabria granted Meta summary judgment on fair use, on the record and arguments before him.
• May 9, 2025, US Copyright Office. The Office released a pre-publication version of Part 3 of its AI report, on generative AI training, which treats training as a case-by-case fair use question.

How the data was obtained matters as much as how it is used: pirated sources and getting around technical protections (17 U.S.C. § 1201) are where the clearest risks sit.

• three cumulative conditions for legitimate interests: a legitimate interest, necessity, and a balancing test;
• minimization before collection, including excluding websites that clearly oppose scraping through logins, robots.txt or ai.txt files, or CAPTCHAs, and excluding personal data that is only accessible when logged in;
• filters for special categories of data, which need an Article 9 derogation on top of a lawful basis;
• deleting, anonymizing or pseudonymizing personal data as soon as possible, and measures against memorization and regurgitation in the model.

Enforcement is real: the Dutch authority fined Clearview AI €30,500,000 in 2024 for a facial-recognition database built from scraped photos (EDPB news). The European rules in full: web scraping law in the UK and EU.

The UK allows text and data mining only for non-commercial research, under section 29A of the Copyright, Designs and Patents Act 1988. The government consulted on copyright and AI from December 17, 2024, to February 25, 2025, and published a report and impact assessment on March 19, 2026 (GOV.UK). Personal data falls under the UK GDPR, and the ICO joined 11 other regulators in a 2023 joint statement that public personal data is still protected.

Under Article 4(1) of the GDPR, personal data is "any information relating to an identified or identifiable natural person". In scraped data that includes:

• names, usernames and handles, email addresses and phone numbers;
• photos, voices and videos of people;
• profiles, posts, reviews and comments tied to a person;
• location data and, where the holder can identify the user, IP addresses (Breyer, C-582/14);
• data about sole traders, such as a self-employed seller's name and number.

Pseudonymized data is still personal data; only data that can no longer be linked to a person is outside the GDPR. Prices, product specifications and aggregate statistics are not personal data.

In the US, the CAN-SPAM Act treats sending commercial email to addresses harvested by automated means from a website that says it will not share them as an aggravated violation (15 U.S.C. § 7704(b)). In the EU and the UK, collecting individuals' emails needs a GDPR lawful basis, and marketing email to individuals generally needs their prior agreement under the ePrivacy rules. Building marketing lists from scraped emails is the clearest case of scraping that regulators fine.

Summarizing scraped pages. Reading pages and producing your own summary for internal analysis is low risk; publishing summaries that reproduce the original's expression, or whole articles, is a copyright question. Sending scraped personal data to an LLM provider is itself processing, which needs a lawful basis and a contract with the provider in Europe.

Deep research tools fetch pages live, quote sources and link to them. The legal questions are the same as for any reader of the page, plus the site's terms on AI agents and the copyright limits on how much of the source the answer reproduces.

AI agents. Sites now write agent rules into their terms. Amazon's Conditions of Use (last updated August 14, 2026) require agents to identify themselves with "Agent/[agent name]" in the user agent and forbid "completing or circumventing CAPTCHAs", and a federal court granted Amazon a preliminary injunction against Perplexity's shopping agent on March 9, 2026 (docket). eBay's User Agreement bars "buy-for-me agents" and "LLM-driven bots" without permission. Details: is scraping Amazon legal.

AI crawlers in robots.txt. On October 23, 2026, the robots.txt files of Amazon and TikTok both blocked GPTBot, ClaudeBot, PerplexityBot, CCBot and other AI crawlers from the whole site. The EDPB's draft guidelines read such signals as opposition to scraping, and site owners use them to reserve content from text and data mining.

Monitoring how AI assistants answer questions about your brand means collecting their answers at scale. The AI services' own terms govern automated use of their interfaces, and the answers quote third-party sources whose copyright stays with them. ProxyField's ChatGPT scraper API, Perplexity scraper API and Google AI Mode API return those answers for $1.50 per 1,000 successful results, falling to $1.00 at volume; the overview is in AI search scraper APIs. ProxyField's acceptable use policy forbids infringing intellectual property and accessing data behind logins you are not entitled to.

• Thomson Reuters v. Ross Intelligence, D. Del. No. 1:20-cv-00613, docket
• Thomson Reuters v. Ross Intelligence, 3d Cir. No. 25-2153, appeal docket
• Bartz v. Anthropic, N.D. Cal. No. 3:24-cv-05417, docket
• US Copyright Office, Copyright and Artificial Intelligence (Part 3 pre-publication, May 9, 2025)
• 17 U.S.C. § 1201
• Directive (EU) 2019/790
• AI Act, Regulation (EU) 2024/1689
• EDPB, Opinion 28/2024 (adopted December 17, 2024)
• EDPB, Guidelines 03/2026 on web scraping in the context of generative AI (adopted July 7, 2026, public consultation)
• EDPB news, Dutch authority fines Clearview AI
• Copyright, Designs and Patents Act 1988, s.29A
• GOV.UK, Copyright and Artificial Intelligence consultation (report and impact assessment, March 19, 2026)
• ICO and others, joint statement on data scraping (August 2023)
• GDPR, Regulation (EU) 2016/679
• CJEU C-582/14, Breyer
• 15 U.S.C. § 7704 (CAN-SPAM)
• Amazon Conditions of Use (last updated August 14, 2026)
• Amazon.com Services v. Perplexity AI, N.D. Cal. No. 3:25-cv-09514, docket

This is not legal advice. Laws and court decisions change, and the primary sources linked on this page are the authority.