What Data Is Legal and Safe to Scrape? US, EU and UK (2026)

No type of data is illegal to read as such; the risk comes from how you get it and what you do with it.

Safe by default:

• public prices, product specs, stock and listings on pages anyone can open;
• statistics and other facts that describe no person, such as weather, sports scores and public business addresses;
• public government data, under the license it is published with;
• aggregated statistics, or data that is truly anonymized. Removing names is not always enough: data that can still be linked back to a person is personal data, and only anonymous data falls outside the GDPR (GDPR Recital 26; EDPB basic principles);
• data you own, or that a license or an official API lets you use.

Never collect:

• anything behind a login or paywall you are not entitled to, or past a block the site has put on you;
• passwords, session tokens, API keys and private messages, even when a page exposes them by mistake;
• payment card and bank details, and national ID numbers;
• personal data without a lawful basis, and above all the special categories of GDPR Article 9 (health, religion, sexual orientation, political views, biometric data);
• children's data: under the GDPR it needs extra care, and in the US the FTC's COPPA Rule covers personal information collected from children under 13 by sites and services aimed at them, or that know they collect it (FTC: Complying with COPPA);
• a substantial part of an EU database, or copyrighted content you plan to republish wholesale.

Five kinds of data, from the lowest risk to the highest:

The regulators' 2023 joint statement adds the site's side: "Mass data scraping of personal information can constitute a reportable data breach in many jurisdictions", which is why large sites watch for it.

Is it legal to scrape public data in general? The full legal answer, including publicly available data, is in is web scraping legal.

Before you scrape: four questions, in order

You are, in almost every case, not your proxy provider or your scraping tool: the "Joint statement on data scraping and the protection of privacy" of August 24, 2023, signed by 12 data protection regulators, says "Individuals and companies that scrape such personal information are therefore responsible" for complying with data protection law, even when the data is publicly accessible. Its signers include the UK's ICO and the regulators of Australia, Canada, Switzerland, Norway and New Zealand. Whoever decides what to collect, how and why is the "controller" under the GDPR and the UK GDPR (Article 4(7)), and answers for it. A proxy provider or a tool maker shares the responsibility only in narrower cases.

Three setups, and who is responsible in each:

Each party, with the rule and its source:

A provider's part in practice, using ProxyField as the example: we keep connection metadata for up to 30 days, trace every abuse report to the account that used the IP, and report illegal activity to the competent authorities where the law requires it. What you collect and what you do with it stays your responsibility under the law and the site's terms.

Residential proxy providers ban spam, attacks, fraud, access to data behind logins, infringement and illegal use in every policy we read; most also ban malware, unapproved reselling and ticket bots, and some add gambling, in-game item trading, crypto or NFT trading, streaming sites, reward surveys and posting to classifieds.

We read the acceptable use policies of three large residential proxy providers on October 28, 2026 (their own pages give last updates of June 2024, June 2025 and June 2026). The middle column counts how many of the three ban each use; the right column is ProxyField's rule. ProxyField's rule for every site is public pages only, and follow the site's terms.

Two of the three say their list is not complete, and the narrower bans differ most from provider to provider, so read the policy before you buy.

How to check a provider's acceptable use policy

1. A written list of banned uses, not only "lawful use".
2. An enforcement process with steps and response times. ProxyField's: we acknowledge every abuse report within 1 business day, trace the IP and time to the account, give the account owner 48 hours to reply and decide, usually within 3 business days.
3. Site-category restrictions, stated in the policy.
4. A reseller rule: who may resell, and whether resellers are verified (ProxyField verifies every reseller).
5. An abuse report channel with the details to send: date, time and time zone, source IP, target and logs.
6. Verification when an account shows signs of abuse, and no promises of anonymity.

ProxyField's policy. You may use ProxyField for collecting public web data, price and SEO monitoring, ad verification, testing, market research, managing your own or your clients' social media and marketplace accounts (one IP per account), and similar lawful work. You may not use it to send spam or open mail ports, spread malware, attack systems (DDoS, password guessing, scanning without permission), commit fraud (including phishing, ad and click fraud, fake accounts or engagement), access data behind logins you are not entitled to, infringe intellectual property or break the law. Spam tools such as GSA Search Engine Ranker, and ScrapeBox used for spam, are not allowed. Some site categories are restricted to protect the network, including financial and government services. Reselling is allowed only through our reseller program.

Enforcement. Confirmed abuse leads to a warning, limits on traffic or targets, suspension or closure of the account; serious cases (malware, fraud, attacks, material exploiting children) are closed at once, and accounts closed for abuse lose their remaining traffic. The full text: ProxyField acceptable use policy.

Web scraping is not illegal in itself in the US, the EU or the UK; the law limits how you get data and what you do with it.

• US. In Van Buren v. United States (2021), the Supreme Court read the Computer Fraud and Abuse Act as a "gates-up-or-down" question: are you entering parts of a system that are off limits to you? In hiQ Labs v. LinkedIn (2022), the Ninth Circuit found that scraping profiles anyone can view without logging in is likely not access "without authorization". Contract claims are separate: the district court later found hiQ had breached LinkedIn's User Agreement (November 2022), and the parties settled.
• EU. The GDPR governs personal data, and the Database Directive protects databases built with substantial investment. Country by country: web scraping law in the UK and EU.
• UK. The Computer Misuse Act 1990 makes unauthorized access a crime, and the ICO signed the 2023 joint statement with 11 other regulators: public personal data is still protected.

The cases that changed the answer in 2024–2026 are in web scraping legal news.

A proxy is a lawful network tool in the US, the EU and the UK; what you do through it decides whether it is legal. Fraud, unauthorized access and spam stay illegal when they run through a proxy. Businesses use residential proxies for price monitoring, SEO and SERP monitoring and ad verification. More: are proxies legal and are residential proxies legal.

In March 2026, the FBI warned that residential proxy networks route traffic through home devices, often without their owners' knowledge, and that criminals use them to hide their identity and location. The alert, "Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals" (I-031226-PSA, March 12, 2026; IC3 copy), names TV streaming devices, streaming sticks, Android TV boxes, digital picture frames, smartphones, tablets, routers, digital projectors and aftermarket vehicle infotainment systems. Its advice includes: avoid streaming devices that promise free content, keep software updated, keep unauthorized devices off business networks, and report compromise to the FBI's Internet Crime Complaint Center (IC3).

Earlier enforcement:

• 2022: the DOJ disrupted RSOCKS, a Russian botnet that sold hijacked devices as proxies (DOJ release).
• May 2024: the DOJ dismantled 911 S5, a botnet-based residential proxy service, and arrested its operator (DOJ release; FBI/IC3 PSA of May 29, 2024).
• March 12, 2026: an FBI FLASH described routers infected with AVrecon malware and sold as residential proxies by SocksEscort, after a joint takedown of that service (FBI FLASH).

Check any provider against the acceptable use checklist above. ProxyField: no identity verification for ordinary purchases, including crypto; we may ask for it if an account shows signs of abuse, and we verify every reseller.

robots.txt is a voluntary standard, not a law; terms of service you accept can bind you as a contract. RFC 9309 (2022) defines robots.txt and states that its rules are not a form of access authorization. Breaking terms you agreed to, for example by creating an account, can mean a contract claim and a closed account. The practice: ethical web scraping.

Public personal data is still personal data: in the EU and the UK, scraping it needs a lawful basis and data minimization (EDPB). The French regulator's focus sheet sets out the safeguards it expects when scraping relies on legitimate interest.

AI training adds copyright:

• US. The Copyright Office's report on generative AI training (Part 3) treats training on copyrighted works as a case-by-case fair-use question.
• EU. The AI Act, Regulation (EU) 2024/1689, requires providers of general-purpose AI models to have a policy for complying with EU copyright law, including text-and-data-mining opt-outs.

More: is AI scraping legal.

Most large platforms ban automated collection without permission, and several offer an official API instead. Terms decide what you agreed to; the laws above decide what is a crime. Summaries written October 2026; the linked terms are the authority.

Paid proxies from an accountable provider are generally safe for work traffic; free and open proxies are the risky kind. With HTTPS, page content stays encrypted between you and the site, but the proxy operator still sees which hosts you connect to, when, and how much data moves. Free and open proxies may log traffic, alter unencrypted pages or run on hijacked devices.

A proxy does not make you anonymous. The site sees the proxy's IP, but the provider knows which account sent the traffic, and courts and police can obtain records through legal process. In the EU, the Court of Justice held in Breyer (C-582/14, 2016) that a dynamic IP address can be personal data when a site operator has legal means to identify the user through the internet provider.

ProxyField's line on data: we don't record the content of your traffic or the pages you visit. We keep only the service data we need to count your traffic, keep the network running and handle abuse reports; connection metadata is kept for up to 30 days. More: are proxies safe and are free proxies safe.

Each guide with its one-line answer.

• Is web scraping legal? Generally yes for public data.
• Web scraping law in the UK and EU: the GDPR, the database right and the Computer Misuse Act, country by country.
• Web scraping legal news: the 2024–2026 cases that change the answer.
• How to check if scraping is allowed: robots.txt, terms, official API.
• Ethical web scraping: public data, a low request rate, care with personal data.
• Is AI scraping legal? It can be; copyright and data-protection rules apply.
• Is scraping Amazon legal? Its terms restrict automated collection.
• Is scraping Google legal? Google's policies restrict automated queries.
• Is scraping TikTok legal? Its terms bar automated scripts.
• Is scraping social media legal? Platform terms and data-protection law apply.
• Is scraping e-commerce sites legal? Product data is lower risk; terms set limits.
• Are proxies legal? Generally yes; the use decides legality.
• Are residential proxies legal? Generally yes; networks built from hijacked devices are criminal.
• Are proxies safe? From an accountable provider, generally yes.
• Are free proxies safe? Usually not: they can log or alter traffic.

1. ProxyField provides infrastructure for permitted business work with public data: public pages only, and follow the site's terms.
2. What is allowed and forbidden: the acceptable use policy (summary above).
3. No identity verification for ordinary purchases, including crypto; we may ask for it if an account shows signs of abuse, and we verify every reseller.
4. Report abuse through [email protected]; include the date, time and time zone, the source IP, the target and any logs you have.

All our policies are in the Trust Center. This is not legal advice.