How does GDPR apply to scraping?

ProxyField sells proxies from $1.95/GB for public-data work, and the GDPR question is about the data you collect, not the tool: as of October 2026, the GDPR applies to the personal data you scrape, not to scraping itself. As soon as you collect names, profiles, contact details or photos, you need a lawful basis (usually legitimate interests), must collect only what your purpose needs and must meet the information duties of Article 14. Public availability does not take data outside the GDPR.

Is web scraping GDPR compliant?

It can be. Scraping that collects no personal data raises no GDPR issue; scraping that does is compliant when it has a lawful basis, a defined purpose, minimal fields, a retention limit and a way for people to object. The EDPB's 2026 guidelines add that scrapers should exclude sites that clearly oppose scraping, for example through robots.txt or CAPTCHAs.

How do I collect web data in compliance with GDPR?

Define the purpose and fields first, document a legitimate-interests assessment, drop personal data you do not need at collection time, filter out special categories, skip sites and areas that object or require a login, and delete or pseudonymize data once you no longer need it. For large-scale collection about people, run a data protection impact assessment.

Web Scraping GDPR: UK and EU Rules, Contracts, Databases

What you scrape	Main rule in the EU and UK	Risk
Prices, stock, product specs, public statistics	Contract terms you accepted; database right for wholesale copying	Lower
Names, profiles, contact details, photos, reviews with names	GDPR / UK GDPR: lawful basis, minimization, information duties	Higher
Health, political views, religion, sexuality and other special categories	GDPR Article 9: prohibited unless an exception applies	Highest
A substantial part of one site's database, or repeated small parts of it	Database Directive 96/9/EC; UK database right (SI 1997/3032)	Higher
Articles, images, text for AI training	Copyright and the text-and-data-mining rules	Depends on opt-outs and purpose
Pages behind a login or after a block	Computer-crime law and the terms you accepted	Highest

The GDPR does not ban scraping; it governs personal data, whatever its source. Regulation (EU) 2016/679 applies to any processing of personal data, and collecting, storing and organizing scraped data are processing. The UK keeps the same rules as the UK GDPR, as amended by the Data (Use and Access) Act 2025, alongside the Data Protection Act 2018.

If your scraper collects no personal data, the GDPR is not the rule that limits you. If it does, five obligations follow:

A lawful basis

Under Article 6. For private companies it is usually legitimate interests, Article 6(1)(f).
Purpose limitation and data minimization

Decide in advance what you collect and why, and collect nothing else.
Transparency

Article 14 requires you to inform people whose data you did not get from them, unless that proves impossible or would need disproportionate effort (Article 14(5)(b)).
Special categories

Article 9 prohibits processing health, political, religious and similar data unless an exception applies.
Accuracy, security and rights

People can object, ask for access and ask for deletion.

The US and general picture is in is web scraping legal.

Sources GDPR; EDPB, basic principles.

Is web scraping legal in the UK?

Yes, scraping public pages is legal in the UK; four rules decide what you may collect and how, and breaching a site's terms is a civil matter, not a crime.

UK rule	Instrument	What it means for a scraper
Personal data	UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025; ICO guidance on lawfulness, fairness and transparency	Public personal data is still covered: lawful basis, fairness, minimization
Database right	Copyright and Rights in Databases Regulations 1997 (SI 1997/3032), Part III	Extracting or re-utilising "all or a substantial part" without consent infringes (reg. 16(1)); so can "the repeated and systematic extraction or re-utilisation of insubstantial parts" (reg. 16(2))
Copyright	Copyright, Designs and Patents Act 1988	Articles, photos and text are protected; text and data mining is allowed only for non-commercial research (s. 29A)
Unauthorised access	Computer Misuse Act 1990, s. 1	A crime to access computer material you know you are not authorised to access, such as an account or area behind a login you have no right to use
Website terms	Contract law; for consumers, the Consumer Rights Act 2015, Part 2	Bind you only if they became a contract with you; consumer terms must also be fair

Breaching a website's terms in the UK

Website terms bind you when they became a contract: the clearer your acceptance, such as ticking "I accept" or creating an account, the stronger the site's claim; terms in a footer link you never opened are weaker (logic from contract formation, not a statute). A breach is not a criminal offence. What a site can do:

Block

Your IPs or close your account.
Send a cease-and-desist letter

Demanding that you stop.
Claim damages

For breach of contract, often together with database right or copyright.
Ask the court for an injunction

Ordering you to stop.

The criminal risk starts only when you get past a login or another access control you are not authorised to pass (Computer Misuse Act 1990, s. 1). Terms come up in UK litigation: in On The Beach Ltd v Ryanair UK Ltd [2023] EWHC 2694 (Comm), a package-travel dispute decided on October 31, 2023, Ryanair relied on Website Terms of Use that apply once a user clicks "I accept" and permit access only "for private non-commercial purposes" (paras 61–62); the judgment turned on other issues and did not decide the terms point. What to do when terms forbid scraping: is web scraping legal.

The EDPB's 2026 guidelines on web scraping

In July 2026, the European Data Protection Board published Guidelines 03/2026 on web scraping in the context of generative AI for public consultation (dated July 8, 2026 on the EDPB site; consultation ongoing in October 2026). They are written for private companies that scrape, or have others scrape, data to train generative AI, but their reading of the GDPR is the most detailed regulator text on scraping so far.

Legitimate interests needs three conditions: a legitimate interest, the necessity of the processing for it, and a balancing test in which people's rights do not override that interest.
Minimization before collection: precise collection criteria, filters for certain categories of data, and excluding websites that clearly oppose scraping through technical measures, which the guidelines list as login requirements, robots.txt or ai.txt files and CAPTCHAs.
Mitigating measures for the balancing test include limiting collection to freely accessible data, excluding certain sources by default, and deleting, anonymizing or pseudonymizing personal data as soon as possible.
Transparency: depending on the design, individual notices may not be needed where informing people is impossible or would take disproportionate effort.
Special categories: a derogation under Article 9(2) is needed in addition to a lawful basis.

They build on the EDPB's Opinion 28/2024 on AI models, adopted December 17, 2024, and on national guidance such as the CNIL's focus sheet on web scraping.

These steps follow from the GDPR text and the EDPB and CNIL guidance above:

Write down the purpose and the fields before the first request, and record your legitimate-interests assessment.
Leave out personal data you do not need. For price and catalog monitoring, drop seller names, reviewer profiles and contact details at collection time.
Exclude sources that object: sites whose robots.txt or terms refuse scraping, and areas behind logins.
Filter special categories and data about children out of the stream.
Keep it only as long as you need it, and pseudonymize or delete it after that.
Answer requests: a contact for objections, access and deletion.
Run a data protection impact assessment for large-scale collection about people.

Enforcement: fines and decisions on scraping

Regulators have fined companies that scraped personal data without a lawful basis, and closed cases where no personal data was processed.

Netherlands, 2024. The Dutch authority fined Clearview AI €30,500,000 for building a facial-recognition database from scraped photos (decision of May 16, 2024, announced September 3, 2024), citing among others Articles 6, 9 and 12 of the GDPR (EDPB news).
France. The CNIL fined a company €240,000 whose browser extension collected the contact details of people whose profiles its customers visited on a professional social network; the findings included the lack of a lawful basis (EDPB news).
Spain, 2025. The AEPD closed a complaint about a tool that scanned public social media posts by keyword and showed their sentiment as a chart, because processing of personal data was not proven: the demonstration showed only aggregated information, with no reference to identified or identifiable people (AEPD legal criteria, published November 25, 2025).
UK and 11 other regulators, 2023. The ICO and its peers said in a joint statement that publicly accessible personal information is still covered by data protection law, and asked platforms to protect it against unlawful scraping.

The database right: prices, listings and catalogs

The EU's Database Directive 96/9/EC gives the maker of a database a sui generis right to prevent the extraction or reuse of all or a substantial part of its contents, where obtaining, verifying or presenting them took substantial investment. Repeated and systematic extraction of insubstantial parts counts too when it conflicts with normal use of the database or unreasonably harms the maker. The right lasts 15 years.

In British Horseracing Board v William Hill (C-203/02), November 9, 2004, the Court of Justice held that the protected investment is in obtaining, verifying and presenting existing materials, not in creating the data, and that taking a substantial part needs permission even when the database is public.
In CV-Online Latvia v Melons (C-762/19), June 3, 2021, the Court held that a search engine copying and indexing a job-ad database extracts and reuses it, but that this is prohibited only where it adversely affects the maker's investment.

For price monitoring, this means: tracking the prices of 200 products you compete on is a different act from copying a retailer's whole catalog, or re-collecting it piece by piece every day. The UK kept its own database right after Brexit (GOV.UK guidance).

Contracts in the EU

In Ryanair v PR Aviation (C-30/14), January 15, 2015, the Court of Justice held that the Database Directive does not stop a site from limiting, by contract and subject to national law, the use of a database that neither copyright nor the database right protects. So for public, non-personal data, terms you accepted can matter as much as the database right. In both the EU and the UK, scraping logged in is where contract risk concentrates, because creating the account is where you accepted the terms.

Copyright and text and data mining

The EU's Directive (EU) 2019/790 allows text and data mining by research organizations (Article 3) and by anyone else (Article 4), but under Article 4 rightholders can reserve their works, for online content "in a machine-readable manner". The UK allows text and data mining only for non-commercial research, under section 29A of the Copyright, Designs and Patents Act 1988. AI training is covered in is AI scraping legal.

Germany: the database right and other rules

Scraping public, non-personal pages is lawful in Germany within five rules of national law, on top of the GDPR:

Rule	Section	What it says
What a database is	§ 87a UrhG	A collection of independent elements, arranged systematically and individually accessible, whose obtaining, verification or presentation needed a substantial investment; the maker is whoever made that investment
What the maker can stop	§ 87b UrhG	Copying, distributing or publicly reproducing the database or a substantial part of it; repeated and systematic copying of insubstantial parts counts the same where it conflicts with normal use or unreasonably harms the maker (para. 1, sentence 2)
How long	§ 87d UrhG	15 years from publication (or from creation, if unpublished)
Text and data mining	§ 44b UrhG	Copies of lawfully accessible works for automated analysis are allowed, unless the rightholder reserves them; online, the reservation counts only "in maschinenlesbarer Form" (machine-readable)
Access protection	§ 202a StGB	Overcoming access protection to obtain data not meant for you is the offense of data espionage
Unfair competition	§ 4 UWG	Protects competitors, for example against targeted obstruction and against imitating their products

For a price monitor this means: sample the products you compete on, check robots.txt and similar machine-readable reservations (how to check if a website allows scraping), and never mirror a shop's catalog or log in to areas you have no right to.

Spain: public prices and the law

Collecting public prices is lawful in Spain; prices are not personal data, so the GDPR and Spain's Organic Law 3/2018 on data protection (LOPDGDD) apply only if you also take names of sellers, reviewers or other people. Four national rules set the limits:

Rule	Spanish law	What it means for price scraping
Database right	Intellectual Property Law (Royal Legislative Decree 1/1996), Book II, Title VIII, Articles 133–137	A retailer's catalog can be a protected database: no substantial extraction, and no repeated small extractions that conflict with its normal use
Unauthorized access	Criminal Code, Article 197 bis	Accessing an information system by breaking its security measures without authorization is an offense
Unfair competition	Unfair Competition Act (Law 3/1991)	Misleading use of the data, or conduct that unfairly harms a competitor, can be challenged
Personal data	GDPR and LOPDGDD, overseen by the AEPD	Applies only to data about people; the AEPD closed a 2025 case where a tool showed only aggregated results

Example: tracking the prices of 200 competing products once a day is ordinary monitoring; copying a retailer's full catalog with its descriptions and photos is where the database right and copyright risk lies. Store terms and product data in more detail: is scraping e-commerce sites legal; the job itself: price monitoring proxies.

Switzerland

Switzerland is outside the EU but has similar rules. The revised Federal Act on Data Protection (in force since September 1, 2023) governs personal data, and the Unfair Competition Act, Article 5(c), makes it unfair to take over and exploit another's market-ready work product by technical reproduction without an appropriate effort of your own. A business that copies a competitor's whole dataset to resell it runs that risk; reading public prices for comparison is a different act.

Country by country

The EU rules above apply in every member state; national law adds to them.

Country	Regulator	National points
United Kingdom	ICO	UK GDPR (as amended by the Data (Use and Access) Act 2025), Data Protection Act 2018, Computer Misuse Act 1990 s. 1, database right in SI 1997/3032 Part III (reg. 16), CDPA 1988 s. 29A
Germany	Federal and state data protection authorities	Database right in §§ 87a–87e UrhG (15 years, § 87d); text and data mining opt-out in § 44b UrhG; data espionage in § 202a StGB; § 4 UWG
Spain	AEPD	LOPDGDD (Organic Law 3/2018); database right in Articles 133–137 of the Intellectual Property Law; Criminal Code Article 197 bis; Unfair Competition Act (Law 3/1991)
France	CNIL	Focus sheet on web scraping under legitimate interests; the €240,000 browser-extension fine
Netherlands	Autoriteit Persoonsgegevens	The €30.5M Clearview decision (2024)
Italy	Garante	GDPR and the Database Directive's sui generis right as transposed into Italian copyright law; the CV-Online test (C-762/19) for price scraping
Poland	UODO	GDPR and the Database Directive's sui generis right as transposed into Polish law; the GDPR applies only to sellers' or reviewers' data
Switzerland	FDPIC	FADP and the Unfair Competition Act, Article 5(c)

The infrastructure for lawful collection across Europe: proxies for web scraping and Europe locations.

Web Scraping Law in the UK and EU FAQ

Is web scraping legal in the UK, and what about breaching a website's terms?

Scraping public pages is legal in the UK, within the UK GDPR for personal data, the database right (SI 1997/3032, which also covers repeated small extractions) and copyright. Breaching a site's terms is a civil matter: if the terms became a contract, for example when you clicked "I accept" or created an account, the site can block you, send a cease-and-desist letter, claim damages or seek an injunction. It becomes a crime only when you get past a login or other access control you are not authorised to pass, under section 1 of the Computer Misuse Act 1990.

Does the Computer Misuse Act apply to web scraping?

Only to access you know is unauthorised: section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to give you access to material you are not authorised to access. Reading public pages that anyone can open is not that; using someone else's login, or getting into an area closed to you, is.

What is the database right in the UK?

A right of the maker of a database, under Part III of the Copyright and Rights in Databases Regulations 1997, to stop anyone extracting or re-utilising all or a substantial part of its contents without consent. Regulation 16(2) adds that repeated and systematic extraction of insubstantial parts can count as a substantial part, so re-collecting a whole site in small pieces is the risk, not checking a few prices.

Is web scraping legal in the EU?

Yes, scraping public pages is legal in the EU, within four limits: the GDPR for personal data, the database right for substantial parts of databases, copyright for protected content, and contract terms you accepted. National computer-crime laws add a fifth for getting past logins or other access protection.

Is web scraping legal in Switzerland for businesses?

Generally yes, for public data. The revised Federal Act on Data Protection, in force since September 1, 2023, governs personal data, and Article 5(c) of the Unfair Competition Act makes it unfair to take over another company's market-ready work product by technical reproduction without your own appropriate effort. Reading competitors' public prices is lower risk than copying and reselling their dataset.

Is web scraping legal in Germany, and what does the database right mean for it?

Scraping public, non-personal pages is lawful in Germany if you respect personal data, copyright, terms you accepted and access protection. The database right protects a collection of independent elements, arranged systematically, whose obtaining, verification or presentation needed a substantial investment (§ 87a UrhG); for 15 years (§ 87d) the maker can stop copying of a substantial part, or repeated and systematic copying of small parts (§ 87b). So monitor selected prices rather than mirroring a catalog, respect machine-readable text-and-data-mining reservations (§ 44b), and never overcome access protection, an offense under § 202a StGB.

Is web scraping legal in France for competitor price monitoring?

Yes. Prices are not personal data, so the CNIL's scraping guidance matters only if you also collect data about people, such as seller names. The limits for prices are the EU database right, if you take a substantial part of one retailer's database, and terms you accepted on a site.

Show 4 more questionsShow fewer questions

Is scraping prices from Italian e-commerce sites legal under EU database rights?

Usually, yes. The database right protects a substantial investment in a database against extraction of all or a substantial part of it; the Court of Justice held in CV-Online (C-762/19, 2021) that extraction is prohibited only where it adversely affects that investment. Tracking the prices of the products you compete on is a different act from copying a shop's entire catalog.

Is it legal to collect public web data in the Netherlands for market research?

Yes, for non-personal data such as prices, products and public statistics. The Dutch data protection authority is strict on personal data: it fined Clearview AI €30.5 million in 2024 for a database built from scraped photos. For market research that touches people, rely on aggregated or anonymized data where you can.

Is web scraping legal in Spain for collecting public prices?

Yes. Public prices are not personal data, so the GDPR and Spain's LOPDGDD (Organic Law 3/2018) apply only if you also take sellers' or reviewers' names. The limits are the database right in Articles 133–137 of the Intellectual Property Law (no substantial or repeated systematic extraction from one retailer's database), Article 197 bis of the Criminal Code against breaking security measures, and the Unfair Competition Act (Law 3/1991).

Is web scraping legal in Poland for e-commerce price monitoring?

Yes, under the same EU-wide rules: price monitoring is lawful when you collect public product data, respect terms you accepted and do not take a substantial part of one shop's database. If you also collect sellers' or reviewers' personal data, the GDPR applies and the UODO is the regulator.

Sources

This is not legal advice. Laws and court decisions change, and the primary sources linked on this page are the authority.

Web Scraping Law in the UK and EU

Web scraping and the GDPR: the short answer

A lawful basis

Purpose limitation and data minimization

Transparency

Special categories

Accuracy, security and rights