A plain-English guide to the rules around scraping — what courts have actually decided, what's clearly safe, what's risky, and how to stay on the right side of the line.
Scraping publicly available data — information any visitor can see without logging in — is generally legal in the United States. Scraping data behind a login, ignoring explicit legal notices, or collecting personal data without a lawful basis is where businesses get into trouble.
This article is a practical guide, not legal advice. For a specific project with real money on the line, talk to an attorney. But after 1000+ scraping projects for US clients, I can tell you where the lines usually sit.
This is the case everyone cites. hiQ scraped public LinkedIn profiles; LinkedIn tried to block them under the Computer Fraud and Abuse Act (CFAA), the US anti-hacking law.
The courts sided largely with hiQ: scraping data that is publicly visible without authentication does not count as "unauthorized access" under the CFAA. You cannot hack into something that has no lock on it.
The Supreme Court narrowed the CFAA further, holding that the law targets people who access areas of a system they are not entitled to enter — not people who misuse data they were allowed to see.
The practical takeaway: no login wall, no CFAA problem in most cases.
The moment you create an account, accept Terms of Service, and then scrape, you have entered a contract and may be breaching it. This shifts the analysis from "hacking law" to "contract law" — and contract claims are much easier to win.
Names, emails, phone numbers, and addresses of individuals are regulated by GDPR (if any EU residents are involved), CCPA/CPRA (California), and a growing list of US state laws. Business contact data is treated more leniently than consumer data, but "publicly available" does not automatically mean "free to process however you like."
Facts are not copyrightable. Prices, addresses, ratings, specifications — these are facts. But republishing whole articles, photos, or creative descriptions verbatim is a copyright issue regardless of how you obtained them.
Hammering a site with thousands of requests per second can cause real damage, and damage is what turns a civil dispute into something worse. Responsible scrapers rate-limit.
eCommerce price monitoring — Very well established. Competitor prices are public facts. Low risk.
Google Maps / business directory leads — Business names, phones and addresses are business data, not consumer data. Common practice, moderate risk, and outreach must still follow CAN-SPAM and TCPA rules.
Real estate listings — Public listing data is widely scraped. Photos and agent-written descriptions are the copyrighted parts; stick to the facts.
Auction and wholesale platforms — Almost always behind a login. This is the one area where you genuinely need your own credentials and, ideally, permission. Many dealers scrape platforms they personally pay for, which is a very different posture from scraping someone else's account.
Social media — Highest risk category. Aggressive Terms of Service, heavy personal data, active enforcement.
Every project I take on starts with three questions:
1. Is this data publicly accessible without a login? If not, do you have your own authorized account?
2. Does the data include personal information about individuals, or only businesses?
3. What will the data actually be used for?
If the answers point somewhere uncomfortable, I say so before we start rather than after. A scraper that gets you sued is not a good scraper, no matter how clean the output.
Describe what you want to collect and what you plan to do with it. I will tell you honestly whether it is a straightforward build, whether it needs care, or whether you should not do it at all.
Contact me at sam@autosmartcode.com for a free assessment within 24 hours.