ON THIS PAGE
By Efe Berke Colaker, Founder at GetleadReviewed by the Getlead editorial team for accuracy. Last updated August 2026.
Scraping legality is argued as a single yes or no and it is three questions stacked on top of each other. Answering them separately makes the risk legible.
This is not legal advice. It is the operational shape of the problem, and where teams actually get into trouble.
The three questions
Public data is content a server returns to any visitor without authentication, which is the distinction courts have leaned on rather than whether the site owner objects.
For example, a company directory page visible to anyone is a different legal object from the same information behind a signed in feed, even when the underlying facts are identical.
What the cases actually settled
The Ninth Circuit's hiQ decision treated access to publicly available data as not unauthorised under the CFAA, which removed the criminal shaped risk from public scraping. The same case then turned on contract, where hiQ was found to have breached LinkedIn's user agreement.
The 2024 Meta v Bright Data decision sharpened it further, declining to find breach for scraping public logged out pages, on the reasoning that platform terms bind account holders rather than anonymous visitors.
The working rule that emerges is narrow and useful: logged out public scraping is defensible, logged in scraping against terms you accepted is a contract exposure, and neither answers the personal data question.
Where the real weight sits
Publicness does not remove personal data obligations. A work email on a public page is still personal data in the EU and UK, and collecting it puts you in scope.
Personal data is any information relating to an identified or identifiable person, which includes a named individual's work email even when it sits on a public page.
Two duties matter in practice. You need a lawful basis, usually legitimate interest for B2B, and you need to be able to tell the person where their data came from, which Article 14 requires when it was not collected from them directly.
That is why provenance per record is the practical control. Without it, compliance is a story rather than a record, and the data quality is usually poor too: in our verification 23.9% of raw records are invalid outright.
Practical rules that keep you out of trouble
- Do not log in to scrape. It converts a defensible activity into a contract question.
- Respect robots and rate limits. Aggressive crawling is what turns a tolerated activity into a dispute.
- Store provenance per record, including the source URL and the date.
- Prefer facts to content. Firmographics are safer ground than copying written material.
- Verify before sending, since scraped addresses carry the highest invalid rates.
The first rule removes most exposure on its own, and the last one is where scraping and deliverability meet: an unverified scraped file is the classic route to a burned sending domain.
Provenance is the per record note of where a value came from and when, and for scraped data it is the difference between a defensible file and an unexplainable one. For example, storing the source URL and collection date alongside each contact turns a later question into a lookup.
Sources and method
First-party data (Getlead, 2026): the verification split of 43.4% confirmed valid, 23.9% invalid, 16.7% catch-all and 16.0% unknown comes from 383,368 addresses analyzed through live SMTP verification, and the 0.51% bounce rate comes from 34,973 tracked sends, aggregated and anonymized at campaign level. Full method in our cold email benchmark study.
External sources: the Ninth Circuit ruling in hiQ v LinkedIn on public data and the CFAA, the subsequent contract finding, and the 2024 Meta v Bright Data decision on logged out scraping are summarised in 2026 legal reviews of the field; obligations when personal data is obtained from a third party are set out in Article 14 of the GDPR; US commercial email rules come from the FTC CAN-SPAM compliance guide.
This is operational guidance rather than legal advice, and the law differs by jurisdiction and changes. Checked in August 2026.
Frequently asked questions
Is web scraping legal for B2B data?
Scraping publicly available, non personal business data is broadly defensible. The risk concentrates in three places: data behind a login, access against terms you accepted, and personal data obligations under the GDPR or similar laws.
What did the hiQ v LinkedIn case decide?
The Ninth Circuit treated access to publicly available data as not unauthorised under the CFAA, which removed the criminal shaped risk. hiQ then lost on contract grounds for breaching LinkedIn's user agreement, and the case ended in a consent judgment.
Does breaching terms of service make scraping illegal?
It is a civil matter rather than a criminal one. Terms breach is grounds for being blocked and for a lawsuit, and it was what ultimately decided the most famous scraping case, so it is a real exposure rather than a technicality.
Does public data escape GDPR?
No. A work email visible on a public page is still personal data in the EU and UK. You need a lawful basis, usually legitimate interest for B2B, and you must be able to say where the data came from under Article 14.
What is the single most protective rule?
Do not log in to scrape. Logged out access to public pages is the defensible position, while scraping from an account you registered converts the question into a contract dispute you are likely to lose.
Why does verification matter for scraped data?
Because scraped files carry the highest invalid rates. In our verification of raw B2B records, 23.9% were invalid and 16.7% catch-all, and sending to that produces the bounce pattern that gets sending domains blocklisted.