Is web scraping legal in the UK?

Short answer

Collecting public facts such as prices, product details and tender notices, from public pages, at a gentle pace, is common and usually low risk. The risk goes up when you:

collect personal data, such as names, emails or profiles
go behind a login or get round blocks and CAPTCHAs
break terms you have agreed to, for example by having an account
copy a substantial part of a database, or creative content like articles and photos
send so many requests that you affect the site

This guide is general information, not legal advice. For anything commercially important or borderline, speak to a solicitor.

1. Contract: the website's terms

Most sites have terms of use, and many forbid automated collection. How much those terms bite depends on whether you actually agreed to them. Terms you click to accept, for example when creating an account, are much easier to enforce than a link in a footer you never read.

Two cases show why terms matter. In Ryanair v PR Aviation (2015), the EU's top court held that where data isn't protected by copyright or database right, the site owner can still restrict its use through contract terms. Because it was decided before Brexit, it still carries weight in UK courts. In the US, hiQ Labs famously won the argument that scraping public LinkedIn profiles wasn't hacking, then lost on breach of LinkedIn's user agreement in 2022 and agreed to stop scraping and delete the data.

The lesson: being right about one law doesn't help if you've agreed to terms that forbid what you are doing.

2. The Computer Misuse Act 1990

The Act makes unauthorised access to computer material a criminal offence. Reading public pages that anyone can open is very unlikely to count. Risk appears when you:

log in with fake accounts or someone else's credentials
get round technical blocks, CAPTCHAs or IP bans put there to stop you
send enough traffic to slow down or break the site

There is little UK case law on scraping under this Act, which is a reason for caution rather than comfort.

3. Database right

The UK has a separate right protecting databases where someone made a substantial investment in obtaining, checking or presenting the contents. It lasts 15 years from completion and is renewed when the database is substantially updated. Extracting a substantial part of a protected database, or repeatedly taking small parts in a way that adds up to the same thing, can infringe it.

In practice: pulling a few hundred prices to compare against your own is very different from copying a directory or listings site wholesale to run a rival service.

4. Copyright

Facts are not protected by copyright. A price, a product code or a tender deadline is a fact. The words and photos around them usually are: product descriptions, articles, reviews and images.

UK law has a text and data mining exception in section 29A of the Copyright, Designs and Patents Act, but it only covers non-commercial research. The government consulted on a much broader exception for AI, and in March 2026 decided not to introduce one. So for commercial use, collecting facts is generally fine, but copying and republishing someone else's content needs a licence.

This is where most real-world risk sits. Personal data that is publicly visible is still personal data. If you scrape names, email addresses, photos or profiles, UK GDPR applies in full: you need a lawful basis, you must tell people you hold their data, and you should collect only what you need.

In August 2023 the ICO and 11 other privacy regulators issued a joint statement stressing that public personal data is still protected and that mass scraping can be a reportable data breach for the site it was taken from.
The ICO's view after its generative AI consultation is that legitimate interests is the realistic lawful basis for scraping personal data, and that relying on it means passing a three-part test of purpose, necessity and balance, documented in advance.
The ICO fined Clearview AI £7.5 million in 2022 for scraping photos of people in the UK. In October 2025 the Upper Tribunal confirmed the ICO had jurisdiction even though Clearview is based abroad.

6. Marketing: PECR

If the plan is to email people you found by scraping, the Privacy and Electronic Communications Regulations apply alongside UK GDPR. You can send marketing emails to limited companies and LLPs without prior consent, as long as you identify yourself and offer an easy opt-out. Sole traders and ordinary partnerships are treated like individuals, so you generally need their consent first. Scraped lists rarely tell you which is which, which is why scraped email lists are one of the riskiest uses.

A traffic light guide

Risk	Examples
Lower	Competitor prices and stock from public product pages. Public tender and planning notices. Government and open data. Supplier catalogues with the supplier's agreement.
Take care	Sites whose terms forbid scraping. Listings and directory sites built on heavy investment. Pages that include business contacts' names. Collecting descriptions or photos rather than facts.
Higher	Anything behind a login. Social media profiles of individuals. Getting round blocks or CAPTCHAs. Copying articles or images to republish. Building marketing lists of people.

Good practice that keeps you on the right side

Look for an API or a licence first. Many sources offer one, and it removes most of the risk.
Read the terms and robots.txt. If they forbid automated access, assume that matters.
Stay on public pages. No logins, no fake accounts, no getting round blocks.
Be gentle. Limit your request rate, run outside the site's busy hours and identify your bot with contact details.
Collect facts, not content. Take what you need, and don't republish other people's words or photos.
Avoid personal data, or document a legitimate interests assessment and tell people you hold it.
Keep a record of what you collect, why, and the checks you made.
Stop when asked. If a site owner objects, pause and take advice.

How we handle it

Our data feeds follow the rules above as standard: public data only, gentle collection, no personal data without a lawful basis, and we tell you when a source is off limits. Where something is borderline, we'll say so before we build it.

Questions

Is it legal to scrape competitor prices in the UK?

Usually this is the lowest-risk kind of scraping. Prices and product facts are not protected by copyright, and there is no personal data involved. Check the site's terms, stay on public pages, and keep your request rate low so you don't affect the site.

Is robots.txt legally binding?

Not by itself. It is an instruction to automated visitors rather than a law. Ignoring it can still count against you, because it shows you knew the owner didn't want automated access, and it may be referred to in the site's terms. Respect it.

Can I scrape LinkedIn?

We advise against it. LinkedIn's user agreement prohibits scraping, profiles are personal data under UK GDPR, and LinkedIn has enforced its terms in court. Use LinkedIn's own tools or a licensed data provider instead.

Can I scrape email addresses for marketing?

This is high risk. You need a lawful basis to collect personal data, and under PECR you generally need consent before emailing sole traders and individuals. Company addresses are more flexible, but scraping personal work addresses still brings UK GDPR duties.

Can I use scraped content to train an AI model?

For commercial use, copied text and images generally need a licence. The UK's text and data mining exception only covers non-commercial research, and in March 2026 the government decided not to widen it. Personal data in a training set also needs a lawful basis.

Sources

Checked on 31 October 2026. This guide covers the law of England and Wales in general terms and is not legal advice. The law in this area is developing, so take advice on your specific situation.