There is no EU law that bans web scraping, and collecting publicly accessible, non-personal data is generally lawful across Europe. What draws the lines are four bodies of law that apply the same way in every member state: the GDPR for personal data, the sui generis database right, the DSM Directive's text-and-data-mining exception, and national unfair-competition rules. This is information, not legal advice.
Why Europe regulates the data, not the act
The most important thing to understand is the frame. US scraping law is access-centric — it asks whether you were authorized to reach the data (the CFAA's gates-up-or-down test, covered in our US guide). The EU frame is data-centric — it asks what the data is and what you do with it. A pipeline that is perfectly fine in the US because the pages were public can still breach EU law the moment personal data lands in the dataset. So in Europe the useful questions are: is any of this personal, is it a protected database, and did the rightholder reserve it?
The four layers
1. GDPR — the one that bites
The GDPR governs any processing of personal data — names, emails, profiles, photos, even IP addresses — whether or not it was public. "It was on a public website" is not a legal basis. Scraping personal data needs an Article 6 ground, usually legitimate interest, which requires a documented balancing test, data minimisation, and a way to honour data-subject rights. As the IAPP's survey of EU scraping notes, regulators treat bulk personal-data scraping as a priority and have fined it repeatedly. The clean path: collect facts, prices and content, and filter out personal fields at extraction time unless you genuinely have a basis to keep them.
2. The sui generis database right
EU law gives the maker of a database that required substantial investment a special right against extraction or re-use of a substantial part — or systematic harvesting of insubstantial parts that adds up. Listings portals, price databases and directories are the classic protected targets. Taking a few data points is normally fine; mirroring a portal's inventory is not.
3. The TDM exception
The 2019 Copyright Directive created a text-and-data-mining exception: reproducing lawfully accessible works for automated analysis is permitted — unless the rightholder opted out in a machine-readable way. That makes robots.txt-style reservations legally meaningful in Europe in a way they are not in the US: respecting them is the boundary of the exception, not mere etiquette. Courts across member states are now testing its edges in AI-training disputes, with early rulings accepting the exception while insisting the opt-out be honoured.
4. Unfair competition and contracts
National unfair-competition rules catch free-riding: impersonating users, circumventing targeted technical blocks, or building a substitute product that hollows out the source. Website terms bind less than intuition suggests — the CJEU's Ryanair v PR Aviation line shows browsewrap terms rarely bind a non-registered visitor, and gain force mainly where database protection is absent. Logged-off scraping of public pages stays on the safe side.
Is it the same in every EU country?
The framework is harmonised because the GDPR, the database right and the TDM exception are EU-wide instruments, so the shape of the analysis is the same in France, Germany, Spain or the Netherlands. What varies is enforcement culture and the national implementation details — Germany's §44b UrhG implements the TDM exception, for example, and we cover the German specifics in our Germany guide. Post-Brexit the UK mirrors much of this through UK GDPR and its own database right, with a narrower TDM exception; see the UK guide. Treat "Europe" as one framework with local accents, not thirty different laws.
A compliance checklist for EU targets
- Scrape public, logged-off pages only — no credentialed areas, no paywall circumvention.
- Filter personal data at extraction unless you have a documented Article 6 basis; keep facts and prices.
- Respect machine-readable opt-outs — they are the boundary of the TDM exception.
- Stay insubstantial per source — take the points you need, not the database.
- Rate-limit and cache so collection never degrades the target; document volumes.
- Keep an audit trail — what, when, from where, under which reasoning.
Tooling makes the personal-data step enforceable: a scraping API that returns structured fields lets you drop personal columns in one line, and a map call scopes collection to the sections you need instead of blanket-crawling. Get the framework right and the boring posture — public, non-personal, opt-out-respecting, rate-limited — is both legally solid and cheap to run. For your specific market and use case, get local counsel; the checklist gives you collection hygiene, not legal cover.