Germany has no law against web scraping as such: collecting publicly accessible, non-personal data is generally lawful, and the Federal Court of Justice has said as much. What draws the real lines are the GDPR for anything personal, database rights, the text-and-data-mining exception and unfair-competition rules. This is information, not legal advice.
The short answer for Germany
Scraping public German websites is legal in principle. The BGH — Germany's highest civil court — held in its 2014 screen-scraping decision (the Flugvermittlung case, I ZR 224/12) that automated collection of publicly available flight data did not, by itself, constitute unfair competition, even against the operator's stated wishes. What flips the analysis is how you collect and what you collect: defeating technical protections, extracting substantial parts of a protected database, or processing personal data without a legal basis.
The four legal layers that matter
1. GDPR — the layer that bites hardest
The GDPR applies to any processing of personal data — names, emails, profiles, photos, IP addresses — regardless of whether the data was public. "It was on the internet" is not a legal basis. Scraping personal data requires one of the Article 6 grounds, in practice usually legitimate interest, which demands a documented balancing test, data minimisation and a way to honour data-subject rights. European regulators have repeatedly fined large-scale profile scraping, and EU data-protection authorities treat bulk personal-data scraping as a priority topic, as the IAPP's overview of scraping in the EU documents. The clean path: scrape facts, prices and content — filter out personal fields at extraction time unless you have a genuine, documented basis.
2. Database rights — §87a UrhG and the sui generis right
The EU database right, implemented in Germany in §§87a ff. UrhG, protects collections that took substantial investment to build. Extracting or re-using a substantial part of such a database — or systematically harvesting insubstantial parts until they add up — infringes it. Listings portals, price databases and directories are the classic protected targets. Taking a handful of data points is usually fine; mirroring a portal's inventory is not.
3. The TDM exception — §44b UrhG
Germany implemented the EU Copyright Directive's text-and-data-mining exception: reproducing lawfully accessible works for automated analysis is permitted, unless the rightholder has opted out in machine-readable form. That makes robots.txt and equivalent machine-readable reservations legally meaningful in Germany in a way they are not in the US — respecting them is not just etiquette but the boundary of the exception. Courts are now testing its edges in AI-training disputes, and early decisions have accepted TDM as a defense while insisting the opt-out be honoured.
4. Unfair competition and contracts — UWG and AGB
The UWG catches free-riding scenarios: impersonating users, circumventing targeted technical blocks, or building a substitute product that hollows out the source. Terms of service matter less than intuition suggests — browsewrap terms rarely bind a non-registered visitor under German law, and the CJEU's Ryanair v PR Aviation line shows contract terms gain force mainly where database protection is absent but access was conditioned. Logged-off scraping of public pages keeps you on the safe side of both.
Germany vs the US and UK: the useful contrasts
The German/EU frame is data-centric where the American one is access-centric. US analysis turns on the CFAA's "gates up or down" logic — we cover the cases in our US guide — while German exposure concentrates on what you keep: personal data (GDPR) and database substance (§87a). The UK sits between, with UK GDPR mirroring the EU rules — see the UK guide. One practical consequence: a pipeline that is fine in the US because pages were public can still violate the GDPR the moment personal fields land in your dataset.
A German-compliance checklist you can implement
- Scrape logged-off, public pages only — no credentialed areas, no paywall circumvention.
- Filter personal data at extraction time unless you have a documented Article 6 basis; keep facts, prices, specs.
- Respect machine-readable opt-outs — robots.txt and TDM reservations are load-bearing under §44b UrhG.
- Stay insubstantial per source — take the data points you need, not the database.
- Rate-limit and cache so collection never degrades the target; document volumes.
- Keep an audit trail — what was collected, when, from where, under which reasoning.
Tooling helps enforce this: a scraping API that returns structured fields makes drop-personal-fields a one-line filter, and a map call lets you scope collection to exactly the sections you need instead of blanket-crawling a site. For datasets with company contact details, the GDPR analysis gets stricter — our company-data service exists precisely because that filtering is better done in the pipeline than after the fact.
Where the risk actually concentrates
German enforcement reality: data-protection authorities act on personal-data scraping at scale; competitors sue over database extraction and substitute products; and criminal exposure (§202a StGB, "Ausspähen von Daten") is reserved for defeating access protections — none of which a public-page, non-personal pipeline touches. The boring compliance posture — public, non-personal, opt-out-respecting, rate-limited — is both legally solid and operationally cheap. For your specific case and market, talk to counsel; the checklist gives you collection hygiene, not legal cover.