Is web scraping legal in the UK? The four layers that decide

Web scraping is not illegal in the UK. No statute bans it. But four separate legal regimes apply at the same time — contract law, copyright and database right, UK GDPR, and the Computer Misuse Act 1990 — and your job only stays lawful if it clears all four. What you scrape, how you access it, and what you do next all matter.

Why "is web scraping legal UK" has no yes/no answer

Ask a lawyer and you get "it depends" — not because they are hedging, but because scraping is a technique, not a legal category. Reading a public product page with a script is legally almost identical to reading it in Chrome. The liability comes from the surrounding facts: whether you agreed to terms that forbid automated access, whether the content is protected by copyright or a database right, whether the records describe identifiable people, and whether you had to defeat an access control to get them.

That is why the same crawler can be perfectly fine on one site and actionable on another. It is also why the UK question differs from the US position, where the Computer Fraud and Abuse Act and cases like hiQ v LinkedIn dominate the discussion. The UK has no CFAA equivalent that has been stretched to cover public-data scraping, but it has a much stronger database right than the US does.

The four layers, and what triggers each one

Layer	Instrument	Triggered when	Realistic consequence
Contract	Website terms of use	You accepted terms (account, clickwrap) that ban automated collection	Cease and desist, injunction, damages, account termination
Intellectual property	Copyright, Designs and Patents Act 1988; Copyright and Rights in Databases Regulations 1997	You copy original expression, or a substantial part of a database that took substantial investment to build	Infringement claim, injunction, delivery up or deletion of the dataset
Data protection	UK GDPR and Data Protection Act 2018	Any field relates to an identifiable living person — including names, emails, profile URLs, sometimes IPs	ICO investigation, enforcement notice, fines
Criminal	Computer Misuse Act 1990	You bypass a login, paywall or technical control, or impair the site's operation	Prosecution (rare, but real for access-control bypass)

The layers are cumulative, not alternative. A dataset of UK estate agent listings can be clean on copyright and criminal law and still be unlawful because it carries named agents' mobile numbers with no lawful basis for processing.

Layer 1: terms of use are contract, not statute

Breaching terms of use is not a crime in the UK. It can be a breach of contract — if a contract was actually formed. A clickwrap agreement you accepted when creating an account is far more enforceable than a browsewrap link in a footer you never touched. Most litigation risk here is commercial rather than existential: a letter, then an injunction if you ignore it.

Practically: read the acceptable use policy of any site you plan to scrape at volume, log the date you read it, and keep a list of sites you have excluded because they forbid automated access. That list is the cheapest evidence of good faith you will ever produce.

Layer 2: copyright and the UK database right

Facts are not protected. Prices, stock levels, star ratings, opening hours — copying those is not copyright infringement. Original text, photographs, reviews written by users and editorial descriptions are protected, and reproducing them at scale is copying.

The bigger UK-specific trap is the sui generis database right under the Copyright and Rights in Databases Regulations 1997. A directory, marketplace catalogue or listings portal that required substantial investment to obtain, verify or present can be protected as a database even where each individual record is a bare fact. Extracting or re-utilising a substantial part — quantitatively or qualitatively — infringes. Repeatedly taking insubstantial parts that cumulatively add up to a substantial part counts too.

The text and data mining exception at section 29A of the CDPA 1988 is narrow: it covers computational analysis for non-commercial research by someone with lawful access. It does not cover a commercial AI training set or a price intelligence product. As Slaughter and May put it in their review of scraping compliance, it is difficult to run broad commercial data scraping in the UK without touching copyright unless you are limiting yourself to facts or licensed content.

Layer 3: UK GDPR is where most projects actually fail

"Publicly available" is not a lawful basis. Under UK GDPR, personal data stays personal data whether you found it on a profile page or in a leaked file. If your rows contain a name, a work email, a phone number or anything that can identify a living person, you need a lawful basis, a purpose, retention limits and transparency.

In practice legitimate interests (Article 6(1)(f)) is the only realistic basis for scraped data, and it requires a documented three-part test. The ICO's generative AI consultation stated that, based on current practices, five of the six lawful bases are unlikely to be available for training generative AI on web-scraped data, leaving legitimate interests as the only candidate. The Clearview AI enforcement action showed the other half of the problem: scraping is "invisible processing", so Article 14 transparency and fairness obligations are hard to satisfy when the people in your dataset have no idea you exist.

The operational answer is boring and effective: drop personal fields at extraction time unless the use case genuinely needs them, run a DPIA for anything high-volume, and write the legitimate interests assessment before you write the scraper. If you need contact-level data, read the layered breakdown in is lead generation legal first.

Layer 4: the Computer Misuse Act 1990

Section 1 makes unauthorised access to computer material a criminal offence. Fetching a page the server serves to anyone is not that. Using stolen or shared credentials, defeating a paywall, guessing internal endpoints or brute-forcing an ID range is a different conversation. Section 3 covers acts that impair operation — which is the legal shadow behind "do not hammer the site". Rate limits are not just etiquette; they keep you out of the criminal layer entirely.

Is web scraping legal in Europe, and how does the UK differ?

Broadly the same shape, with two differences worth knowing. The EU applies GDPR rather than UK GDPR (near-identical text, different regulators), and the Digital Single Market Directive gives the EU wider text and data mining exceptions — including one for commercial TDM, subject to a machine-readable rights reservation by the rights holder. The UK did not implement that directive after Brexit and shelved a proposed broad TDM expansion after objections from the creative sector. Net effect: for commercial AI training, EU law currently offers a route that UK law does not, provided the site has not opted out.

Both regimes protect databases. Both treat public personal data as regulated data. Both leave terms of use to contract law.

Amazon, eBay and other marketplaces

There is no special statute for marketplaces, but they concentrate all four risks. Their terms explicitly forbid automated collection, their catalogues are strong database-right candidates, product photos and descriptions are copyrighted, and seller names on many listings are personal data. Both Amazon and eBay also publish official APIs and affiliate feeds.

So the honest answer to "is scraping Amazon legal" is: collecting public price and availability facts at a polite rate is unlikely to be criminal, is likely to breach their terms, and becomes materially riskier the moment you republish listing text or images or rebuild a substantial slice of their catalogue. If a licensed API covers your need, use it. If you are doing competitor price monitoring across many merchant sites rather than mirroring one marketplace, the risk profile is much lower — you are collecting scattered facts, not extracting somebody's database.

A compliance workflow you can actually run

1. Write the purpose down first. One sentence. "Track daily prices for 400 SKUs across 20 UK retailers." Purposes that cannot be stated in a sentence usually cannot pass a balancing test either.
2. Classify the fields. Facts, protected expression, personal data. Delete the third category unless you have documented a lawful basis.
3. Check terms and robots.txt per domain and keep the exclusion list. robots.txt is not law, but ignoring it destroys any good-faith argument.
4. Prefer official APIs where they exist and cover the need — cheaper legally and usually cleaner data.
5. Throttle and identify. Human-scale request rates, a stable user agent, a contact address. Never impersonate Googlebot.
6. Store provenance. Source URL, fetch timestamp, HTTP status for every row. This is the single most useful artefact if you ever receive a letter.
7. Review quarterly. Terms change, sites change, and the ICO's guidance on scraping for AI is still moving.

How the tooling choice affects your risk and your bill

Compliance work is design work, and the stack you pick either helps or fights you. A managed API that returns clean Markdown plus the source URL and cost per call gives you the provenance trail step 6 asks for by default. Running your own headless fleet gives you the same data plus logs you have to build yourself.

Here is a single-page fetch against the QuanticData Web Scraping API, which returns the shared envelope with per-call cost:

curl https://api.quanticdata.io/v1/scrape \
  -H "Authorization: Bearer $QD_API_KEY" \
  -d '{ "url": "https://example.co.uk/pricing" }'

{ "success": true,
  "data": { "markdown": "# Pricing\n…" },
  "usage": { "cost_usd": 0.0002 } }

The cost math is worth doing honestly. Scraping is priced from $0.0002 per page ($0.001 with JS rendering), search results from $0.0005 per query via the SERP API, and crawls at $0.0003 per page with unfetched pages refunded. A 100,000-page monthly refresh is $20 without rendering, $100 with. Failed calls cost nothing under pay-per-success, which matters when your compliance rules mean you deliberately abandon domains mid-run.

Set that against the alternative: an engineer maintaining proxy rotation, browser pools and parsers is the dominant cost in any DIY scraper, and none of that spend reduces legal risk by a penny. The money that actually reduces risk goes on scoping, field classification and a legitimate interests assessment.

For agent-driven work, the same endpoints are exposed as tools through the MCP server, so a model in Claude or Cursor can search, map and scrape without you shipping credentials into a script. That is convenient and it is also a governance risk: an agent that decides on its own which domain to crawl next can walk straight into a site you excluded. Keep the allowlist outside the model. Our pillar guide to the AI web scraping service covers how prompt-to-dataset workflows keep source URLs and timestamps attached to every row, which is exactly what you want when someone asks where a record came from.

Is web scraping ethical, and does that matter legally?

It matters more than people expect, because regulators and judges assess conduct, not just code. The workable test: are you taking facts rather than expression, staying off authenticated areas, keeping load negligible, building something transformative rather than a substitute for the source, and would the people in your dataset be surprised? A project that answers well on all five rarely ends up in front of the ICO. For the AI-specific version of this analysis, see is AI web scraping legal.

This article is general information for engineers and product teams, not legal advice. UK scraping law is unsettled — the Clearview appeal and the ICO's AI guidance are both live — so take advice from a qualified UK solicitor before launching anything at scale.