# Is Web Scraping Legal in the UK?

> Is web scraping legal in the UK? Yes for most public data, but four layers decide: contract, copyright and database right, UK GDPR and the Computer Misuse Act.

[Home](https://quanticdata.io/)/[Blog](https://quanticdata.io/blog/)/Is Web Scraping Legal in the UK?

# Is web scraping legal in the UK? The four layers that decide

AI scrapingJul 29, 2026·10 min read·QuanticData Team

On this page [Why "is web scraping legal UK" has no yes/no answer](/blog/is-web-scraping-legal-uk/#why-is-web-scraping-legal-uk-has-no-yes-no-answer) [The four layers, and what triggers each one](/blog/is-web-scraping-legal-uk/#the-four-layers-and-what-triggers-each-one) [Is web scraping legal in Europe, and how does the UK differ?](/blog/is-web-scraping-legal-uk/#is-web-scraping-legal-in-europe-and-how-does-the-uk-differ) [Amazon, eBay and other marketplaces](/blog/is-web-scraping-legal-uk/#amazon-ebay-and-other-marketplaces) [A compliance workflow you can actually run](/blog/is-web-scraping-legal-uk/#a-compliance-workflow-you-can-actually-run) [How the tooling choice affects your risk and your bill](/blog/is-web-scraping-legal-uk/#how-the-tooling-choice-affects-your-risk-and-your-bill) [Is web scraping ethical, and does that matter legally?](/blog/is-web-scraping-legal-uk/#is-web-scraping-ethical-and-does-that-matter-legally)

Web scraping is not illegal in the UK. No statute bans it. But four separate legal regimes apply at the same time — contract law, copyright and database right, UK GDPR, and the Computer Misuse Act 1990 — and your job only stays lawful if it clears all four. What you scrape, how you access it, and what you do next all matter.

## Why "is web scraping legal UK" has no yes/no answer

Ask a lawyer and you get "it depends" — not because they are hedging, but because scraping is a technique, not a legal category. Reading a public product page with a script is legally almost identical to reading it in Chrome. The liability comes from the surrounding facts: whether you agreed to terms that forbid automated access, whether the content is protected by copyright or a database right, whether the records describe identifiable people, and whether you had to defeat an access control to get them.

That is why the same crawler can be perfectly fine on one site and actionable on another. It is also why the UK question differs from [the US position](https://quanticdata.io/blog/is-web-scraping-legal-in-us/), where the Computer Fraud and Abuse Act and cases like *hiQ v LinkedIn* dominate the discussion. The UK has no CFAA equivalent that has been stretched to cover public-data scraping, but it has a much stronger database right than the US does.

## The four layers, and what triggers each one

| Layer | Instrument | Triggered when | Realistic consequence |
| --- | --- | --- | --- |
| Contract | Website terms of use | You accepted terms (account, clickwrap) that ban automated collection | Cease and desist, injunction, damages, account termination |
| Intellectual property | Copyright, Designs and Patents Act 1988; Copyright and Rights in Databases Regulations 1997 | You copy original expression, or a substantial part of a database that took substantial investment to build | Infringement claim, injunction, delivery up or deletion of the dataset |
| Data protection | UK GDPR and Data Protection Act 2018 | Any field relates to an identifiable living person — including names, emails, profile URLs, sometimes IPs | ICO investigation, enforcement notice, fines |
| Criminal | Computer Misuse Act 1990 | You bypass a login, paywall or technical control, or impair the site's operation | Prosecution (rare, but real for access-control bypass) |

The layers are cumulative, not alternative. A dataset of UK estate agent listings can be clean on copyright and criminal law and still be unlawful because it carries named agents' mobile numbers with no lawful basis for processing.

### Layer 1: terms of use are contract, not statute

Breaching terms of use is not a crime in the UK. It can be a breach of contract — if a contract was actually formed. A clickwrap agreement you accepted when creating an account is far more enforceable than a browsewrap link in a footer you never touched. Most litigation risk here is commercial rather than existential: a letter, then an injunction if you ignore it.

Practically: read the acceptable use policy of any site you plan to scrape at volume, log the date you read it, and keep a list of sites you have excluded because they forbid automated access. That list is the cheapest evidence of good faith you will ever produce.

### Layer 2: copyright and the UK database right

Facts are not protected. Prices, stock levels, star ratings, opening hours — copying those is not copyright infringement. Original text, photographs, reviews written by users and editorial descriptions are protected, and reproducing them at scale is copying.

The bigger UK-specific trap is the sui generis database right under the Copyright and Rights in Databases Regulations 1997. A directory, marketplace catalogue or listings portal that required substantial investment to obtain, verify or present can be protected as a database even where each individual record is a bare fact. Extracting or re-utilising a substantial part — quantitatively or qualitatively — infringes. Repeatedly taking insubstantial parts that cumulatively add up to a substantial part counts too.

The text and data mining exception at [section 29A of the CDPA 1988](https://www.legislation.gov.uk/ukpga/1988/48/section/29A) is narrow: it covers computational analysis for *non-commercial research* by someone with lawful access. It does not cover a commercial AI training set or a price intelligence product. As Slaughter and May put it in their review of scraping compliance, it is [difficult to run broad commercial data scraping in the UK without touching copyright](https://www.slaughterandmay.com/insights/importedcontent/data-scraping-and-compliance-no-clearview-yet/) unless you are limiting yourself to facts or licensed content.

### Layer 3: UK GDPR is where most projects actually fail

"Publicly available" is not a lawful basis. Under UK GDPR, personal data stays personal data whether you found it on a profile page or in a leaked file. If your rows contain a name, a work email, a phone number or anything that can identify a living person, you need a lawful basis, a purpose, retention limits and transparency.

In practice legitimate interests (Article 6(1)(f)) is the only realistic basis for scraped data, and it requires a documented three-part test. The ICO's [generative AI consultation](https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/generative-ai-first-call-for-evidence/) stated that, based on current practices, five of the six lawful bases are unlikely to be available for training generative AI on web-scraped data, leaving legitimate interests as the only candidate. The Clearview AI enforcement action showed the other half of the problem: scraping is "invisible processing", so Article 14 transparency and fairness obligations are hard to satisfy when the people in your dataset have no idea you exist.

The operational answer is boring and effective: drop personal fields at extraction time unless the use case genuinely needs them, run a DPIA for anything high-volume, and write the legitimate interests assessment before you write the scraper. If you need contact-level data, read the layered breakdown in [is lead generation legal](https://quanticdata.io/blog/is-lead-generation-legal/) first.

### Layer 4: the Computer Misuse Act 1990

Section 1 makes unauthorised access to computer material a criminal offence. Fetching a page the server serves to anyone is not that. Using stolen or shared credentials, defeating a paywall, guessing internal endpoints or brute-forcing an ID range is a different conversation. Section 3 covers acts that impair operation — which is the legal shadow behind "do not hammer the site". Rate limits are not just etiquette; they keep you out of the criminal layer entirely.

## Is web scraping legal in Europe, and how does the UK differ?

Broadly the same shape, with two differences worth knowing. The EU applies GDPR rather than UK GDPR (near-identical text, different regulators), and the Digital Single Market Directive gives the EU wider text and data mining exceptions — including one for commercial TDM, subject to a machine-readable rights reservation by the rights holder. The UK did not implement that directive after Brexit and shelved a proposed broad TDM expansion after objections from the creative sector. Net effect: for commercial AI training, EU law currently offers a route that UK law does not, provided the site has not opted out.

Both regimes protect databases. Both treat public personal data as regulated data. Both leave terms of use to contract law.

## Amazon, eBay and other marketplaces

There is no special statute for marketplaces, but they concentrate all four risks. Their terms explicitly forbid automated collection, their catalogues are strong database-right candidates, product photos and descriptions are copyrighted, and seller names on many listings are personal data. Both Amazon and eBay also publish official APIs and affiliate feeds.

So the honest answer to "is scraping Amazon legal" is: collecting public price and availability facts at a polite rate is unlikely to be criminal, is likely to breach their terms, and becomes materially riskier the moment you republish listing text or images or rebuild a substantial slice of their catalogue. If a licensed API covers your need, use it. If you are doing [competitor price monitoring](https://quanticdata.io/competitor-price-monitoring/) across many merchant sites rather than mirroring one marketplace, the risk profile is much lower — you are collecting scattered facts, not extracting somebody's database.

## A compliance workflow you can actually run

1. **Write the purpose down first.** One sentence. "Track daily prices for 400 SKUs across 20 UK retailers." Purposes that cannot be stated in a sentence usually cannot pass a balancing test either.

2. **Classify the fields.** Facts, protected expression, personal data. Delete the third category unless you have documented a lawful basis.

3. **Check terms and robots.txt per domain** and keep the exclusion list. robots.txt is not law, but ignoring it destroys any good-faith argument.

4. **Prefer official APIs where they exist** and cover the need — cheaper legally and usually cleaner data.

5. **Throttle and identify.** Human-scale request rates, a stable user agent, a contact address. Never impersonate Googlebot.

6. **Store provenance.** Source URL, fetch timestamp, HTTP status for every row. This is the single most useful artefact if you ever receive a letter.

7. **Review quarterly.** Terms change, sites change, and the ICO's guidance on scraping for AI is still moving.

## How the tooling choice affects your risk and your bill

Compliance work is design work, and the stack you pick either helps or fights you. A managed API that returns clean Markdown plus the source URL and cost per call gives you the provenance trail step 6 asks for by default. Running your own headless fleet gives you the same data plus logs you have to build yourself.

Here is a single-page fetch against the [QuanticData Web Scraping API](https://quanticdata.io/web-scraping-api/), which returns the shared envelope with per-call cost:

```
curl https://api.quanticdata.io/v1/scrape \
  -H "Authorization: Bearer $QD_API_KEY" \
  -d '{ "url": "https://example.co.uk/pricing" }'

{ "success": true,
  "data": { "markdown": "# Pricing\n…" },
  "usage": { "cost_usd": 0.0002 } }
```

The cost math is worth doing honestly. Scraping is priced from $0.0002 per page ($0.001 with JS rendering), search results from $0.0005 per query via the [SERP API](https://quanticdata.io/serp-api/), and crawls at $0.0003 per page with unfetched pages refunded. A 100,000-page monthly refresh is $20 without rendering, $100 with. Failed calls cost nothing under pay-per-success, which matters when your compliance rules mean you deliberately abandon domains mid-run.

Set that against the alternative: an engineer maintaining proxy rotation, browser pools and parsers is the dominant cost in any DIY scraper, and none of that spend reduces legal risk by a penny. The money that actually reduces risk goes on scoping, field classification and a legitimate interests assessment.

For agent-driven work, the same endpoints are exposed as tools through the [MCP server](https://quanticdata.io/mcp-server/), so a model in Claude or Cursor can search, map and scrape without you shipping credentials into a script. That is convenient and it is also a governance risk: an agent that decides on its own which domain to crawl next can walk straight into a site you excluded. Keep the allowlist outside the model. Our pillar guide to the [AI web scraping service](https://quanticdata.io/ai-web-scraping-service/) covers how prompt-to-dataset workflows keep source URLs and timestamps attached to every row, which is exactly what you want when someone asks where a record came from.

## Is web scraping ethical, and does that matter legally?

It matters more than people expect, because regulators and judges assess conduct, not just code. The workable test: are you taking facts rather than expression, staying off authenticated areas, keeping load negligible, building something transformative rather than a substitute for the source, and would the people in your dataset be surprised? A project that answers well on all five rarely ends up in front of the ICO. For the AI-specific version of this analysis, see [is AI web scraping legal](https://quanticdata.io/blog/is-ai-web-scraping-legal/).

*This article is general information for engineers and product teams, not legal advice. UK scraping law is unsettled — the Clearview appeal and the ICO's AI guidance are both live — so take advice from a qualified UK solicitor before launching anything at scale.*

### Sources & further reading

- [ICO — Generative AI first call for evidence: the lawful basis for web scraping](https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/generative-ai-first-call-for-evidence/)

- [Slaughter and May — Data scraping and compliance: no Clearview (yet)?](https://www.slaughterandmay.com/insights/importedcontent/data-scraping-and-compliance-no-clearview-yet/)

- [Copyright, Designs and Patents Act 1988, section 29A (text and data analysis)](https://www.legislation.gov.uk/ukpga/1988/48/section/29A)

- [Copyright and Rights in Databases Regulations 1997](https://www.legislation.gov.uk/uksi/1997/3032/contents/made)

- [ICO — Clearview AI Inc monetary penalty notice](https://ico.org.uk/media/action-weve-taken/mpns/4020436/clearview-ai-inc-mpn-20220518.pdf)

- [Sprintlaw UK — Is web scraping legal in the UK?](https://sprintlaw.co.uk/articles/is-web-scraping-legal-in-the-uk-understanding-data-and-intellectual-property-laws-for-businesses/)

## FAQ

Quick answers on is web scraping legal uk.

[Something else? Ask us →](mailto:hello@quanticdata.io)

### Is web scraping illegal in the UK?

No. There is no UK law banning web scraping. Liability comes from four other regimes: breach of a website's terms of use, copyright or database right infringement, UK GDPR if the data identifies people, and the Computer Misuse Act 1990 if you bypass a login or impair the site. Public, factual data collected politely sits at the low-risk end.

### Is web scraping for commercial use legal in the UK?

Often yes, but commercial use removes some protections. The text and data mining exception in section 29A of the Copyright, Designs and Patents Act 1988 only covers non-commercial research, so commercial projects cannot rely on it. Stick to facts rather than protected expression, avoid substantial extraction from protected databases, and license content where you need the actual text or images.

### Is web scraping legal in Europe?

Broadly the same framework applies: GDPR for personal data, the Database Directive for structured collections, and contract law for terms of use. The main difference is the Digital Single Market Directive, which gives the EU a commercial text and data mining exception subject to a machine-readable opt-out by rights holders. The UK did not adopt an equivalent.

### Is scraping Amazon or eBay legal?

Their terms of use forbid automated collection, so scraping them is likely a contract breach even where it is not criminal. Their catalogues are strong database-right candidates and listing text and photos are copyrighted. Collecting public price facts at a low rate is the lowest-risk end; republishing listings or rebuilding a substantial part of the catalogue is the highest. Official APIs exist for both.

### Can I scrape personal data if it is already public?

Public availability is not a lawful basis. Under UK GDPR, personal data remains regulated wherever you found it. In practice legitimate interests is the only realistic basis, and the ICO has said five of the six lawful bases are unlikely to be available for training generative AI on scraped data. You also owe transparency duties under Article 14, which scraping makes hard to meet.

### Does ignoring robots.txt break the law in the UK?

robots.txt is not legally binding on its own. But ignoring it undermines any argument that you acted in good faith, and it is often cited alongside terms of use when a site argues that access was unauthorised. Combined with aggressive request rates, it can also bring section 3 of the Computer Misuse Act into scope.

## Collect UK web data with provenance attached

QuanticData's scrape, SERP and crawl APIs return clean Markdown or JSON with the source URL, timestamp and per-call cost in one envelope — from $0.0002 a page, and failed calls cost nothing. Start with $2 of free usage every month, no card required.

[Start free — $2/month included](https://app.quanticdata.io/register)[Explore AI Web Scraping Service](https://quanticdata.io/ai-web-scraping-service/)

## Related reading

[AI scraping Is Web Scraping Legal in the US? Scraping publicly available pages is generally lawful in the US. What creates liability is how you access, what you collect and how you reuse it. Read →](https://quanticdata.io/blog/is-web-scraping-legal-in-us/) [AI scraping Is AI Web Scraping Legal? AI web scraping is not one legal question but three: how you access, what you collect, and what your model does with it. Here is the test, the case law and the pipeline. Read →](https://quanticdata.io/blog/is-ai-web-scraping-legal/) [SEO data How to Perform an SEO Audit A practical six-step SEO audit process with a checklist, the crawler-vs-user diff most audits skip, and how to run the whole thing programmatically. Read →](https://quanticdata.io/blog/how-to-perform-an-seo-audit/)

---

Source: https://quanticdata.io/blog/is-web-scraping-legal-uk/ · Site index for AI: https://quanticdata.io/llms.txt