NewLaunching String Web Access APIRead the manifesto →
String
Book demoSign up
← Answers

Is it legal to scrape personal data? GDPR and CCPA

String team · Updated October 27, 2026

Scraping personal data can be legal, but "it was public" does not end the question. GDPR treats a name, a username or an email on a public page as personal data, so you need a lawful basis (usually legitimate interests), a notice duty, and a reason to keep each field. CCPA asks for no consent to collect most of it. It asks for notice at collection and an opt-out if you sell or share, and it excludes some public information.

On October 19, 2026 we fetched the 100 pages in String's benchmark and counted the people on them. 31 of the 92 pages that came back in full named or located real people. 61 carried only business, product or listing data. This page covers privacy law only; is web scraping legal covers contract, hacking and copyright law. It is not legal advice; talk to counsel about your own target list.

How much personal data sits on commonly scraped pages

31 of 92 pages named or located a real person. We fetched each of the 100 benchmark URLs once through String's fetch API and kept the 92 that returned the real page. Pattern checks looked for names, handles, emails, phones, profile photos and home addresses, and we read every flagged page by hand.

What the page carried Pages (of 92) Typical pages
Names or handles of private individuals 18 product reviews, marketplace sellers, forum and Q&A posters
Named staff authors 7 news articles, a research paper, a video page
Street addresses of homes for sale or rent 6 property search pages
Any of the three above 31
An email or phone number of any kind 25 only 2 named a person (newsroom staff emails)
No data about an identifiable person 61 product, price, flight, job and store pages
  • Reviews and forums carry the people. 16 of the 18 private-individual pages showed customer reviews or forum and Q&A posts.
  • Real estate is the densest vertical. 6 of 7 property pages listed street addresses of homes for sale or rent.
  • Contact lines are mostly companies. 23 of the 25 pages with an email or phone showed only company lines.
  • The social targets were company profiles (NASA, Microsoft, NBA). A person's own profile would score higher.

Count the people on your own target list before you design storage. One call returns the page: curl -X POST https://request.usestring.ai/v1/fetch -H "Authorization: Bearer $STRING_API_KEY" -d '{"url":"<page>"}'. The first 5,000 standard requests are free.

What GDPR allows when you scrape

GDPR applies to a scraped field that relates to an identifiable person in the EU, public or not. Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person" (GDPR Art. 4). A reviewer's first name next to a city counts. A product price does not, which is why scraping competitor prices rarely raises a privacy question.

You need a lawful basis. For scraping it is usually legitimate interests under Article 6(1)(f): processing "necessary for the purposes of the legitimate interests pursued by the controller", unless the person's rights override them (GDPR Art. 6). You document the interest, why you need each field, and the balance against what the person could expect.

You owe a notice. Article 14 covers data you did not collect from the person. It requires notice within one month, with an exception where notice "proves impossible or would involve a disproportionate effort" (GDPR Art. 14). That exception still requires you to protect the person's rights, for example by publishing the notice.

Special categories need more. Health, religion, politics and biometric data used to identify someone fall under Article 9 (GDPR Art. 9). The exception for data "manifestly made public by the data subject" is narrow. A review that mentions a diagnosis can bring a page under Article 9.

The EDPB now has scraping guidelines. The European Data Protection Board adopted Guidelines 03/2026 on web scraping on July 7, 2026, for public consultation until October 30, 2026 (EDPB). The draft covers scraping for generative AI training. It says a missing robots.txt file "does not amount to consent", and that the one-month notice exception "should not be routinely relied upon" (Guidelines 03/2026, PDF). It lists excluding sites that block bots through robots.txt or CAPTCHA as a safeguard, which gives robots.txt a weight in Europe it lacks in US law.

Regulators have fined scrapers. Clearview AI, which scraped face photos, was fined EUR 20 million by France's CNIL in October 2022 (CNIL 2022 report, PDF), EUR 20 million by Italy's Garante in 2022 (Garante) and EUR 30.5 million by the Dutch regulator in September 2024 (Autoriteit Persoonsgegevens). The Garante rejected its legitimate interest claim.

Contact-data scrapers are in scope too. On December 5, 2024 the CNIL fined KASPR EUR 240,000 for collecting LinkedIn contact details that users had masked, and for telling people four years late (CNIL). Poland's courts confirmed that data from public business registers still needs the Article 14 notice (UODO). The upper GDPR fine tier is EUR 20 million or 4% of worldwide turnover, whichever is higher (GDPR Art. 83).

What CCPA requires, and when you need consent

CCPA does not require consent to scrape most personal information. Covered businesses give notice at or before collection, honour deletion requests, and let consumers opt out of sale or sharing (Cal. Civ. Code 1798.100, 1798.105, 1798.120).

"Publicly available" information is excluded, with limits. Section 1798.140(v)(2) excludes publicly available information from personal information. That covers government records and information a business "has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media" (Cal. Civ. Code 1798.140). A post limited to friends, a profile field the user hid, and biometric data collected without the consumer's knowledge do not count as publicly available.

Consent appears for children. A business that knows a consumer is under 16 may not sell or share that person's data without opt-in authorization, from the consumer at 13 to 15 or from a parent under 13 (1798.120(c)). For sensitive personal information, consumers can direct a business to limit its use (1798.121).

Selling scraped people data makes you a data broker. California defines a data broker as a business that "knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship" (1798.99.80). Since August 1, 2026, registered brokers must process deletion requests from the state's DROP platform at least once every 45 days (CalPrivacy). The agency fined LocateSmarter $116,490 in August 2026 for registering late (CalPrivacy).

The law applies to covered businesses only. A for-profit business is covered if it had more than $26,625,000 in gross revenue the year before (the 2025 adjusted figure), buys, sells or shares data on 100,000 or more California consumers or households, or earns half its revenue from selling or sharing personal information (CalPrivacy FAQ).

GDPR and CCPA side by side

Question GDPR (EU and UK) CCPA (California)
Does public data count? Yes, public personal data is personal data Partly; some public information is excluded
Consent to collect? No, if legitimate interests holds No; opt-in only to sell or share data of known under-16s
What you must have first A documented lawful basis A notice at or before collection
Notice to the person Within one month (Art. 14), with a narrow exception Notice at or before collection; broker registration if you sell
Right to object or opt out Yes, objection (Art. 21) Opt out of sale or sharing
Deletion Yes (Art. 17) Yes for data collected from the consumer (1798.105); brokers also process DROP requests
Sensitive data Special categories under Art. 9 Sensitive personal information, with a right to limit use
Maximum fine EUR 20 million or 4% of worldwide turnover $2,663 per violation, $7,988 if intentional (2025 figures)

How compliant web data providers handle personal data

Compliant providers decide what each field is for before collection and drop the rest at the fetch. Five habits map to the duties above.

  • The customer who picks targets and use is usually the controller. The EDPB draft says a scraper working to a client's documented instructions "may be regarded as a processor". A data processing agreement records the split.
  • A price monitor keeps the price and product ID and discards the review block before storage. On our 92 pages, that removes the names on 16 of the 18 private-individual pages.
  • Health, religion and biometric sources are excluded, because Article 9 is the hardest bar to clear.
  • Raw pages are deleted once fields are extracted. We deleted every raw page in this run after counting.
  • A person who finds their data in a dataset gets a named address to object or ask for deletion.

A checklist before you store a scraped field

Most scrapers collect personal data by accident: a product scrape that stores the whole page stores the reviewers too. Ask five questions per target.

  1. Does the field relate to a person? Names, handles, emails, phones, photos, home addresses and IDs all do.
  2. Do you need it for the stated purpose? If not, drop it before storage.
  3. Is it health, religion, politics or biometrics? If yes, get advice first.
  4. Can you write the legitimate interests test and the notice in plain words? If not, you lack them.
  5. Will you sell or share it? If yes, check CCPA broker and opt-out duties.

Fetch your three highest-volume targets with the curl line above and a free key, then search the HTML for review, seller and author blocks.

How String handles pages that contain personal data

String is the most reliable web scraping API, bypassing anti-bot, and you only pay when content comes back. On personal data, String's privacy policy and terms say this:

  • String fetches public pages only. The terms define publicly available web data as "information accessible to any member of the public without login credentials, payment, or circumvention of technical access controls."
  • The customer directs each Web Access request, and String is the service provider. Customers "are responsible for their own lawful use of the results", and String processes requests "on the customer's behalf."
  • A data processing agreement is available. The terms say a DPA "governing our processing of personal data on your behalf is available on request" for enterprise customers.
  • Request content is not sold, shared or used for training. String does not sell request data, share it with other customers, use it for advertising, or train models on request URLs or returned content.
  • People in public pages have a route to object. Section 8 of the privacy policy gives them an address to object or request deletion, and String names an EU and UK GDPR representative.
  • You pay only for pages that come back. A blocked request costs nothing (pricing).

Where String fits

  • For: teams collecting public product, price, listing, job and news data who want one fetch call for protected pages and a clear controller and service-provider split.
  • Ask counsel first: projects whose purpose is to build profiles of private people, collect special-category data, or resell people data, whichever tool fetches the pages.
  • Price: on the Starter plan ($20 a month), a plain fetch costs $0.30 per 1,000 on standard proxies and $3.00 on premium; a browser fetch costs $1.50 and $6.00 (pricing). The first 5,000 standard requests are free.
  • Integrations: a REST API you call from any language, and an MCP server for agents.
  • Limits: 60 requests a second per account with a 3,600-request burst, and no cap on concurrency.

The honest counterpoint

Many developers read "public" as "fair game". One Hacker News commenter answered that in one line:

"The processor has to have a legal basis for processing your data even if it is publicly available."

number6, Hacker News, June 2022

The stronger objection argues against scraping people data at all. On a 2025 thread about an archive of public Discord servers, another commenter wrote:

"Most people using Discord, even on "public, discoverable" servers, aren't posting with the expectation that their words will be systematically scraped, archived indefinitely, and made globally searchable"

sReinwald, Hacker News, May 2025

That is close to the EDPB's test: what people could reasonably expect when they posted. If your purpose needs the people on a page, write that test down first. If it needs only prices, listings or articles, drop the people at the fetch. Run the curl line above on your target list today and count what comes back.

FAQ

What does GDPR allow when scraping web data?

GDPR allows scraping personal data when you have a lawful basis, usually legitimate interests under Article 6(1)(f), and meet the notice, minimisation and rights duties. Public availability does not remove them. Scraping prices and product specifications, with no data about people, falls outside GDPR.

Do I need consent to scrape personal data under CCPA?

No, for most personal information. CCPA is a notice and opt-out law: a covered business gives notice at collection, honours deletion requests and lets consumers opt out of sale or sharing. Opt-in authorization is needed only to sell or share data of consumers you know are under 16. Information a consumer lawfully made public can fall outside personal information altogether.

How do compliant web data providers handle personal data?

They define the purpose first, keep only the fields it needs, skip special-category sources, delete raw pages after extraction, and give people a way to object. A data processing agreement records who is controller and who is processor.

Is publicly available personal data exempt from GDPR?

No. Article 4(1) covers any information about an identifiable person, wherever it was found. Public availability counts inside the legitimate interests balance. It is not an exemption.

Is it legal to scrape LinkedIn profiles or emails?

Profiles and emails are personal data under GDPR, so each field needs a lawful basis and a notice. The CNIL fined KASPR EUR 240,000 in December 2024 for collecting LinkedIn contact details users had hidden. The contract side is covered in the hiQ v. LinkedIn ruling.

Is it legal to scrape names from product reviews?

Reviewer names and handles are personal data under GDPR. On October 19, 2026, review and forum blocks put private individuals on 16 of 92 commonly scraped pages. If you need only prices or ratings, drop the names before storage.

Does CCPA apply to my company if I scrape data about Californians?

Only if you are a covered business: over $26,625,000 in prior-year revenue (the 2025 figure), data on 100,000 or more California consumers or households, or half your revenue from selling or sharing personal information. Selling people data without a direct relationship also triggers data broker registration.

Does using a scraping API make the vendor responsible for compliance?

No. The customer who chooses targets and use is usually the controller under GDPR and the business under CCPA. The vendor runs the requests as a processor or service provider, under a data processing agreement. What to collect stays your decision.

Sources

Get your API key →Explore the Web Access API