Is Web Scraping GDPR Compliant? What Enterprises Need to Know

GDPR never mentions the words "web scraping." Yet no regulation looms larger over the practice, and the question of GDPR web scraping compliance has stalled more enterprise data projects than any technical obstacle ever has. For years, teams had to assemble the answer from general privacy principles, scattered regulator opinions, and enforcement cases. That changed in July 2026, when the European Data Protection Board adopted its first guidelines dedicated specifically to web scraping, giving the practice something it has never had: a purpose-built rulebook.

The short answer to the title question is yes, web scraping can be GDPR compliant, and much of it sits outside GDPR entirely. The longer answer is that compliance depends on what you collect, the basis you rely on, and the safeguards you can prove. This article walks through the legal mechanics: when GDPR applies, how lawful basis works for scraped data, the obligations most teams miss, and what the new guidelines expect in practice.

The usual caveat applies: this is educational content to inform your planning and your conversations with counsel, not legal advice.

It applies whenever scraping collects personal data about people in the EU or EEA, and both halves of that sentence are broader than most teams assume.

Personal data is defined by content, not location

Personal data means any information relating to an identified or identifiable person: names, email addresses, usernames, photos, job titles tied to individuals, even IP addresses. The defining test is what the data is, not where it was found, so information on a fully public webpage carries the same protections as information behind a login. The inverse is equally important: scraping that collects no personal data, such as product catalogs, prices, and stock levels for a competitive pricing analysis, largely falls outside GDPR's scope. The first compliance question in any scraping project is therefore simply: will people appear in this data?

The extraterritorial reach: non-EU scrapers are covered too

Being based outside Europe is not an exit. GDPR applies to organizations anywhere in the world that process the personal data of people in the EU in connection with offering them goods or services or monitoring their behavior. The enforcement record makes this concrete: Clearview AI, a US company with no EU offices, has accumulated roughly €100 million in European fines for its scraped facial recognition database, and the Dutch regulator has explored holding its directors personally liable. If your scraped dataset contains EU residents, GDPR is in the room regardless of where your servers are.

The Six Lawful Bases, and Why Legitimate Interest Does the Work

When personal data is in scope, GDPR's Article 6 requires one of six lawful bases for the processing: consent, contract, legal obligation, vital interests, public task, or legitimate interest.

For scraping, the list narrows fast. Consent is effectively unavailable, since you cannot realistically obtain permission from individuals before collecting their data at scale, and contractual necessity fails because no relationship exists between the scraper and the people whose data appears on target sites. That leaves legitimate interest as the only basis that practically fits most commercial scraping. This is not a loophole; it's the basis regulators themselves point to, and it comes with real obligations.

The three-part legitimate interest test

Relying on legitimate interest means passing, and documenting, a three-step test. The EDPB's formulation requires identifying a genuine legitimate interest, establishing that the processing is necessary to pursue it, and balancing that interest against the rights and freedoms of the people involved, with reasonable expectations playing a central role: whether the data was publicly available, the context in which it was posted, and whether individuals would anticipate this use all weigh in the assessment. The output of this exercise is a written legitimate interest assessment (LIA). If a regulator ever asks why your scraping was lawful, the LIA is the document that answers, and its absence is itself a finding.

The new EDPB web scraping guidelines (July 2026)

The most significant development in this space is brand new. In July 2026 the EDPB adopted Guidelines 03/2026 on web scraping, its first guidance dedicated to the practice, clarifying with examples how legitimate interest applies to scraping and confirming that special category data demands both an Article 6 basis and a separate Article 9(2) exception. The guidelines were written with AI training in mind, but their reasoning about lawful basis, safeguards, and sensitive data reflects how European regulators now analyze scraping generally. For enterprises, the practical takeaway is that the compliance path is better mapped than ever, and so are the expectations.

Special Category Data: Where Scraping Gets Dangerous

Not all personal data carries equal risk. GDPR's Article 9 designates special categories (health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, biometric and genetic data) and prohibits processing them by default.

The double requirement

For special category data, a legitimate interest assessment is not enough. The EDPB's new guidelines reiterate that processing these categories requires both a lawful basis under Article 6 and a separate exception under Article 9(2), and the available exceptions are narrow. This is precisely where Clearview failed: biometric data scraped at scale with neither consent nor any applicable exception. For most commercial scraping programs, the correct posture toward special category data is not "justify it" but "engineer it out."

Incidental collection and the exclusion measures regulators expect

Broad crawls will occasionally sweep in sensitive data nobody asked for, and regulators have addressed this directly. France's CNIL expects controllers to implement measures that automatically exclude irrelevant sensitive data, for instance by excluding certain data categories or entire sites that contain sensitive data by nature, and to be able to demonstrate those measures; where residual sensitive data slips through despite them, the collection is not automatically illegal. The message is that regulators distinguish between programs designed to avoid sensitive data and programs indifferent to it. Filters, source vetting, and exclusion lists are what put you in the first group.

Transparency and Article 14: The Obligation Everyone Forgets

Lawful basis gets the attention, but transparency is where scraping programs quietly fail, because GDPR requires telling people their data has been collected even when they never interacted with you.

The one-month notification rule

Article 14 governs exactly this situation: when personal data is obtained from a source other than the person themselves, the controller must provide privacy information within a reasonable period and at the latest within one month of collection. For scraped data, that obligation is obviously awkward, since you often hold no contact details and the individuals number in the millions. GDPR anticipates this with an exemption, which brings us to the clause everyone leans on.

The "disproportionate effort" exemption is narrower than you think

Article 14(5)(b) lifts the notice obligation where providing it proves impossible or would involve disproportionate effort. Many scraping programs treat this as a blanket pass; regulators and courts do not. Poland's Supreme Administrative Court upheld a decision in January 2026 against a data-scraping business, stressing that transparency is the rule and the disproportionate effort exemption must be interpreted restrictively, and the CNIL has sanctioned vendors for invoking the exemption without the required documented, per-case assessment. The defensible approach is to assess the exemption per project, document the balancing (number of individuals, data sensitivity, safeguards applied, feasibility of notice), and publish a public privacy notice describing your scraping activities even when individual notice genuinely isn't feasible.

Data Subject Rights and Your Scraped Dataset

People retain their GDPR rights over scraped data: access, rectification, erasure, and objection. That has operational consequences for how datasets are built.

Access, erasure, and objection requests

If someone asks what data you hold on them, you need to be able to find it, which means scraped datasets need to be searchable by data subject, not just by source. Both the EDPB and the UK's ICO have stressed the importance of the right to opt out where legitimate interest is the basis, with the EDPB pointing to approaches like maintaining opt-out lists for web-scraped data. Clearview's fines included its failure to honor access and deletion requests, a reminder that ignoring these rights compounds the original violation.

DPIAs and documentation as your first line of defense

Large-scale scraping of personal data is generally high-risk processing, which triggers a data protection impact assessment (DPIA): a structured analysis of the risks and the mitigations applied. Regulators on both sides of the Channel emphasize thorough documentation, DPIAs included, as central to accountability for scraped data. There's a pattern across everything in this article worth naming: GDPR compliance for scraping is largely a documentation discipline. The LIA, the Article 14 assessment, the DPIA, the exclusion measures. What regulators punish hardest is not the edge case that slipped through but the absence of any evidence that you tried.

Pulling the threads together, the compliant pattern looks consistent across regulator guidance.

The compliance measures regulators consistently expect

The CNIL's operational recommendations, which build on the EDPB's position, sketch the working checklist: collect only data necessary for the defined purpose, exclude sensitive data types and sources, honor site-level refusal signals such as robots.txt, respect contextual privacy expectations by distinguishing content people deliberately made public from content they didn't, and apply anonymization or pseudonymization promptly after collection where the use case allows. Add the documentation spine (LIA, DPIA, Article 14 assessment, retention policy) and you have the shape of a defensible program. None of it prohibits scraping; all of it disciplines scraping.

What to require from your scraping vendor

If a provider collects data on your behalf, their practices become your risk, since the enterprise commissioning the data is typically the controller in GDPR's eyes. Ask vendors to show their personal data screening process, their sensitive data exclusion measures, and their LIA support for projects that need one. Then verify the operation behind the promises, using the same due diligence discipline we covered in our guide to vendor security and compliance verification, and make the commitments contractual through the SLA terms that make vendor obligations enforceable. A vendor who understands GDPR will welcome the questions; one who waves them off is transferring their risk to you.

Conclusion

GDPR regulates web scraping; it does not ban it. Scraping without personal data sits largely outside the regulation, and scraping with personal data has a mapped, defensible path: legitimate interest with a documented assessment, engineered exclusion of sensitive data, honest handling of the transparency obligation, respect for data subject rights, and a documentation trail proving all of it. With the EDPB's 2026 guidelines, that path is clearer than it has ever been. The organizations that get in trouble are not the ones scraping; they are the ones scraping indiscriminately and documenting nothing.

DataHen scopes enterprise scraping projects with these questions on the table from the start: what data is actually necessary, where personal data appears, and what exclusions and documentation the project needs. If you want a data partner who treats GDPR as an engineering requirement rather than an afterthought, request a quote and tell us what you're trying to collect.

Frequently Asked Questions

No. GDPR does not prohibit web scraping; it regulates the collection and use of personal data by any method, scraping included. Scraping that involves no personal data falls largely outside the regulation, and scraping that does involve personal data is lawful when it rests on a valid lawful basis with appropriate safeguards and documentation. What GDPR penalizes is collecting personal data without a basis, transparency, or regard for individual rights.

Q: Can I scrape publicly available personal data?

Only under the same rules that govern any personal data processing. GDPR draws no distinction based on public availability: a name or email on a public page still requires a lawful basis to collect, usually legitimate interest supported by a documented assessment. Public availability does factor into the balancing test, since it shapes what individuals might reasonably expect, but it never removes the data from GDPR's scope on its own.

Q: What is a legitimate interest assessment (LIA)?

An LIA is the written analysis that justifies relying on legitimate interest as your lawful basis. It works through three steps: identifying a genuine, clearly articulated interest; showing the processing is necessary to achieve it, including that less intrusive alternatives wouldn't work as well; and balancing the interest against the rights and reasonable expectations of the individuals involved. For scraping projects, the LIA is the single most important compliance document you can hold.

Q: Do I have to notify people when I scrape their personal data?

Article 14 requires providing privacy information to individuals within one month when their data is obtained from a source other than themselves. For large-scale scraping, individual notice is often genuinely infeasible, and the regulation offers a disproportionate effort exemption, but courts and regulators interpret it restrictively and require a documented, per-project assessment rather than blanket reliance. Publishing a clear public privacy notice about your scraping activities is the accepted complementary measure.

Article 9 lists the special categories: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation. Processing them is prohibited by default, and scraping them requires both a lawful basis and a separate Article 9(2) exception. Most commercial scraping programs are better served by engineering these categories out of collection entirely.

Yes, when they process personal data of people in the EU in connection with offering them goods or services or monitoring their behavior. Enforcement against non-EU scrapers is established practice: Clearview AI, a US company, has accumulated roughly €100 million in European fines for its scraped database. The location of your company or servers does not determine whether GDPR applies; the location of the people in your data does.

GDPR fines can reach €20 million or 4% of global annual turnover, whichever is higher, and scraping cases have drawn serious penalties: Clearview AI alone has been fined by regulators in France, Italy, Greece, the Netherlands, and the UK. Beyond fines, regulators can order deletion of unlawfully collected datasets, which for a data-driven business can cost more than the penalty itself.

Does GDPR Apply to Web Scraping?