Since GDPR came into force in May 2018, many companies have asked us the same question: is web scraping legal in Europe? The short answer: yes, for publicly available non-personal data. The nuance is everything.
Personal data — names, emails, phone numbers linked to identifiable individuals — requires a legal basis under GDPR. Legitimate interest can apply for B2B prospecting or market research, but you must document your assessment and offer opt-out mechanisms where appropriate.
Scraping product prices, real estate listings without owner names, or aggregated statistics is generally low-risk. Scraping LinkedIn profiles, social media accounts, or contact directories requires careful legal review.
Technical good practices complement legal compliance: respect robots.txt as a signal of intent, rate-limit your requests, store only what you need, and define retention periods. Scrapy Ninja includes anonymization steps in our pipelines and signs DPAs with all enterprise clients.
Our recommendation: involve your DPO early, classify the data you target before writing a single line of code, and prefer aggregated/anonymized outputs when personal data is not strictly necessary.
