Is Web Scraping Legal in 2026? Rules by Method and Data Type

For pages any visitor can open, collecting business facts is an ordinary analytics practice. The line moves at three places: content behind a login, personal data in the export, and platform terms that restrict automated collection. Three documents decide where a project stands: the law, which varies by country, the site’s terms of use, and robots.txt. This article maps all three by method and data type, quoting the platform rules from the live documents, and issues no legal verdicts. I fix exactly this boundary in every brief as part of web scraping to order.

Three documents with different force

People asking whether scraping is legal are usually holding three documents in one question. They answer different things.

• The law sets the outer frame, and it varies by country. It is the document a lawyer reads, and this article does not replace that read.
• The terms of use are a contract between the site and the visitor. Break them and the response is technical and immediate: captcha challenges, IP blocks, account blocks. An account means you accepted them.
• robots.txt is a technical instruction to crawlers about which paths the site asks them to skip. It is a courtesy convention rather than a law, but a scraper that respects it is a scraper that lives longer, and it is the document platforms keep most precise.

A workable project reads all three and fixes its own red lines before the first request.

By method: where the collection happens

Public pages are the working zone. Public means visible without an account: product cards in a marketplace catalog, open channel posts with their counters, public listings. A scraper reads them the way a visitor’s browser does and writes facts to a table. Prices, stock signals, ratings, listing positions: this is market data, and collecting it on a schedule is standard analytics practice.

Behind a login is a different category. Content that opens after authorization, private messages, closed groups, cabinet statistics, is not public, and bypassing logins, captcha, and other technical protections is a separate risk category that working scrapers refuse in writing. If the data is available to you legitimately through an API or your own account, that is the channel, not a parser.

Bulk collection against an explicit ban is the third method line. Telegram is the clearest documented example: its content-licensing terms prohibit access to user content for purposes beyond ordinary use of the platform, keep a narrow exception for legitimate clients, bots, and mini-apps, and ban collecting data for neural network training separately. The document has been in force since 2026 and appears in the web archive from July. A parser of open channels works inside a much thinner corridor than a parser of a web catalog.

By data type: what lands in the export

The method decides how you collect; the data type decides what you may keep.

Business facts are the safe core. Prices, stock counts, ratings, review counts, seller offer structures, positions in search results. None of it resolves to a person.

Personal data is the sharpest line. Names, contact details, photos tied to a specific person: working with personal data requires a lawful ground, and public visibility does not create one. The practical rule is mechanical, strip identities out of exports before the table ships. Review text on a product page is a market signal; the reviewer’s profile and contact string are not.

Creative content needs its own boundary. Facts and wholesale copies of creative text and images are different things to collect, and the brief should say which one the project wants.

What the platforms actually wrote

Amazon keeps two documents that disagree on purpose. Its robots.txt leaves product pages, the /dp/ paths, open to general crawlers and closes offer lists, wishlists, and availability pages. Its Conditions of Use, in the edition dated August 14, 2026, put the restriction inside the license: “This license does not include any collection and use of any product listings, descriptions, or prices; any use of data mining, robots, or similar data gathering and extraction tools.” The response to crossing the line is technical, captcha and IP and account blocks. I mapped both documents clause by clause in Amazon scraping: what the rules actually allow.

Avito, Wildberries, and VKontakte take the general approach: their user agreements restrict automated collection and assume the site is used as an ordinary visitor. The wordings differ and the editions change, so the working habit is to open the live agreement on the site itself before the run, not an article about it.

Red lines that hold in every project

The list I fix in a brief before the first request:

1. No bypassing logins, captcha, or technical protections.
2. No personal data without a lawful ground for having it.
3. No private correspondence or closed groups.
4. No bulk collection against an explicit platform ban.
5. No exports toward neural network training where the source forbids it.

Common mistakes

• Asking “is scraping legal” as one question. Method and data type decide it.
• Treating an open login page as permission. An account means accepted terms.
• Keeping personal fields in the export “just in case”. The obligation attaches to the dataset, not the intent.
• One heroic run instead of a schedule. It maximizes block risk and produces stale data at the same time.
• Reading a platform’s rules from a two-year-old article instead of the live document.

The short version

Scraping legality is not one question. Public pages with business facts inside the terms are the working zone; behind a login, personal data, and explicitly banned bulk collection are the lines that move a project into legal review. The law, the terms of use, and robots.txt are three documents of different force, and a project that reads all three, strips identities, and paces itself holds the same boundary in every jurisdiction. This is not legal advice: for a specific case, the verdict belongs to a lawyer. The boundary belongs in the brief. The same frame governs every collection job in the web scraping services family.