Is scraping public social media data legal? A practical overview (not legal advice)

"Is scraping legal?" is one of the most common questions we hear, and the honest answer is: it depends, but there is more clarity than most people think. Collecting data that anyone can see without logging in is treated very differently from breaking into accounts or bypassing technical barriers. What you do with the data afterwards often matters more than how you collected it.

This overview splits the question into the five areas that usually come up: computer access laws, platform terms of service, data protection, intellectual property and practical safeguards.

1. Computer access laws: public vs. protected data#

Most countries have laws against unauthorized access to computer systems. In the United States, that is the Computer Fraud and Abuse Act (CFAA). Two developments shaped how it applies to scraping:

• In Van Buren v. United States, 593 U.S. 374 (2021) (opinion), the U.S. Supreme Court read the CFAA's "exceeds authorized access" narrowly, focusing on whether someone enters parts of a system that are off-limits to them, rather than on their purpose.
• In the hiQ Labs v. LinkedIn litigation, the Ninth Circuit (2022 opinion) indicated that accessing data on publicly available web pages is unlikely to be "without authorization" under the CFAA. The case did not end there, though: hiQ was later found to have breached LinkedIn's user agreement, and the parties settled. The lesson is that access law and contract law are separate questions.

The common thread: data behind a login, a paywall or a technical barrier is treated very differently from data shown to every visitor. Collecting only logged-out, public data, without circumventing access controls, keeps you on the side of the line that courts have been most comfortable with.

2. Platform terms of service#

Social platforms' terms usually restrict automated collection. Whether those terms bind you depends largely on whether you agreed to them. If you create an account and log in, you accept the terms, and violating them can be a breach of contract. If you only access public pages without an account, the question is less clear.

In Meta Platforms, Inc. v. Bright Data Ltd., No. 3:23-cv-00077 (N.D. Cal. 2024; docket search on CourtListener), a U.S. federal court found that Meta's terms did not prohibit Bright Data's logged-out scraping of public data, and Meta later dropped its claims. That decision concerned specific terms and facts and does not mean every terms-of-service claim fails, but it reflects the importance of the logged-in/logged-out distinction.

Practical takeaway: do not scrape with logged-in accounts, do not create fake accounts to reach more data, and read the terms of any service you rely on, including your scraping provider's.

3. Data protection: public does not mean free to use#

This is the area most teams underestimate. Social media profiles are about people, so the data is often personal data. Under the EU's GDPR, the UK GDPR, Turkey's KVKK and similar laws, personal data does not stop being protected because it was published. You need a legal basis to process it, and the usual obligations apply.

• Legal basis. For most commercial scraping, the relevant basis is legitimate interests. That requires a documented balancing test: your interest, whether the processing is necessary, and whether it overrides the individuals' rights and reasonable expectations.
• Data minimization. Collect the fields you need for your purpose, not everything you can get.
• Transparency. The GDPR generally requires informing people when you collect data about them from other sources, with limited exceptions. How to do this at scale is a question to discuss with counsel.
• Special categories. Data revealing health, religion, political opinions, sexual orientation and similar categories gets extra protection. Be very careful with profiling that infers such traits.
• Rights. People can ask for access, correction and deletion. Have a process for it.
• Retention. Delete data you no longer need.

European data protection authorities have fined companies for scraping and processing publicly available personal data without a valid legal basis, with facial recognition databases built from social media photos as the best-known example. Business uses that stay close to people's expectations (a brand monitoring its mentions, a company checking a creator's public reach before a sponsorship) are very different from building profiles of individuals at scale, but both need to be thought through.

In the United States, privacy laws such as California's CCPA/CPRA define "publicly available information" more narrowly as an exception, but state laws differ and are changing quickly. If you serve users in several jurisdictions, design for the strictest one you are subject to.

4. Copyright and database rights#

Facts (a follower count, a publication date) are generally not protected by copyright. Creative content is: photos, videos, captions and, arguably, longer comments belong to the people who made them. Analyzing content, computing statistics and showing short excerpts is very different from republishing it.

In the EU, databases can also be protected by a separate database right when the maker invested substantially in them. Extracting substantial parts of a protected database can be an issue even if individual items are not copyrighted. For social platforms, the content is largely user-generated, but keep this in mind if you collect large portions of any single source.

Text and data mining exceptions in the EU and other jurisdictions allow some analysis of lawfully accessible content, with conditions and opt-outs that differ by country and purpose, especially for training AI models. If that is your use case, get specific advice.

5. Practical safeguards#

Whatever your jurisdiction, these habits reduce risk substantially:

1. Public, logged-out data only. No logins, no fake accounts, no circumventing technical barriers. Scrape Everything only returns data visible without logging in, for example the public fields of an Instagram profile or an X (Twitter) profile.
2. Write down your purpose and which fields you need for it. Drop the rest.
3. Do a legitimate interests assessment if you process personal data of people in the EU, UK or Turkey, and keep it on file.
4. Avoid sensitive inferences about individuals.
5. Set retention periods and delete data on schedule.
6. Handle requests from people who ask what you hold about them or want it removed.
7. Do not republish creative content at scale without permission. Link to it instead.
8. Secure the data. Scraped datasets are still datasets that can leak.

What your API provider can and cannot do for you#

A responsible scraping provider limits collection to public data, does not use customer accounts or credentials on the platforms, and is clear about its own role. It cannot decide on your legal basis, your retention or your use case. Under our Terms of Service, you are responsible for how you use the data you collect; our Privacy Policy explains how we handle personal data on our side.

Sources#

• Van Buren v. United States, 593 U.S. 374 (2021): Supreme Court opinion.
• hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783 (9th Cir. Apr. 18, 2022): Ninth Circuit opinion.
• Meta Platforms, Inc. v. Bright Data Ltd., No. 3:23-cv-00077 (N.D. Cal. 2024): docket search on CourtListener.
• General Data Protection Regulation (EU) 2016/679: EUR-Lex.
• Directive (EU) 2019/790 on copyright in the Digital Single Market (text and data mining, Articles 3 and 4): EUR-Lex.
• Directive 96/9/EC on the legal protection of databases: EUR-Lex.
• Turkey's Law No. 6698 on the Protection of Personal Data (KVKK): Personal Data Protection Authority.
• California Consumer Privacy Act: California Attorney General.

Summary#

• Collecting publicly visible, logged-out data is on much firmer ground than accessing anything behind a login.
• Platform terms matter most when you have agreed to them, for example by logging in.
• Data protection law applies to public personal data. Have a purpose, a legal basis and a retention plan.
• Content is protected by copyright even when it is public. Analyze it; do not republish it wholesale.
• When the stakes are high, ask a lawyer.

If you are evaluating tools, our Instagram Graph API vs scraper API comparison covers when official APIs are the better fit, which is also the more conservative choice when you work with connected accounts.