Pulling prices or product sheets from a public website is generally allowed in France. Data scraping changes nature when it targets identifiable people: the GDPR (EU Regulation 2016/679, applicable since 25 May 2018) then applies even to a profile anyone can see. In its guidance of 19 June 2025, the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority) says that this kind of harvesting generally rests on legitimate interest (Article 6(1)(f)), with precise safeguards. Behind a password-protected page, criminal law takes over.
Data scraping: definition and how it works
A program requests a page from a web server the way Chrome or Firefox would. It reads the returned HTML, then isolates the fields it wants: a price, a name, an address, a review. The result lands in a spreadsheet or a database. The Python libraries Beautiful Soup and Scrapy have done this job for years; for pages built in JavaScript, the tool drives a headless browser such as Playwright or Puppeteer. Proxies rotate the IP address to get around request limits.
Uses range from price monitoring to building prospecting files and training AI models. These files often feed automated email sequences: a contact added without checking gets chased several times before the mistake shows.
Scraping, crawling and APIs: three ways to read a site
Crawling follows the links of a site to map it; that is Googlebot’s job. Scraping lifts specific fields from each page visited. A crawler can feed a scraper, and most tools bundle both functions. Only the scraper produces a reusable dataset.
An API works differently. The site publishes its own access point with quotas and reuse conditions, so its consent is given upfront. Scraping cannot always claim that.
Is scraping legal in France? It depends on the data
Yes, under conditions: everything depends on the nature of the data and how it is collected. Three questions help place a project. Does the data concern an identifiable person? Is it reachable without logging in? Has the site expressed its refusal through its terms of use or a robots.txt file? Each answer opens a different legal regime.
Non-personal data: databases and competition
A price catalogue falls outside the GDPR. Another text still protects it, derived from Directive 96/9/EC of 11 March 1996. The producer of a database can prohibit the extraction of a substantial part of its content (Article L342-1 of the French Intellectual Property Code, Code de la propriété intellectuelle, which also covers repeated extraction of non-substantial parts under Article L342-2). The Paris Court of Appeal applied it on 2 February 2021 (no. 17/17688). LeBonCoin won a judgment against Entreparticuliers.com, which had copied its property listings, including €20,000 for damage to its image.
On the copyright side, the text and data mining exception from Directive (EU) 2019/790 allows certain extractions. It stops applying once the rights holder has reserved its rights in an appropriate way, for example by a machine-readable means for online content.
Personal data: the CNIL guidance of June 2025
Public data is still personal data. An employee’s name and job title fall under the GDPR even when they appear on an open page. The CNIL’s “focus sheet on the measures to take when collecting data by harvesting (web scraping)” (fiche focus sur les mesures à prendre en cas de collecte des données par moissonnage), published on 19 June 2025, states that this collection generally rests on legitimate interest, provided extra measures protect the people concerned. Harvesting is not banned in itself; each case is assessed on its own facts.
The examples in the sheet mostly concern building AI training datasets. Its safeguards work as a reference for broader harvesting, without having been written for prospecting.
- Minimisation: set precise collection criteria in advance, then delete whatever is not necessary as soon as it is identified.
- Exclusion of sites that object to harvesting, signalled by robots.txt or a CAPTCHA.
- A “discretionary and prior” right to object for the people concerned.
- Information spread as widely as possible about the collection and the rights available, for example by publishing the list of sites concerned.
- Automated deletion of sensitive data found after the fact, with particular attention to minors.
The guidance asks to “exclude from the collection the sites that clearly object to harvesting of their content”: without this precaution, according to the CNIL, the processing falls outside people’s reasonable expectations. (Our translation of the CNIL’s French text.)
These requirements are extended by the duty to inform people whose data was obtained from another source (Article 14 of the GDPR) and by the need to choose a precise purpose before the first request. Depending on the size of the file and the nature of the data, a data protection impact assessment (DPIA) may be added.
Pages behind a login and terms of use
An account created to reach closed profiles changes the picture. Fraudulently accessing or remaining in an automated data processing system is an offence (Article 323-1 of the French Criminal Code, Code pénal), punishable by 3 years’ imprisonment and a €100,000 fine.
Terms of use create a contractual obligation of their own. On 15 January 2015 (Ryanair, C-30/14), the Court of Justice of the European Union held that a site can restrict by contract the reuse of a database that neither copyright nor the sui generis right protects. The CNIL makes the same point: terms of use can prohibit harvesting.
What passes and what does not
| Situation | Verdict | Legal basis |
|---|---|---|
| Product prices and features from a public page | Generally allowed | Outside the GDPR; limit beyond a substantial extraction (database law) |
| Public profiles of individuals with minimisation and prior right to object | Possible under conditions | Legitimate interest, CNIL guidance of 19 June 2025 |
| Site that prohibits harvesting (robots.txt, CAPTCHA, terms of use) | To be excluded | Condition of legitimate interest; contractual risk |
| Content behind a login, access obtained by misuse | Illegal | Fraudulent access, Criminal Code Art. 323-1 |
| Face photos without a legal basis | Illegal | GDPR; CNIL sanction of 17 October 2022 against Clearview AI |
| Listings or database of a competitor reused in bulk | Risky | Sui generis right (Articles L342-1 and L342-2 of the Intellectual Property Code) |
hiQ, Meta, Clearview: what the decisions settled
The hiQ v. LinkedIn case reads in two stages. The US Ninth Circuit backed hiQ in 2019 (938 F.3d 985) and again in April 2022 (31 F.4th 1180): scraping public profiles raised at least serious questions under the CFAA (Computer Fraud and Abuse Act). The injunction in hiQ’s favour, issued in 2017, stood.
The outcome still turned against hiQ. On 4 November 2022, the district court found that it had breached LinkedIn’s terms of use. On 8 December 2022, a consent judgment imposed $500,000 and the destruction of the profiles and the code, as the Proskauer law firm details. The courts therefore rejected public access as a defence against a breach of terms of use. The case goes no further than that: no French judge is bound by a US decision.
Meta shows the other side: the platform itself can pay. Ireland’s Data Protection Commission adopted a decision on 25 November 2022 and announced it on the 28th: a €265 million fine against Meta Platforms Ireland. The ground: a breach of Article 25(1) and (2) of the GDPR, on data protection by design and by default. The inquiry covered Facebook search and the contact importers of Messenger and Instagram between May 2018 and September 2019.
Then Clearview AI. By deliberation SAN-2022-019 of 17 October 2022 (made public on 20 October), listed in the CNIL sanctions table, the restricted committee imposed €20 million on this facial recognition company. The grounds: lack of a legal basis, failure to respect the right of access and the right to erasure, and failure to cooperate. A penalty payment order came with it. Deliberation SAN-2023-005 of 17 April 2023 settled that penalty at €5.2 million for lack of a response.
Scraping email addresses to prospect
An address like firstname.lastname@company.fr identifies a person, so it falls within the GDPR even in B2B. On this ground, the CNIL accepts B2B email prospecting without prior consent (Article L34-5 of the French Postal and Electronic Communications Code) on two conditions. The subject of the message must relate to the recipient’s profession. The person must also have been told how their address will be used, and must be able to object simply and free of charge to every message (CNIL page on prospecting by email, in French). Generic addresses of legal entities (info@, contact@) fall outside the scheme.
The second risk is technical. A harvested list ages: employees change companies, businesses close, catch-all domains answer “accepted” for any address. Every dead address produces a hard bounce. A high hard bounce rate damages the sender’s reputation with Gmail and Outlook. Messages to valid contacts suffer too.
Methods for collecting email addresses that go through a form or a direct exchange limit this risk by design. For a harvested list, you still have to document proof of consent and unsubscribe handling before writing to anyone. Running a sample of the list through an email verification tool before the next campaign shows what share of addresses is invalid.
Official APIs and purchased data
The safest route is to use the site’s API: the platform sets the scope and the quotas itself. The API only delivers the fields the platform chooses to open, which limits prospecting.
Buying or renting data moves the problem without removing it. The GDPR applies to whoever uses the data, and the duty to inform remains if the people have never heard of that user. The details of the risks are in our analysis of buying email lists. For an in-house database, building a qualified B2B list through direct channels avoids both harvesting and buying.
Frequently asked questions about data scraping
Is scraping illegal in France?
No. It becomes illegal depending on what is collected: personal data without a legal basis or notice, a private area forced open, or a protected database extracted in substance. A specific case deserves the advice of a lawyer or the data protection officer.
Can you scrape LinkedIn or X?
Their terms of use prohibit unauthorised scraping. In Europe, the GDPR applies on top as soon as the data covers profiles of individuals. The hiQ case, detailed above, is a US decision and does not bind European judges.
Does robots.txt have legal value?
It is not a law. The CNIL nonetheless treats it as a clear signal of objection: a site that objects must be excluded from the collection for legitimate interest to hold.
What penalties do you risk?
Depending on the situation: a fine from a data protection authority, a civil judgment for infringing a database, or criminal prosecution, notably for fraudulent access to a computer system.
