The legal landscape for web scraping shifted twice this quarter, and the changes affect any organization that scrapes web data for AI training, RAG pipelines, or market intelligence.
First, a US federal court ruled that scraping publicly accessible data for AI model training does not, by itself, violate the Computer Fraud and Abuse Act (CFAA), as long as the scraping does not circumvent technical access controls. Second, the European Data Protection Board issued guidance clarifying that scraping personal data for AI training requires a lawful basis under GDPR, and that “legitimate interest” is difficult to establish when the data subjects have no reasonable expectation that their data will be used for model training.
These two developments point in different directions. US law is moving toward permissiveness for non-personal data. EU law is moving toward restriction for personal data. Organizations that scrape for AI training need to navigate both.
The US Position: CFAA Narrowed
The CFAA has been the primary legal tool for website operators who want to阻止 scraping. The argument was that accessing a website in violation of its terms of service constitutes unauthorized access under the CFAA, making the scraping a federal crime.
The courts have narrowed this argument. Following the Supreme Court’s Van Buren decision, lower courts have consistently held that the CFAA applies to technical access barriers (authentication bypass, rate limit circumvention, IP block evasion), not to violations of terms of service. A scraper that accesses publicly available data without circumventing technical access controls does not violate the CFAA, regardless of what the website’s terms of service say.
This quarter’s ruling extended this reasoning to AI training data specifically. The court held that scraping publicly available web pages to build a training dataset does not constitute unauthorized access under the CFAA because the data is publicly accessible and no technical barrier was circumvented.
The ruling does not address copyright. The scraped content may still be copyrighted, and using copyrighted content for model training may still constitute infringement. The CFAA ruling removes one legal theory (unauthorized access) but leaves others (copyright, trespass to chattels, unjust enrichment) available.
The EU Position: GDPR Tightened
The EDPB guidance is more restrictive. The guidance clarifies that scraping personal data from public websites for AI training requires a lawful basis under GDPR. The most commonly cited basis — legitimate interest — requires a balancing test: the organization’s interest in the data must be weighed against the data subject’s rights and expectations.
The EDPB’s position is that data subjects who post content on public websites have a reasonable expectation that their content will be read by other humans and indexed by search engines. They do not have a reasonable expectation that their content will be used to train AI models. This makes legitimate interest difficult to establish for scraped personal data used in training.
The practical consequence is that organizations training AI models on scraped data that contains personal data must either obtain consent (impractical at web scale), anonymize the data before training (which may reduce its utility), or establish an alternative lawful basis (which is narrow and case-specific).
What Data Teams Should Do
Separate personal and non-personal data in your scraping pipeline. If your scraping includes personal data (names, email addresses, social media profiles), implement filtering that separates personal data from non-personal data. The non-personal data has a more favorable legal position in both jurisdictions. The personal data requires additional legal analysis before use in training.
Document your scraping practices. For each data source, document: what data is scraped, whether it includes personal data, what technical access controls are in place (or not), what the terms of service say, and what the legal basis for use is. This documentation will be essential if a regulator or plaintiff asks about your training data.
Implement robots.txt compliance. While robots.txt compliance is not legally required in the US (after the CFAA narrowing), it is a strong signal of good faith. Scraping in violation of robots.txt increases the risk of non-CFAA legal claims and may be viewed negatively by a court evaluating the reasonableness of your conduct.
Consider licensed alternatives. Data licensing marketplaces that provide AI training data with explicit licenses are growing. For organizations that want legal certainty, licensed data eliminates the scraping risk entirely. The cost is higher than scraping, but the legal exposure is lower.
The Trajectory
The legal trend in the US is toward permissiveness for public data scraping, with copyright as the remaining constraint. The legal trend in the EU is toward restriction for personal data scraping, with GDPR as the binding constraint. Organizations operating in both jurisdictions need a jurisdiction-aware data acquisition strategy that treats US and EU data differently.
Bounded Recommendation
Audit your training data sources for scraping risk. Identify which sources were scraped, whether they contain personal data, and which jurisdiction’s law applies. Implement data provenance tracking so you can demonstrate the origin and legal basis for each data source. The cost of this audit is modest. The cost of not having it — litigation, regulatory penalties, forced model retraining — is growing.
