How to scrape leads legally
Three things decide this. Is the data really public, what do the site's terms of service say, and which country's law covers the person you scraped? None of the three alone gives a full answer.
Want to see it first? Book a demo
The short answer
- Legality here is not a single yes-or-no question. It depends on three things. Is the data really public? What do the site's terms say about automated collection? And where does the person live?
- A platform's terms of service can prohibit scraping even data that is publicly visible on the page. Breaking those terms carries its own risk, such as a closed account or a legal claim, apart from any data protection law.
- GDPR governs how personal data about an EU or UK resident is processed, however it was collected. Scraped data is still subject to GDPR's lawful-basis requirements, even though the person never consented to being scraped.
- Scraped data and a purchased list raise similar questions about origin and lawful basis. Neither is automatically safer, and both need verification before being treated as ready to use.
Why 'is it public' is not the whole question
A common assumption is that data visible on a public web page is fair game to collect and use. That misses two layers that also apply. First, the platform hosting the page has its own terms of service. Those often prohibit automated collection, even of content visible to any logged-out visitor. Breaking them is a contract issue between you and the platform. It's separate from whether you also broke a data protection law. It carries its own consequences, from account bans to legal claims from the platform.
Second, data protection laws like GDPR govern how you handle personal data about a person, wherever or however you got it. If the person you scraped is in the EU or UK, GDPR still needs a lawful basis. That applies to scraped data just as it does to any other way of collecting it, even though the person never agreed to be scraped.
So "is it public" answers neither question on its own. A page can be fully public and still off-limits to scrape under the platform's terms. The resulting data can still trigger data protection obligations, depending on who the person is and where they are.
Three separate checks before scraping a source
| Check | What it governs |
|---|---|
| Is the data genuinely public, with no login or paywall? | A factual starting point, not a legal conclusion by itself |
| What does the source platform's terms of service say about automated collection? | Contractual risk between the scraper and the platform |
| Where is the person located (EU/UK triggers GDPR; other jurisdictions have their own rules)? | Data protection obligations for processing their personal data |
What to actually do before building a scraping-based lead list
Read the specific platform's terms of service for the source you are considering. Do not assume a general "public data" rule applies to every site. Check where the bulk of the target list is located, and whether that triggers a specific regime like GDPR. Verify the resulting data before using it in outbound, the same way a purchased list needs verifying. Scraped data degrades and contains errors just as compiled lists do.
Disclosure: SalesCrew is our product. Its data bank can hold and segment a list whatever its origin, and suppression is enforced at send time. Whether a scraping method or source met the platform's terms and the law is a call you make before the data reaches the product.
Terms of service violations and data protection law are two separate risks
Questions
- Is scraping publicly visible data automatically legal?
- Public visibility and a platform's terms of service are separate questions. Data can be publicly viewable on a page while the platform's terms still prohibit automated collection of it. Violating those terms carries its own risk, such as account bans or legal action, separate from data protection law.
- Does GDPR apply to scraped data even if the person never agreed to be scraped?
- Yes, if the person is in the EU or UK. GDPR governs how personal data is processed, however it was obtained. Scraped data about someone in the EU still falls under GDPR's lawful-basis rules, even though they never agreed to be scraped.
- What is the practical difference between scraping and buying a purchased list?
- Scraping collects data directly from its source. A purchased list was collected and compiled by someone else. Both raise similar legal questions about the data's origin and lawful basis. Both carry deliverability risk if nobody has checked the resulting list.