GDPR and scraping public data: 2026 in practice
What changed in GDPR interpretation after Schrems II and Meta vs Bright Data. Lawful basis for scraping, controller/processor obligations, real fines from 2024-2025.
Why this matters right now
GDPR has been in force since 2018, but its take on scraping has evolved. In 2024-2025 a few precedents materially shifted practice:
- Meta v. Bright Data (2024) — a US court partially sided with Bright Data on public data but forced them to stop collecting from authenticated sessions.
- Clearview AI (2024) — a €30.5M fine in the Netherlands for scraping public face photos without consent.
- OpenAI (2025) — the Italian DPA accused them of unlawful use of web-scraped training data. The investigation is ongoing.
Bottom line: GDPR doesn't ban scraping, but it sets a high bar for legitimacy. Especially for commercial use-cases.
Lawful basis for scraping public data
GDPR Article 6 lists 6 lawful bases. For scraping, two are realistic:
1. Legitimate Interest (Art. 6(1)(f))
The most common for B2B scraping. Requirements:
- A clear "legitimate interest" of your business (lead generation, price monitoring, market research)
- Necessity — scraping is genuinely required to achieve the goal
- Balancing test — your interest outweighs the data subject's rights
- Transparency notice — you have to inform subjects about the processing
Document the result of the balancing test. If a complaint lands, you'll need to show it to the DPA.
2. Consent (Art. 6(1)(a))
Inapplicable for scraping public data — getting explicit consent from millions of profiled individuals is impossible.
Data-controller obligations
If you scrape personal data (name, email, photo, job title, phone), you're a data controller with the full set of duties:
- Privacy notice on your site — sources of data, processing purposes, lawful basis, retention period.
- Right to access — provide a copy of a subject's data on request (1 month).
- Right to erasure — delete data on request (1 month).
- Right to object — allow opt-out from your database.
- Records of processing (Art. 30) — documentation of all processing activities.
- DPIA — mandatory if processing is high-risk (large-scale, automated, scoring).
- DPO appointment — mandatory if you process PII at scale on a regular basis.
- Breach notification — 72 hours to the DPA + notification to affected subjects.
Real-world fines from 2024-2025
| Company | Fine | Jurisdiction | Reason |
|---|---|---|---|
| Clearview AI | €30.5M | NL | Scraping photos without consent |
| OpenAI (incoming) | investigation | IT | Web-scraped training data |
| Voodoo Sàrl | €3M | FR | Tracking IDs without legitimate interest |
| Meta (Ireland) | €1.2B | IE | Cross-border data transfers (Schrems II fallout) |
| TikTok | €345M | IE | Children's data processing |
Safe practices for 2026
- Don't aggregate PII from multiple sources — even when each is legal, aggregation creates a "comprehensive profile" and needs a separate lawful basis.
- Avoid sensitive data — religion, political views, sexual orientation, health (Art. 9). Fines are 4× higher.
- Pursue B2B data over B2C — a CEO's email and job title is lower-risk than a student's personal profile.
- Practice data minimisation — don't collect fields you don't need for the business task.
- Pseudonymise early — replace PII with a hash at collection time, then work with anonymised data.
- Avoid children's profiles — children's data has extra protection (Art. 8).
- Work with compliance-ready providers for enterprise — Bright Data, Oxylabs ship DPA templates.
This text is an overview, not legal advice. Discuss specifics with a specialised lawyer in your jurisdiction. Especially for B2C projects and commercial PII aggregation.