Web scraping and the GDPR: what French law says

Web scraping is not illegal in France. That's the first thing to know, and it often comes as a surprise. Automatically collecting publicly accessible information is a legal practice, widely used for price monitoring, research or data aggregation. But legal doesn't mean without limits. Between data protection law, database law and sites' terms of use, the framework is real. Here's what you need to understand.

Personal data: the GDPR applies, even in public

A widespread mistake is believing that publicly accessible data falls outside the GDPR. That's false. A name, an email, a profile visible online remain personal data, and collecting them automatically constitutes processing subject to the regulation.

In June 2025, the CNIL published two important practical guidance sheets, one on legitimate interest as a legal basis for training AI, the other specifically on collection by scraping. The message is nuanced: scraping personal data can rest on legitimate interest, provided a series of safeguards are respected.

• define precise collection criteria upfront, and take only what's necessary;
• exclude sensitive sites by default (health, genealogy, adult content) and set aside sensitive data as well as minors' data;
• delete irrelevant data immediately, and pseudonymize as soon as possible;
• respect the robots.txt file and anti-collection mechanisms such as CAPTCHAs;
• allow a right to object.

Notably: the CNIL gives the robots.txt file near-normative weight. Ignoring it seriously undermines the legitimacy of a collection.

Database law

A second pillar, distinct from the GDPR: the so-called "sui generis" database right. It protects the investment of whoever built a database, independently of any personal data. Extracting or reusing a substantial part of a database can therefore be penalized, even if the information isn't personally identifying.

French case law reaffirmed this recently. In October 2025, the Cour de cassation confirmed, in a case pitting a car classifieds site against a meta-search engine, that the mass harvesting of listings could infringe this sui generis right. Earlier, a case involving a major classifieds site resulted in a scraper being convicted, with damages for financial harm and reputational damage.

Terms of use matter too

A third level is often forgotten: the contract. The Court of Justice of the European Union ruled, in the Ryanair case, that data not covered by database law could still be locked down by a site's general terms. Accepting the terms of use, then breaching them by harvesting the content, exposes you to a contractual claim. Conversely, another European decision recalled that the producer's protection and third parties' legitimate access must be balanced.

When the penalty lands: the Clearview example

To gauge how serious the subject is, one case stands as a reference. The company Clearview AI, which built a facial-recognition database by scraping billions of images off the web with no legal basis, was hit with a 20 million euro fine from the CNIL in 2022, followed by a penalty for non-compliance, and further sanctions across Europe. The message is clear: scraping biometric data without consent, at scale, comes at a very high cost.

A simple framework for thinking it through

For a collection project, four questions help you place yourself:

• Am I collecting personal data? If so, the GDPR applies: legal basis, minimization, information, right to object.
• Am I drawing from a protected database? Watch out for the sui generis right if the extraction is substantial.
• Did I accept terms of use that forbid collection? The ground becomes contractual.
• Am I respecting robots.txt and the site's load? That's the bare minimum of good faith, and the CNIL attaches importance to it.

Collecting cleanly, technically too

Respecting the law has a technical side. Limiting your pace so you don't overload a server, respecting the published rules, taking only the useful data: these are practices that protect both the target site and the collector. WyndPath builds this logic in, with rate limiting and respect for sites' directives. Technique never exempts you from the legal framework, but it helps you stay on the right side of it.