What is data scraping?
Definition
Data scraping is the automated collection of information from websites, often in bulk. When the information includes personal details such as names, photos or contact data, privacy and data protection laws can apply.
- Category
- Privacy
- Also called
- web scraping, scraping
- Last updated
Data scraping, also called web scraping, means using software to pull information off websites automatically instead of copying it by hand. A script can visit thousands of pages and save what it finds in minutes.
Scraping is not bad by nature. Price comparison sites and researchers use it. It becomes a privacy problem when the thing being collected is information about people: profiles, names, photos, phone numbers, email addresses.
What privacy regulators say
In August 2023, data protection authorities from around the world, including the UK's ICO, issued a joint statement on data scraping. Their main points:
- Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions.
- Social media companies and other sites that host publicly accessible personal data have obligations to protect it from unlawful scraping.
- Mass scraping incidents that harvest personal information can be reportable data breaches in many jurisdictions.
A follow-up statement in October 2024 reported on the authorities' engagement with large social media companies. The ICO's guidance for organisations also says that if you scrape publicly available personal data from social media profiles, you become the controller for that data.
Why it matters to you
"Public" does not mean "free to use for anything". Details you posted on a profile, or that sit in a public record, can be scraped, combined with other sources and republished on a people-search site. The same information can then help scammers write convincing messages or help someone find your address.
Scraping vs. related terms
- Data scraping collects data that is publicly visible, using automation.
- A data breach is unauthorised access to data held inside a system. The regulators note that a mass scraping incident can also count as a breach.
- Data mining analyses data you already have to find patterns. Scraping is one way of getting it.
How to protect yourself
- 1
Lock down what your profiles show
Set social accounts to private and remove your phone number, email, address and birthday from public view.
- 2
Share less in public places
Anything on a public page can be copied by a bot, so assume it stays copied even if you delete it later.
- 3
Find where you're already listed
Search your name in quotes and check people-search sites. Serus finds the data brokers and people-search sites that list you where you live and removes your details, then keeps watching for them to reappear.
- 4
Use a separate email for sign-ups
An alias used only for one service shows you which site leaked or sold your address if spam starts.
- 5
Report misuse to the regulator
If you think your personal data was scraped unlawfully, you can complain to your data protection authority, such as the ICO in the UK.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data scraping legal?
It depends on what is scraped, how and why. Regulators say publicly accessible personal data is still covered by data protection law in most jurisdictions. For a specific case, ask a lawyer or your data protection authority.
Is data scraping the same as hacking?
No. Scraping collects information that is visible to anyone who visits a page, while hacking means breaking into systems. Regulators note, though, that a mass scraping incident can count as a reportable breach.
How do I stop my data being scraped?
You can't fully prevent it, but you can reduce it: make profiles private, post less personal detail in public and remove listings from people-search sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.