Key takeaways
- Accessing public data is generally lawful. hiQ v. LinkedIn is the leading US precedent.
- Prices, SKUs and availability are facts. Facts cannot be copyrighted.
- Descriptions and photographs are creative works. Republishing them verbatim is infringement.
- Breaching terms of service is a contract matter, not a crime, and it matters far more if you signed up for an account.
This question gets muddled because two entirely separate legal issues share a headline. One is whether you may read the data. The other is what you may do with it afterwards.
The answers are different, and conflating them produces both needless anxiety and genuine risk in the wrong places.
This is a practical overview written by an e-commerce tooling team, not legal advice. Jurisdictions differ, facts matter, and a lawyer who knows your situation is worth the fee if the stakes are real.
Question one: may you read it?
In the United States, the governing case is hiQ Labs v. LinkedIn. The Ninth Circuit held that scraping publicly available data does not constitute unauthorised access under the Computer Fraud and Abuse Act. The reasoning is intuitive: if a page is served to anyone who requests it with no credentials, accessing it is not breaking in.
That precedent still stands as the leading authority. It has boundaries, and they are the interesting part.
Where authorisation clearly ends
- Logging in. The moment you authenticate, you have accepted terms and you are no longer accessing public data. Wholesale portals and members-only pricing sit firmly on this side of the line.
- Using stolen or shared credentials. Unambiguously a CFAA problem.
- Evading a targeted block. Being blocked and then rotating IPs to get around it looks a great deal like a revocation of authorisation that you ignored.
- Volume that degrades the service. Enough requests to affect availability starts to resemble a denial-of-service, which is a separate offence entirely.
Everything on that list is avoidable by choice. Read what is public, at a polite rate, and stop if you are asked to.
Outside the US
The UK and EU reach broadly similar conclusions by different routes. There is no CFAA equivalent applied to public web pages, and the EU's database right protects substantial investment in compiling a database rather than the individual facts within it. Extracting a whole catalogue systematically is more exposed under that right than sampling a hundred prices.
Question two: what may you do with it?
This is where real risk lives, and it is a copyright question rather than an access one.
| Data | Protected? | Practical position |
|---|---|---|
| Price | No | A fact. Free to record, compare and publish. |
| SKU, barcode, GTIN | No | Identifiers, not creative works. |
| Stock availability | No | A fact about the world. |
| Product name | Usually no | Too short for copyright. Trademark may apply to brand names. |
| Product description | Yes | Original text. Do not republish verbatim. |
| Product photography | Yes | Strongly protected, and the most commonly enforced. |
| Structure of a full catalogue | Maybe | EU database right can apply to systematic extraction. |
| Reviews and reviewer names | Yes, plus privacy | Copyright for the text, data protection for the person. |
The pattern is straightforward once you see it: facts are free, expression is not.
Images specifically
Product photography is the most likely thing to generate an actual complaint, for a simple commercial reason: brands pay real money for it, and reverse image search makes infringement trivial to detect at scale.
Three situations, three different answers:
- Migrating your own store. You own or licensed the images. Move them freely.
- Importing a supplier's catalogue. Most dropship and wholesale agreements explicitly grant permission to use supplier imagery for resale. Check yours. If it grants it, you are fine, and if it is silent, ask.
- Copying a competitor. No permission, no defence. This is the case people actually get letters about.
Does terms of service matter?
Yes, but less than people assume, and how much depends on one thing: did you agree to it?
A "browsewrap" agreement, buried in a footer link that nobody clicked, is weakly enforceable at best. A "clickwrap" agreement, accepted when you created an account, is a real contract you can be held to.
Either way, breaching terms is a contract matter, not a criminal one. The realistic consequences are an IP ban, account termination, or in a commercial dispute, a civil claim. Not prosecution.
The practical rule: if you never created an account, you probably never formed a contract. If you did create one, read what you agreed to before extracting anything at scale.
Does GDPR apply?
To product catalogues, essentially no. A t-shirt is not a data subject. Titles, prices, SKUs and stock levels contain no personal data and fall outside the regulation.
It becomes relevant the instant you collect anything about a person:
- Reviewer names and profile details
- Seller or vendor contact information on marketplaces
- Customer questions and answers
- Anything identifying an individual, however indirectly
Do not collect those without a lawful basis. For most commercial catalogue work you simply have no reason to, so the cleanest answer is to exclude them at the point of extraction.
What responsible practice looks like
Independent of what you can defend in court, this is what keeps you out of trouble:
- Only read what is public. No login, no paywall, no members-only pricing.
- Respect robots.txt. Not legally binding in most jurisdictions, and a clear signal of intent that a court will notice either way.
- Rate limit yourself. Sequential requests with a pause. Never enough load to be noticed.
- Identify honestly. Do not impersonate Googlebot.
- Stop when blocked. A block is a request. Evading it turns a grey area into a bad one.
- Rewrite before you publish. Use extracted descriptions as a drafting base, never as final copy.
- Use imagery you have rights to. Your own, your supplier's with permission, or shot yourself.
- Skip personal data. Do not collect what you do not need.
How Scrapify is built around this
These constraints are in the product, not in a policy document nobody reads:
- We read public storefront data only: the same endpoints and pages a shopper's browser receives. No login, no credential handling, no authenticated APIs.
- Requests are rate limited and sequential. Extraction is fast because the data is served in bulk, not because we flood anyone.
- We extract product data. Not reviewer names, not customer questions, not seller personal details.
- Image URLs are exported, not image files. What you do with them is your decision and your responsibility.
That last point matters. A tool can decline to help you break in. It cannot decide for you whether republishing someone's product photography is appropriate. That judgement stays with you, and the answer usually depends on a supplier agreement you already have.
Built for public data, by design
Scrapify reads what stores already publish, at a rate that harms nobody, and hands you a clean export.
The bottom line
Reading a store's public product catalogue is, in the ordinary case, lawful. Migrating a catalogue you own, monitoring competitor prices, and importing a supplier's products with permission are all normal, defensible commercial activities.
Republishing another retailer's photography and descriptions as your own is not, and no amount of clarity about the access question changes that. It is also, incidentally, terrible SEO, because duplicate content ranks nowhere. The legal answer and the commercial answer point in the same direction.