A team spends six months building a dataset of product prices, job listings or company profiles from public websites. Then a buyer asks a simple question: do you own it, and can you sell it to us? The honest answer is usually “partly”, and which part decides what the dataset is worth.
Scraped data is not one thing that one party owns. It is a stack of separate rights: rights in the individual items, rights in the source site’s database, rights the site created through its terms, rights that people have over data about themselves, and finally the rights the collector earns by building something new. This guide walks through each layer, how courts in the US and Europe have treated it, and what that means for licensing and resale.
This is general information, not legal advice. The law differs by country and changes quickly; talk to counsel before you license or sell a dataset.
Key takeaways
- Facts are not owned. Prices, addresses, dates and counts are generally free to copy under US copyright law. Text, photos and other creative content stay protected wherever you collect them.
- Europe adds a database right. A site that invested substantially in collecting or verifying its data can stop others from extracting a substantial part of it, even when every single item is a plain fact.
- How you collect can matter as much as what you collect. Terms you accepted, fake accounts and server burden have created liability even where nobody owned the data.
- Personal data never becomes yours to sell freely. Public availability is not an exemption under European data protection law.
- What you own is your own contribution. You can license the selection, structure, cleaning and analysis you added. You never acquire the copyright in what you copied.
Layer 1: the items themselves
Start with the individual things you collected.
Facts. The US Supreme Court settled this in 1991 in Feist v. Rural Telephone: facts are not copyrightable, because copyright requires originality and no one creates a fact. A phone book’s names and numbers were free to copy. The decision also rejected the idea that the effort of gathering facts (“sweat of the brow”) earns copyright. For scraped data, that covers most of what businesses actually collect: prices, stock levels, flight times, business names and addresses, job titles, ratings as numbers.
Expression. Article text, product descriptions written by a brand, photographs, and the wording of user reviews are creative works. Copyright protects them whether or not they are on a public page. Publicly visible is not the same as licensed.
The practical line is between recording what a page says and copying how it says it. “This laptop costs 899 euros in Germany” is a fact. The three paragraphs describing the laptop belong to whoever wrote them.
Layer 2: the source site’s database
US copyright protects a compilation of facts only in its original selection or arrangement, and the courts describe that protection as thin. A competitor can reuse the facts as long as it does not copy the creative structure. The US has no separate right in databases.
Europe does. Under the EU’s sui generis database right, the maker of a database who made a substantial investment in obtaining, verifying or presenting its contents can prevent the extraction or reuse of all or a substantial part of it. The right lasts 15 years and can renew when the contents change substantially. It also catches repeated, systematic extraction of small parts when that adds up to undermining the database.
Three decisions of the Court of Justice of the European Union shape how the right applies to collectors:
| Case | Year | What it means for scraping |
|---|---|---|
| British Horseracing Board v William Hill | 2004 | Only investment in collecting and verifying existing data counts, not in creating it. A site that generates its own data (its own fixtures, its own listings) may struggle to claim the right. Publishing the data does not give up the right. |
| Ryanair v PR Aviation | 2015 | A database protected neither by copyright nor by the database right can still be restricted by contract. In the EU, terms of use can do what intellectual property law does not. |
| CV-Online Latvia v Melons | 2021 | A specialised search engine that copies and indexes a public database is extracting and reusing it, but the maker can only stop this when it puts at risk the maker’s ability to recover its investment. |
The UK kept its own database right after Brexit. Since 1 January 2021 it protects only UK makers, and new UK databases no longer get the EU right, nor the reverse.
For a collector, the question in Europe is therefore not only “are these facts?” but also “did someone invest substantially in gathering them, and am I taking a substantial part?”
Layer 3: contracts and how you collected
Even where no one owns the data, the way it was collected can create liability. Three US cases show the pattern.
- LinkedIn and hiQ. The Ninth Circuit held in 2019, and again in 2022, that hiQ had raised serious questions about whether scraping public profiles is access “without authorization” under the federal anti-hacking statute. But a district court later found hiQ had breached LinkedIn’s user agreement, including by using fake profiles. The case ended in December 2022 with a judgment against hiQ, a permanent injunction and an order to destroy the scraped data. Winning on hacking did not mean winning.
- Meta’s 2024 case against a web data company. A federal court in California ruled in January 2024 that Facebook’s and Instagram’s terms “do not bar logged-off scraping of public data; perforce it does not prohibit the sale of such public data.” Meta dropped its remaining claim and did not appeal.
- X’s case against the same company. In May 2024 the court dismissed X’s claims that scraping and selling public posts breached its terms, holding them preempted by federal copyright law: X held only a non-exclusive licence to its users’ posts and could not use its terms to create private, copyright-like control. Later in 2024 the court let X pursue claims based on how the data was accessed, such as alleged burden on its servers. The case settled in 2025 on confidential terms.
The lesson for ownership is narrow but important. A platform’s terms may not give it control over public data it does not own, but logging in, accepting terms, creating fake accounts or overloading servers each create a separate risk that has nothing to do with who owns the data. Our overview of whether web scraping is legal covers the access side in more detail.
Layer 4: text and data mining and AI training
If the dataset will train or feed AI models, a further set of rules applies.
In the EU, the copyright rules contain two text and data mining exceptions. Research organisations and cultural heritage institutions may mine content they have lawful access to for scientific research, and rightholders cannot opt out of that. Everyone else, including commercial users, may mine lawfully accessible content unless the rightholder has reserved its rights in an appropriate way, which for content online means machine-readable means. The EU AI Act requires providers of general-purpose AI models to have a policy to respect those reservations and to publish a summary of their training content.
What counts as a valid reservation is still being decided. In the German case brought by photographer Robert Kneschke against the non-profit LAION, the Hamburg courts held that LAION’s use was covered by the research exception, and the appeal court found the image agency’s opt-out was not demonstrably machine-readable. Germany’s Federal Court of Justice heard the case in September 2026 and said a referral to the EU’s highest court is under consideration. Our guide to robots.txt, AI opt-outs and reservation signals covers the signals themselves, and our study of who blocks the AI crawlers shows how widely they are used.
US courts have reached split results, and acquisition keeps coming up:
- In Bartz v. Anthropic (2025), the court held that training on lawfully acquired books was fair use, but keeping pirated copies was not. The case settled for 1.5 billion dollars, with final approval in July 2026.
- In Kadrey v. Meta (2025), the court found fair use on that record but stressed that the ruling did not make such training lawful in general.
- In September 2026 the Third Circuit affirmed in Thomson Reuters v. Ross that copying Westlaw’s editorial headnotes to train a competing legal research tool was not fair use. The court noted that this AI system could not generate new expression, and treated the case as an ordinary copyright dispute between competitors.
For a dataset seller, the takeaway is that the source and the legality of acquisition travel with the data. A buyer training a model will ask where every part came from.
Layer 5: personal data
If the dataset contains information about identifiable people, data protection law applies on top of everything else. Under the GDPR there is no exemption for personal data that is publicly available. Whoever collects it and decides what to do with it is a controller, with duties including telling people that their data is being processed and where it came from. Selling or licensing it is a further purpose, which needs its own legal basis, and the buyer becomes a controller with obligations of its own.
Regulators have enforced this against scraping. The Dutch data protection authority fined Clearview AI 30.5 million euros in 2024 for building a database of scraped facial images, following earlier fines in Italy, Greece and France. “It was public” was not a defence. Our GDPR compliance overview covers the basics for collection teams.
What you actually own
Put the layers together and the collector’s position becomes clear.
- Your selection and arrangement. In the US, copyright can protect the original choices you made about what to include and how to organise it, but not the underlying facts.
- Your database investment. In the EU or UK, if your company is established there and invested substantially in obtaining, verifying or presenting the data, your dataset may carry its own database right, which you can license or assign.
- Your work on top. Cleaning, deduplication, normalisation, enrichment, classification, scores, indices and analysis are yours. They are often the most valuable part of the dataset and the easiest to license.
- Never the source’s rights. Your rights cover only what you contributed. They give you no copyright in the articles, photos or reviews you copied, and they do not cancel the source site’s database right or anyone’s data protection rights.
What you can license or resell
| Lower risk | Higher risk |
|---|---|
| Facts and measurements: prices, availability, counts, dates | Copies of articles, product descriptions or review text |
| Derived data: indices, trends, aggregates, scores, flags | Photos, videos and other media |
| Normalised fields and your own categories | A substantial part of a single European database, reproduced as is |
| Links to the source instead of copies of it | Personal data, especially profiles of individuals |
| Data collected without logging in or accepting terms | Data collected through accounts, fake profiles or by evading blocks |
The safest products sell what you learned from the web, not copies of the web. A price index built from millions of observations is a different thing, legally and commercially, from a mirror of a retailer’s catalogue.
Before you license a dataset
- Document provenance. Record the source, the date and the collection method of every part of the dataset. Buyers, auditors and courts will ask.
- Separate facts from content. Keep expressive material out of resale products, or link to it instead of copying it.
- Check for European databases. If a substantial part of the dataset comes from one EU or UK source, assess whether that source has a database right.
- Review how you collected. Note any terms you accepted, logins you used or blocks you met.
- Screen for personal data. Remove it, or confirm a legal basis and transparency before you share it.
- Write it into the licence. State what the buyer receives, what it may do with it, and which compliance duties it takes on.
A written policy makes most of these checks routine. Our data collection policy template is a starting point.
FAQ
Do I own data I scraped from a public website?
You own your own contribution: the selection, the structure, the cleaning and the analysis, and in Europe possibly a database right if you invested substantially. You do not own the facts themselves, and you never acquire the copyright in creative content you copied.
Can I sell scraped data?
Often, yes, for facts and data you derived from them, provided you collected them lawfully and the dataset contains no personal data you lack a basis to share. Reselling copies of articles, photos or reviews, a substantial part of a protected European database, or personal data carries much higher risk.
Does a website’s terms of service decide who owns its data?
Terms do not create ownership of facts, and one US court has held that a platform cannot use its terms to create copyright-like control over public data. But terms can still bind people who accept them, and in the EU they can restrict the use of databases that are not otherwise protected.
Is publicly available personal data free to use?
No. In the EU and UK, data protection law applies to personal data whether or not it is public, and regulators have fined companies for building databases from publicly posted images.
The bottom line
Scraping data does not transfer ownership of it. Facts stay free, creative content stays with its authors, European databases can stay with their makers, and personal data stays subject to the people it describes. What a collector owns is what it adds: the selection, structure, cleaning and analysis that turn raw pages into something useful. Build and sell that, document where everything came from, and keep copies of other people’s work and data out of the product.
Sources and references
- U.S. Supreme Court, Feist Publications v. Rural Telephone Service, 1991; 17 U.S.C. 103.
- Directive 96/9/EC on the legal protection of databases.
- CJEU, British Horseracing Board v William Hill, C-203/02, 2004; Ryanair v PR Aviation, C-30/14, 2015; CV-Online Latvia v Melons, C-762/19, 2021.
- UK Government, Sui generis database rights from 1 January 2021.
- U.S. Court of Appeals for the Ninth Circuit, hiQ Labs v. LinkedIn, 18 April 2022.
- U.S. District Court, N.D. Cal., No. 3:23-cv-00077, order of 23 January 2024; No. 3:23-cv-03698, order of 9 May 2024.
- Directive (EU) 2019/790 on copyright in the Digital Single Market; Regulation (EU) 2024/1689, the AI Act.
- U.S. Court of Appeals for the Third Circuit, Thomson Reuters v. Ross Intelligence, No. 25-2153, 29 September 2026.
- U.S. District Court, N.D. Cal., Bartz v. Anthropic, order granting final approval, 20 July 2026.
- Regulation (EU) 2016/679, the GDPR; Autoriteit Persoonsgegevens, fine on Clearview AI, September 2024.