Is it legal to scrape Instagram?

Every team that needs Instagram data asks the same question, usually after they’ve already built something. The answer isn’t a clean yes or no, but it’s more settled than most people think. US courts have drawn a fairly clear line between public pages and logged-in ones. Europe hasn’t banned scraping, but it treats public profiles as personal data with all the duties that come with it.

The short answer

Scraping public Instagram data is lawful in the US if you stay logged out and don’t break through technical barriers, and the strongest case on the point was brought by Meta itself and lost. It breaks Instagram’s terms either way. Whether that matters depends on whether you ever agreed to them.

In Europe the question is different. Nobody much cares whether the scraping is “allowed” by Instagram; regulators care what you do with the personal data. That’s where companies collecting creator data are most exposed.

What Instagram’s terms say

Instagram’s Terms of Use prohibit “collecting information in an automated way without our express permission”. Meta also publishes separate Automated Data Collection Terms for anyone it does give permission to. So the platform’s position is plain: it doesn’t want you scraping it.

But terms of use are a contract, and a contract only binds people who agreed to it. That’s the thread running through every US case below. If you have an Instagram account and use it to scrape, you’re bound. If you never logged in, Meta has a much harder time showing you ever accepted anything.

What US courts have said

Hacking law: Van Buren and hiQ

The federal Computer Fraud and Abuse Act makes it a crime, and a civil wrong, to access a computer “without authorization”. Platforms used to argue that breaking their terms made scraping unauthorised. That argument has mostly failed.

In Van Buren v. United States (June 2021), the Supreme Court read the law narrowly. The question is whether you entered parts of a system that were closed to you, a “gates-up-or-down” test, not whether you misused data you were allowed to see.

In hiQ Labs v. LinkedIn (April 2022), the Ninth Circuit applied that to scraping. hiQ collected public LinkedIn profiles. The court held that public pages have no gate to lift, and that “the concept of ‘without authorization’ does not apply to public websites”. That was a preliminary ruling, but it’s the leading appeals-court view in the circuit that covers California, where Meta is based.

The same court has also shown where the gate comes down. In Facebook v. Power Ventures (2016), a company that kept accessing password-protected Facebook accounts after a cease-and-desist letter and IP blocks was held liable under the same law. hiQ distinguished it on exactly that point: Power Ventures was behind a login, hiQ wasn’t.

Contract: hiQ’s second act

hiQ won the hacking argument and still lost the case. In November 2022 the district court found hiQ had broken LinkedIn’s User Agreement, through its scraping and through contractors who created fake profiles. The court said the fake profiles were a breach whether or not those contractors scraped anything. In December 2022 hiQ agreed to a $500,000 judgment and to delete the data it had collected. Public data didn’t save it once accounts were involved.

Meta v. BrandTotal

In 2022 Meta won summary judgment that BrandTotal, which collected Facebook and Instagram ad data through a browser extension, had breached Facebook’s terms. The court also found that using fake accounts to reach password-protected pages broke federal and California hacking law, while access to pages that weren’t password-protected didn’t. BrandTotal settled later that year.

Meta v. Bright Data

This is the case that matters most for Instagram. Meta sued Bright Data for scraping public Facebook and Instagram data and selling it. On 23 January 2024, Judge Edward Chen granted Bright Data summary judgment on Meta’s breach-of-contract claim. He found:

• Meta’s terms bind users, meaning account holders. Once Bright Data closed its accounts, it wasn’t one.
• Even while it held accounts, its logged-out scraping was unrelated to what those accounts were for, so it wasn’t “using” Meta’s products under the terms.
• The terms didn’t bar logged-out scraping of public data, or selling that data.
• Meta’s argument that the no-scraping clause survived the accounts being closed failed, because it had no reasonable time limit.

About a month later Meta dropped its remaining claim, which also ended its chance to appeal. The limits are real, though. It’s one district court, it’s about the wording of Meta’s terms at the time, and the court found no evidence of logged-in scraping, so it says nothing about that. Meta can rewrite its terms.

X v. Bright Data, and the next front

X tried something similar in 2023. In May 2024 Judge William Alsup dismissed its claims, holding that claims over copying public posts were pre-empted by copyright law. X was later allowed to pursue narrower claims about harm to its servers, and the case settled on confidential terms in June 2025.

The newer fight is about getting around anti-bot systems. Google sued SerpApi in December 2025 under the anti-circumvention rules in copyright law, claiming it bypassed Google’s bot detection. In July 2026 the court dismissed both claims: for good where results held no copyrighted content, and with permission to amend where they included licensed images. It’s a reminder that how you get past a block can matter as much as what you collect.

Where GDPR applies

If your company is in the EU or UK, or you profile people who are, the data protection rules apply. GDPR covers companies outside the EU that monitor the behaviour of people in the EU, and UK GDPR has the same rule. In October 2025 the UK’s Upper Tribunal ruled that the Information Commissioner’s Office could pursue Clearview AI, a US company, over scraped photos of UK residents, finding that Clearview’s processing related to monitoring their behaviour.

Here’s what that means for creator data:

• Public data is still personal data. A creator’s handle, bio, photos and follower count all relate to an identifiable person. Data protection authorities, including Canada’s and the UK’s, issued a joint statement on scraping in October 2024, and Canada’s privacy commissioner put it plainly: personal information is subject to privacy law even when it’s publicly accessible.
• You need a lawful basis. For scraping, that’s almost always legitimate interests (Article 6(1)(f)): a real interest, processing that’s necessary for it, and a balancing test that the person’s rights don’t override.
• You have to tell people. Article 14 requires you to inform people whose data you didn’t collect from them, within a month at the latest. There’s a narrow exemption for disproportionate effort. Don’t build your plan around it.
• Sensitive data is off-limits by default. Health, religion, sexuality and political views get special protection under Article 9, and creator content often reveals them. Don’t infer or store those categories.
• People can object and ask to be deleted. You need a way to handle it.

How strict regulators are

The Dutch data protection authority went furthest. Its guidance of 1 May 2024 said it would regard most scraping of personal data by private companies as an infringement, that purely commercial interests were unlikely to count as legitimate interests, and that only very targeted scraping might pass. Scraping to build profiles for resale was one of its examples of what wouldn’t.

Five months later the EU’s top court pushed back on part of that. In the KNLTB case (4 October 2024), the Court of Justice held that a purely commercial interest can be a legitimate interest, as long as the processing is necessary and the balancing test is met. So commercial scraping isn’t ruled out in principle. It still has to pass a test that a broad, keep-everything approach will struggle with.

Enforcement so far has hit the extreme end. The Dutch authority fined Clearview AI €30.5 million in September 2024 for building a face database from scraped photos. That’s far from a creator database, but it shows that “it was public” is no defence in Europe.

California and the rest

California’s privacy law, the CCPA, takes the opposite starting point. Its definition of personal information excludes “publicly available” information, which includes information a person has made available to the general public without restricting it to a specific audience. Public Instagram profiles fit that more easily than private ones. Other US state laws vary, so check where your users and creators are.

The EU’s Digital Services Act gives vetted researchers a route to platform data under Article 40, with the detailed access rules in force since 29 October 2025. It isn’t open to commercial users.

The lines not to cross

Put the cases and the guidance together and the practical rules are clear enough:

1. Stay logged out. Public pages, no accounts. Every case scrapers lost involved accounts or getting behind a login.
2. Never use fake accounts. They turned hiQ’s win into a loss and counted against BrandTotal.
3. Never touch private accounts. That’s the gate the courts say you can’t open.
4. Don’t get around a block aimed at you. A cease-and-desist letter plus IP blocks is how Power Ventures lost.
5. Collect only what you need, and keep it only as long as you need it. Write down why. That’s your legitimate-interests case if a regulator asks.
6. Leave out sensitive data and be careful with minors. Don’t profile health, religion or sexuality, and screen out accounts that look like children’s.
7. Honour objections and deletion requests, and have a privacy notice that says what you collect.
8. Don’t republish content wholesale. Captions, photos and videos belong to the people who made them. Data about a post is a different matter from copying the post.

Choosing a provider with this in mind

Using a scraping API doesn’t hand off your legal duties. You still decide what to store and why. But it does mean the provider’s collection methods become part of your risk, so ask three questions before you sign up:

• Logged out or logged in? Providers that run pools of logged-in accounts can reach followers and stories, but they’re working on the side of the line the courts have been hardest on.
• Will they sign a data processing agreement? If you’re subject to GDPR, you’ll want one.
• Who are they? Some providers publish no legal entity. If something goes wrong, you need someone to hold to account.

Bright Data’s court record makes it the reference point on logged-out collection. Our Instagram scraping API ranking notes how each provider works, alongside coverage and price.

For the technical side, our guides to getting Instagram profile data and the Instagram Graph API’s limits cover the official route and the alternatives.

Questions