Is Scraping Instagram Legal?

I get asked whether scraping Instagram is legal more than any other question, usually right before someone is about to build a pipeline they have already half-committed to. The honest answer is that “is scraping Instagram legal” has two layers that people collapse into one: what a court will treat as lawful, and what Instagram’s own terms permit. Those are not the same thing, and the gap between them is where most of the confusion lives.

I build Instagram data pipelines for a living, so I have read the rulings, the terms, and the regulator decisions that decide this. Below I walk through the actual US case law, what Meta’s terms say about scraping, where the line sits between public and private data, the ethical considerations, and how GDPR and the EU AI Act change the picture once you are collecting information about real people. So can you scrape Instagram safely? In most US cases involving public data, yes, with the qualifiers I lay out here, though this is not legal advice, just what the primary sources actually say, with links so you can check each claim yourself.

Is scraping Instagram legal in the US?

Scraping Instagram is largely legal in the US when you collect public data without logging in. The controlling authority is Meta Platforms, Inc. v. Bright Data Ltd., decided in the Northern District of California on January 23, 2024, where Judge Edward Chen granted summary judgment for Bright Data and held that “the Facebook and Instagram Terms do not bar logged-off scraping of public data.”

The court’s reasoning is the part worth understanding, because it tells you exactly where the legal line falls. Meta’s terms govern “your use” of its products, and the judge concluded that Bright Data “did not ‘use’ Facebook and Instagram when it engaged in public logged-off scraping.” In other words, viewing and collecting public Instagram pages as an anonymous visitor is not the kind of account “use” that Meta’s contract regulates. Meta would have needed to prove Bright Data scraped while logged into an account for the terms to apply, and on the public logged-off activity it could not.

That ruling sits on top of an earlier and broader one. In hiQ Labs v. LinkedIn, the Ninth Circuit held that scraping publicly accessible data does not violate the Computer Fraud and Abuse Act, because there is no “unauthorized access” where no login is required and the site has “erected no gates” to bypass. The court reaffirmed that position in April 2022 after the Supreme Court’s narrow CFAA reading in Van Buren. Together these cases form the backbone of why public Instagram scraping is defensible in the US.

Here is how the main US legal theories map onto Instagram scraping:

The one caveat I always flag: a court has decided the logged-off question in Meta’s own backyard, but case law evolves and lower-court rulings can be appealed. The pattern across hiQ, Bright Data, and related decisions is consistent enough that I treat public logged-out scraping as low risk in the US, with the qualifiers below. The next question is what Instagram itself says, because being legal and being permitted are separate things.

Does Instagram allow scraping in its terms of service?

Instagram does not allow scraping in its terms. Meta’s main Terms of Service state: “You may not access or collect data from our Products using automated means (without our prior permission) or attempt to access data you do not have permission to access.” That language is explicit, and it covers scrapers, bots, and crawlers regardless of the legal analysis above.

Meta backs the main terms with a dedicated Automated Data Collection Terms document that goes further. It says you “will not engage in Automated Data Collection without first obtaining Meta’s express written permission,” and it spells out that accepting the terms is not itself that permission. Meta defines Automated Data Collection broadly, covering web scrapers, bots, robots, spiders, crawlers, and user-agents that navigate or index its surface-layer pages. If you want a clause-by-clause read of how this applies, I break it down in my Instagram Terms of Service and platform policy on scraping guide.

So how do the Bright Data ruling and these terms coexist? The ruling decided that the terms bind people who are logged in and “using” an account, and they do not reach an anonymous visitor scraping public pages. The terms still exist and still prohibit the practice as a matter of policy. The practical consequences live outside the courtroom:

This is why I separate “legal” from “against the rules” every time. You can be on solid legal ground for public logged-out scraping and still get your accounts disabled and your IPs blocked, because those are Meta’s enforcement levers that operate outside any courtroom. Keeping that block risk low is its own technical discipline, which I cover in how to avoid getting blocked scraping Instagram. The bigger legal divide, though, is between public and private data.

What is the difference between scraping public and private Instagram data?

The difference between public and private Instagram data is the single most important factor in whether scraping is legal. Public data is anything a logged-out visitor can see: a public profile’s bio, follower counts, public posts, captions, and public hashtags. Private data is anything behind the login wall or a private account, including direct messages, private-account content, and a user’s email unless they chose to display it publicly.

Every favorable US ruling is about public data. hiQ and Bright Data both turned on the data being openly accessible without authentication. The moment you cross into private data, you lose the protection those cases give and you pick up new exposure. Scraping private content usually means logging in, which puts you back under Meta’s terms, or circumventing the login wall, which is exactly the “bypassing a barrier” that can revive a CFAA claim.

Here is how I categorize Instagram data by risk before any project starts:

The “mixed” row is the one that catches people. An email shown on a public business profile is technically public, but it is still personal data the moment it identifies a person, and that pulls in privacy law no matter how the US contract and CFAA questions resolve. Lead and email scraping is the highest-risk category I work with, and I keep the tooling discussion in my Instagram email and lead scraper breakdown. The privacy dimension deserves its own section, because it is governed by an entirely separate body of law.

Is scraping Instagram legal under GDPR and EU law?

Scraping Instagram personal data on EU residents is legal under GDPR only if you have a lawful basis and pass the balancing test, which is a far higher bar than the US public-data rules. GDPR applies to personal data of people in the EU regardless of where your company sits, so a US-based scraper collecting data on European users is squarely in scope.

A public profile does not equal consent. Regulators have been explicit that making information visible does not authorize anyone to process it. The most common lawful basis people reach for is legitimate interest under Article 6(1)(f), and both the UK’s ICO and France’s CNIL have addressed it directly. The ICO’s position on the lawful basis for web scraping and the CNIL’s focus sheet on data collection by web scraping both say legitimate interest can work, but only after a full balancing exercise and with concrete safeguards: precise collection criteria, excluding sites that object, and deleting irrelevant data promptly.

The enforcement record shows what happens when those safeguards are missing. The Dutch Data Protection Authority fined Clearview AI 30.5 million EUR in September 2024 for building a facial recognition database from images scraped across the web, holding over 50 billion face images. That fine is the clearest signal that scraping personal data at scale, without a lawful basis, carries real financial risk in Europe.

EU law tightened further in 2025 and 2026. The EU AI Act, Article 5(1)(e) now bans outright “the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage.” This prohibition became enforceable in February 2025, with penalties up to 35 million EUR or 7% of global turnover. Scraping Instagram photos to build a face-recognition dataset is no longer a gray area in the EU; it is prohibited.

A quick map of the privacy regimes that can apply to Instagram scraping:

US privacy law is more permissive here. Under the CCPA, “publicly available information” is exempted from the definition of personal information, including data a consumer has made available to the general public. That exemption is one reason US-focused public scraping faces less privacy friction than the same activity touching EU residents. The split between US and EU rules is sharp enough that I treat them as two separate compliance questions, which leads to how I actually keep projects clean.

How do you scrape Instagram legally and ethically?

You scrape Instagram legally and ethically by staying on public data, staying logged out, respecting personal-data law, and not overcollecting. These are the rules I apply to my own pipelines, and each one tracks directly to a specific piece of case law or regulator guidance above. They also fold the ethical considerations into the same checklist, so the legal risks and the ethical risks shrink together.

• Collect only public, logged-out data. This keeps you inside the Bright Data and hiQ protections and out of Meta’s contract terms. If reaching the data requires a login, treat it as off-limits.
• Do not bypass the login wall or use fake accounts. Circumventing a technical barrier is what revives CFAA exposure, and fake-account use was part of why hiQ ultimately lost on the breach-of-contract claim and faced a $500,000 judgment.
• Minimize personal data. Overcollection is the most common GDPR failure. Collect the fields you actually need and drop the rest, exactly as the CNIL guidance recommends.
• Never build a facial recognition dataset from scraped images. This is now a prohibited practice under the EU AI Act, full stop.
• Throttle and cache. Hammering Instagram raises both the block risk and any trespass-to-chattels argument about server load. A steady, human-like rate is safer on every axis.
• Get legal review for commercial or EU-facing projects. The US public-data rules do not clear you under GDPR, and a lawyer who knows your jurisdiction is worth more than any blog post, including this one.

The ethical core under all of this is restraint: take what is public, take only what you need, and do not turn public visibility into surveillance. That principle is also what keeps you on the right side of the regulators tightening the rules each year.

There is one more practical point that affects compliance directly. A maintained API collects public data for you without ever logging in with your own account, which keeps your collection on the public, logged-out path that the courts have protected. In my runs against ChocoData’s Instagram endpoint, a single request returned public profile data as clean JSON without any login or credentials of mine attached to the request:

curl "https://chocodata.com/api/v1/instagram/profile?username=nasa&api_key=$CHOCO_API_KEY"

The Python shape is the same, and it returns public profile fields ready to load into your own storage:

import requests

resp = requests.get(
    "https://chocodata.com/api/v1/instagram/profile",
    params={"username": "nasa", "api_key": "YOUR_CHOCO_API_KEY"},
    timeout=30,
)
profile = resp.json()
print(profile)

Because the request targets a public profile and carries no account login of yours, it stays on the logged-off public-data path that the Bright Data ruling protected. Meta’s terms reach the logged-in path, and this request never touches it. You can get an API key on the ChocoData sign-up page and swap it into the snippet above. When you are comparing managed options for this kind of collection, I rank them head to head in my best Instagram scrapers and APIs in 2026 roundup, and I cover the language and library choices in my guide on how to scrape Instagram with Python.