Quick answer
What does the GDPR require when I collect public data through proxies?
When the data includes personal data, document a legal basis, usually legitimate interest under GDPR Article 6(1)(f), and collect only the fields you need. Exclude sites that object to scraping and respect text and data mining reservations. EuroCity Proxies wrote this checklist from EDPB, CNIL, Garante and Dutch AP guidance read in October 2026. This is not legal advice.
Does the GDPR apply to data that anyone can read online?
Yes, as soon as the data relates to an identifiable person. The GDPR defines personal data in Article 4(1), and being public does not take data out of it. The Dutch authority (AP) writes that scraping almost always collects personal data.
Some data is usually not personal: a supermarket's price list, a delivery fee, the opening hours of a chain store. Other data on the same pages is: reviewer names, private sellers in classified ads, agents' phone numbers, faces in photos. Map each field before you collect it.
Which steps belong on the checklist?
Map the fields
List every field you plan to collect and mark which ones can identify a person. Drop the ones you do not need.
Document the legal basis
For legitimate interest, the EDPB names three cumulative conditions. They are a legitimate interest, necessity of the processing, and a balancing test that the people concerned do not override. Write the assessment before you start.
Minimise and filter
Article 5(1)(c) requires data limited to what is necessary. The CNIL asks for precise collection criteria defined in advance, and prompt deletion of data collected outside them.
Exclude sites that object
Skip sites that refuse scraping through robots.txt, CAPTCHAs or their terms. The CNIL and the EDPB both give this as a safeguard.
Keep out sensitive data
Health, religion, political opinion and other Article 9 categories need a separate exception. Filter them out, and delete them at once if collected by accident.
Inform and allow objections
Article 14 covers data not obtained from the person, and Article 21 gives a right to object. The CNIL suggests publishing the list of sources and keeping an opt-out list.
Run a DPIA when risk is high
Article 35 requires a data protection impact assessment for high-risk processing; the AP's guidance on scraping includes it.
Check copyright reservations
Text and data mining under Article 4 of the DSM Directive stops where a rightholder has reserved it, by machine-readable means for online content.
What have EU data protection authorities said about web scraping?
| Authority | Document | Date | Point for proxy users |
|---|---|---|---|
| EDPB | Guidelines 1/2024 on processing based on Article 6(1)(f), version 1.0 for consultation | Adopted 8 October 2024 | Three cumulative conditions, assessed and documented before processing |
| EDPB | Report of the work undertaken by the ChatGPT Taskforce | Published 24 May 2024 | Treats web scraping as a collection stage with its own risks, assessed under Article 6(1)(f) |
| EDPB | Opinion 28/2024 on AI models | Adopted 18 December 2024 | Examples of safeguards include excluding sites that object, for example by respecting robots.txt or ai.txt |
| CNIL (France) | Fiche focus: legitimate interest and collection by web scraping | 19 June 2025 | Collection criteria set in advance, exclusion of sites that refuse scraping, deletion of irrelevant data, opt-out lists |
| Garante (Italy) | Information note on web scraping for training generative AI (register of decisions no. 329) | 20 May 2024 (Gazzetta Ufficiale no. 132, 7 June 2024) | Possible counter-measures for site operators, presented as options rather than GDPR obligations |
| AP (Netherlands) | Handreiking scraping door particulieren en private organisaties | April 2025 | Scraping almost always involves personal data; respecting robots.txt is listed among extra safeguards |
What does EU copyright law say about text and data mining?
Article 4 of Directive (EU) 2019/790 allows text and data mining of lawfully accessible content. It applies only if the rightholder has not reserved that use, for online content by machine-readable means such as robots.txt rules. Article 3 adds a wider exception for research organisations and cultural heritage institutions.
In December 2025, the Hamburg Higher Regional Court held that LAION, a non-commercial research association, could rely on the scientific-research TDM exception. It also held that a plain-language reservation was not machine-readable with the technology available in 2021. It said this could change, and a further appeal to the Federal Court of Justice was allowed. For commercial collection, treat plain-language reservations in terms of use as binding today. This is not legal advice.
Does using a proxy change any of these duties?
No. You remain the controller of the data you collect, whatever exit IP you use. A residential IP in Munich or Milan gives you the local version of a page; it does not make a collection lawful.
On our side, the Acceptable Use Policy applies to every account. Blocked: Banking, government and payment-portal sites, plus SMTP (email-sending) ports 25, 465 and 587. We do not log the content of your requests, full URLs or page data. To handle abuse reports and billing disputes, we keep connection metadata (time, account, exit IP, target hostname, bytes) for up to 30 days, then delete it. We keep your account number, orders, top-up records and traffic totals while your account is open, and afterwards only as long as accounting rules require. We disclose records to authorities only when the law requires it. Our upstream network provider may keep its own logs under its own policy. The privacy policy gives the details.
What is a sensible setup for price and local checks?
Collect company data, not people: prices, fees, stock and delivery slots. Leave reviewer names, seller profiles and contact details out of your parser, or drop them before storage.
Keep the rate modest, with one session per city and per run, as described in sticky sessions per city. Read each site's robots.txt and terms before the first run. When a site refuses automated access, check it by hand or use its official API.
GDPR and proxies: questions
Is collecting public data legal in the EU?
It depends on the data, the purpose and the site's terms. Public personal data is still covered by the GDPR, and copyright reservations can limit text and data mining. This page lists the rules and guidance; it does not decide your case. This is not legal advice.
Can legitimate interest cover a commercial project?
It can, if the three conditions are met and documented: a legitimate interest, necessity, and a balancing test. The EDPB's Guidelines 1/2024 explain each condition. Authorities assess it case by case, with safeguards such as minimisation and exclusion of objecting sites.
Do I need to respect robots.txt under the GDPR?
The GDPR does not name robots.txt. The CNIL says collection cannot meet people's reasonable expectations if sites that clearly refuse scraping are not excluded. The EDPB and the AP list respecting robots.txt among safeguards. Under the DSM Directive, a machine-readable reservation also limits text and data mining.
Which authority is mine?
Usually the authority of the country of your main establishment in the EU. Each EU country has one or more, listed as members of the EDPB. Examples are the CNIL in France, the Garante in Italy and the Autoriteit Persoonsgegevens in the Netherlands.
Are prices and delivery fees personal data?
Usually not, when they belong to a company. They can become personal data when tied to a person, such as a sole trader's name or a private seller's listing. Check each field.
What does EuroCity Proxies keep about my requests?
We do not log the content of your requests, full URLs or page data. To handle abuse reports and billing disputes, we keep connection metadata (time, account, exit IP, target hostname, bytes) for up to 30 days, then delete it. We keep your account number, orders, top-up records and traffic totals while your account is open, and afterwards only as long as accounting rules require. We disclose records to authorities only when the law requires it. Our upstream network provider may keep its own logs under its own policy.
Sources (11)
- Regulation (EU) 2016/679 (GDPR), Articles 4, 5, 6, 9, 14, 21 and 35 — EUR-Lex (checked 2026-10-18)
- Directive (EU) 2019/790 on copyright in the Digital Single Market, Articles 3 and 4 — EUR-Lex (checked 2026-10-18)
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR — European Data Protection Board (adopted 2024-10-08, checked 2026-10-18)
- Report of the work undertaken by the ChatGPT Taskforce — European Data Protection Board (2024-05-24, checked 2026-10-18)
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models — European Data Protection Board (2024-12-18, checked 2026-10-18)
- La base légale de l'intérêt légitime : fiche focus sur les mesures à prendre en cas de collecte des données par moissonnage (web scraping) — CNIL (2025-06-19, checked 2026-10-18)
- Provvedimento del 20 maggio 2024 [10020316]: Nota informativa in materia di web scraping per finalità di addestramento di intelligenza artificiale generativa e di possibili azioni di contrasto — Garante per la protezione dei dati personali (2024-05-20, checked 2026-10-18)
- Handreiking scraping door particulieren en private organisaties — Autoriteit Persoonsgegevens (2025-04-02, checked 2026-10-18)
- Higher Regional Court Hamburg confirms AI training was permitted (Kneschke v. LAION) — Bird & Bird (2025-12-17, checked 2026-10-18)
- EDPB members (national supervisory authorities) — European Data Protection Board (checked 2026-10-18)
- RFC 9309: Robots Exclusion Protocol — IETF (September 2022)