Skip to main content

Web Scraping: UK Ethics and Practice for Journalists

When scraping is acceptable, how to do it responsibly, and the UK legal framework journalists need to understand.

Last reviewed: Next review due:

Information, not legal advice.The legal position on scraping is unsettled. For high-risk projects, consult a media lawyer or your organisation’s legal team before scraping.

What is web scraping?

Web scraping is the automated extraction of data from websites using code. Instead of copying and pasting data by hand, you write a script that visits a page, reads the HTML, and extracts the information you want. For journalists, common use cases include: downloading planning applications from a council website, collecting property listings over time, or archiving public social media content.

Always check first whether the data is available in a more convenient form: an API, a downloadable CSV, or an FOI request. Scraping is the option of last resort.

UK legal framework for scraping

Copyright, Designs and Patents Act 1988 (CDPA)

Original databases are protected by copyright and database right in the UK. Extracting a substantial part of a database could infringe these rights. Factual data itself is not copyrighted, but the selection and arrangement of a database may be. Journalistic research is not a blanket defence to copyright infringement.

UK GDPR and the Data Protection Act 2018

If you scrape personal data (names, contact details, health information), UK GDPR applies. You must have a lawful basis for processing. Journalism and public interest are recognised bases, but the data must be processed only for that purpose and not kept longer than necessary. Never publish scraped personal data that could identify individuals without careful consideration.

Computer Misuse Act 1990

Scraping publicly accessible pages without circumventing access controls is unlikely to engage the CMA. Bypassing login requirements, CAPTCHAs, or other access restrictions could constitute unauthorised access — a criminal offence.

Python scraping basics with BeautifulSoup

Check robots.txt first

# Visit: https://example.com/robots.txt
# Look for Disallow rules that cover your target pages
# E.g.:
# User-agent: *
# Disallow: /planning-applications/  <- do not scrape this
# Allow: /open-data/                  <- this is fine

A responsible scraper

import requests
from bs4 import BeautifulSoup
import time

HEADERS = {
    'User-Agent': 'Mozilla/5.0 (journalist research; contact@example.com)'
}

def scrape_page(url):
    response = requests.get(url, headers=HEADERS, timeout=10)
    response.raise_for_status()
    soup = BeautifulSoup(response.text, 'html.parser')
    # Extract data here
    return soup.find_all('td', class_='planning-ref')

# Rate limit: wait 2 seconds between requests
for url in urls:
    data = scrape_page(url)
    time.sleep(2)   # be polite to the server

When scraping is appropriate

  • 1Publicly accessible pages containing factual data with no API or downloadable format available.
  • 2Archiving public pages that may be removed — for example, capturing council meeting records.
  • 3Monitoring for changes over time — detecting when a government page is updated.
  • 4Extracting data from HTML tables that cannot be downloaded as CSV.

Red flags

  • The target URL requires a login you do not legitimately hold — stop immediately.
  • The robots.txt explicitly disallows the pages you want to scrape.
  • The data is personal data (names, contact details) — UK GDPR applies.
  • Your scraper is sending hundreds of requests per minute — you risk crashing the server and potential legal action.
  • The terms of service explicitly prohibit automated access.

Responsible scraping checklist

  • I have checked whether an API or downloadable dataset already exists.
  • I have checked the robots.txt file and am not scraping disallowed pages.
  • I have read the site's terms of service.
  • My scraper identifies itself in the User-Agent header.
  • My scraper waits at least 1–2 seconds between requests.
  • The data I am scraping does not include personal data, or I have a lawful basis for processing it.
  • I have not bypassed any login, CAPTCHA, or access control.

Try FOI before scraping

If the data is held by a public authority, an FOI request is often faster, lower-risk, and produces better-quality data than scraping a webpage.

Common mistakes

  • Scraping at full speed with no delays — disrespectful and may get your IP banned.
  • Not checking robots.txt before writing the scraper.
  • Using a generic User-Agent that looks like a bot — identify yourself.
  • Scraping personal data without considering UK GDPR.
  • Not saving scraped data to disk immediately — if the script crashes you lose everything.

Related guides

Primary sources

Frequently asked questions

Is web scraping legal in the UK?
There is no single answer — it depends on what you scrape and how. Scraping factual data from publicly accessible pages at a respectful rate, for journalistic purposes, is generally accepted practice. However: scraping personal data (names, emails, addresses) is subject to UK GDPR; scraping a database that is protected by copyright under the Copyright, Designs and Patents Act 1988 may infringe database rights; and some sites' terms of service explicitly prohibit scraping. Always check robots.txt and terms before scraping, and if in doubt, seek legal advice or use an API instead.
What is robots.txt and do I have to follow it?
robots.txt is a file at the root of a website (e.g. example.com/robots.txt) that tells automated crawlers which pages they may or may not access. There is no legal requirement to follow robots.txt in the UK, but ignoring it when you have read it may be relevant to any claim that scraping was unauthorised. Responsible journalists follow robots.txt restrictions and do not scrape pages explicitly disallowed.
What is the Computer Misuse Act risk for scraping?
The Computer Misuse Act 1990 criminalises unauthorised access to computer systems. Scraping publicly accessible pages without circumventing any access controls (login, CAPTCHA, paywalls) is unlikely to engage the CMA. Scraping pages that require a login you do not legitimately hold, or bypassing anti-scraping measures, could constitute unauthorised access. Never scrape behind a login you do not have legitimate access to.