Is Email Scraping Legal in 2026? GDPR, CAN-SPAM and CCPA

TL;DR — is email scraping legal? In most places yes, with strings attached. Here is the short version.

• Scraping emails is rarely banned outright, but it is regulated almost everywhere. Taking a public address is usually safer than what you do with it next.
• In the EU and UK, a work email tied to a named person is personal data. You need a lawful basis under GDPR, plus PECR rules for the send itself.
• In the US, CAN-SPAM never required consent. It does ban harvesting and dictionary attacks. CCPA/CPRA adds notice and delete duties, even for data you never bought.
• Scraping a site can also break its terms of service, and in rare cases anti-hacking law. Those claims come from the platform, not the regulator.
• Most B2B teams should skip scrapers. Buy from a source that shows where each email came from, verify before you send, and honour delete requests fast.

What does "email scraping" actually mean?#

The phrase covers at least four different jobs. Each one carries a very different risk. Lumping them together is why the legal answer feels murky.

1. Crawling public web pages. A bot reads company sites, press pages, directories and job posts. It then pulls out mailto: links and plain-text emails.
2. Pulling contact data from a platform. Think LinkedIn, a trade body portal, or a gated data set. This sits behind a login, and it almost always breaks the terms of service.
3. Guessing emails by pattern. Take a name and a domain. Generate first.last@, flast@, f.last@. Then test which one accepts mail. Nothing is scraped at all. The email is a guess.
4. Buying or licensing a list. A vendor does one of the above, then sells the result, with or without proof of where it came from.

Watchdogs care about the outcome. That means a named human's contact details sitting in your CRM with no legal basis. Courts and platforms care about the method. You have to keep both happy.

Is email scraping legal in 2026?#

So, is email scraping legal? In short, yes, with limits. Collecting public business emails is broadly lawful in the US. It is lawful with conditions in the EU, UK and Canada. Sending cold mail to those emails is where most teams break the law.

Three things turn a grey area into a clear breach:

• Getting past a technical block. Logging in with a fake account, rotating IPs to beat rate limits, or scraping behind a paywall. Each one moves you from reading public pages to unlawful access.
• Harvesting plus spamming. Almost every anti-spam law treats bulk harvesting as an aggravating factor. It multiplies the fine once you hit send.
• Ignoring the person. Someone asks you to delete their record. You cannot, because you do not know where it came from. A paperwork problem just became a case file.

Is email scraping legal under GDPR, CAN-SPAM, CCPA and CASL?#

Here is the reality, law by law, minus the scare copy on most vendor blogs.

Two patterns fall out of that table. First, no major law says "thou shalt not scrape." Second, each one ties its penalties to the send. Each one also asks a hard question. Where did this record come from?

The EU text is worth reading in full. Article 6 lists the six lawful bases. Legitimate interests is the one most B2B senders lean on (gdpr-info.eu). The FTC guide is just as blunt about what CAN-SPAM does and does not ask for (ftc.gov).

Is email scraping legal if the page is public?#

This is where LinkedIn posts get most confident and most wrong. The honest answer has three layers.

Anti-hacking law. In the US, the Computer Fraud and Abuse Act punishes access "without authorisation." The long-running hiQ Labs v. LinkedIn case is the one to know. The court held that scraping data a site shows to the open web, with no login, does not breach the CFAA (overview). The case later settled once hiQ was found to have broken LinkedIn's user agreement. Public page, no login, no workaround: a weak claim. Logged-in scraping with fake accounts: a much stronger one.

Contract law. Terms of service hold up in court. LinkedIn, Crunchbase, Glassdoor and most directories ban bots by name. Breaking a contract sends nobody to prison. It does get your accounts banned, your IPs blocked, and sometimes your company sued.

Database and copyright rights. The EU database right covers bulk copying from a compiled data set, even when each fact is public. Scraping one company's contact page is not the same as scraping a whole trade directory.

So the act itself holds up when the page is public and open. It stops holding up the moment you beat a control built to stop you.

What's the difference between scraping, guessing, and licensed data?#

How you source emails drives three things. Legal risk, data quality, and your odds of surviving an audit. These are not the same axis. The best method on one is rarely the worst on another.

A verified email finder sits at the safe end of that table for one structural reason. It hands you the sources next to the email. So when a buyer asks how you got it, your answer is not "no idea." Tomba publishes where its data comes from. Licensed vendors like BookYourData take a similar route. That paper trail is the most useful asset you can hold in outbound. It is also the one thing a homemade scraper never gives you.

How do you justify cold email under GDPR?#

Emailing EU or UK contacts? Legitimate interests is almost certainly your lawful basis. It is not a free pass. It is a three-part test. You must write it down before you send, because regulators ask to see it.

1. Purpose test. Name the business goal. "Reaching ops leads at haulage firms with 50+ vans about fleet software" holds up. "Growth" does not.
2. Necessity test. Show that email is a fair way to reach that group. If your buyers already search for your category, inbound weakens the case.
3. Balancing test. Weigh your goal against what the person expects. A named work email at a firm that sells to firms carries a low bar. A personal Gmail taken from a hobby forum carries a high one. Never mix the two in one list.

Two more steps make the test hold up in practice.

4. Article 14 notice. You collected the data second-hand, so you must tell the person within a month, or at first contact. One clear line in your first email plus a linked privacy notice covers it.
5. Opt-out plumbing. Build the means to delete on request across each system. That means CRM, sequencer and warehouse, before the first campaign, not after the first complaint.

Keep that test as a one-page note per campaign type. It takes twenty minutes. It is the gap between a warning letter and a fine.

What happens if you get it wrong?#

The headline numbers are familiar. Up to €20 million or 4% of global turnover under GDPR. Up to $7,500 per wilful breach under CPRA. Per-message damages under CAN-SPAM and CASL. Those ceilings almost never land on a 30-person SaaS firm.

What does land is cheaper and more annoying:

• Your mail stops arriving. Scraped lists are full of dead emails and spam traps. Bounce rates above 3-5% get your domain throttled. Trap hits get you blocklisted. That email deliverability problem then poisons the renewal and support mail that pays your salary.
• Domain reputation debt. Google and Microsoft both tightened bulk-sender rules through 2024-2026. Winning back a burned domain takes months of slow warm-up.
• Subject access requests. One annoyed reader can force you to produce each record you hold on them, plus its source, within 30 days.
• Lost enterprise deals. Security forms now ask how you sourced your prospect data. "We scraped it" kills deals before legal even reads them.

Run each address through an email verifier before the first send. It is the cheapest insurance in outbound. It does not make an unlawful list lawful. It does stop the bounce cascade that turns a legal problem into a revenue problem.

Is a compliant email finder better than running your own scraper?#

For almost every team, yes. And not mainly for legal reasons.

A homemade scraper eats engineering time. It breaks each time a site changes its markup. It gives you emails you cannot check. It gets your IPs blocked. And it leaves you holding the "where did this come from" question. A finder API spreads the crawling, pattern logic, checking and opt-out work across thousands of users. It also hands you a paper trail per record.

The cost gap is smaller than people think. Tomba pricing starts free at 25 searches a month. Paid plans run $49/mo for Starter, $99/mo for Growth and $249/mo for Pro. One engineer-week of scraper upkeep costs more than a year of Growth. User reviews on sites like G2 are a fair sanity check on any vendor's accuracy claims.

The rule of thumb is simple. If your model depends on lifting a rival's data set, no tool makes that safe. If you just need the head of buying at 400 mid-size makers, you do not need a scraper at all. You need accurate emails with sources attached.

FAQ#

Is email scraping legal in the EU?#

Yes, with conditions. GDPR does not ban scraping. It asks for a lawful basis to hold the data, an Art. 14 notice within a month, and a way to erase on request. Named work emails count as personal data. Role emails like info@ usually do not.

Is email scraping legal in the US?#

Yes, at federal level. CAN-SPAM never asked for consent. It does ban false headers, missing postal addresses and broken opt-out links. Harvesting raises the damages if you spam. State laws such as CCPA/CPRA add notice and delete duties in California.

Is email scraping legal for B2B outreach?#

Mostly, yes. B2B gets more room in the UK, Canada and Australia. Note that California dropped its B2B carve-out in 2023. And a business email is still personal data in the EU when it names a person.

Is email scraping legal without consent?#

In US and UK B2B, yes, as long as you offer a clear opt-out. In Canada, CASL wants express or implied consent first. Implied consent can come from a business email published in public and tied to the person's role.

Is email scraping legal on LinkedIn?#

Scraping public pages is not a crime under the CFAA. But it does break LinkedIn's terms of service. Expect bans, blocks and, in rare cases, a lawsuit. Logged-in scraping with fake accounts is the riskiest version of all.

Where should you start?#

Is email scraping legal for your team? Pick your countries, write one legitimate interest note, and build the delete path. Then buy emails from a source that names where each one came from. That takes an afternoon. It removes about 90% of the risk people link to scraping.

Start with the Tomba Email Finder. It returns verified work emails with the public sources they were found on. So each record in your CRM has an answer to "where did you get this?" The free tier covers 25 searches a month. That is enough to test accuracy on your own accounts before you pay.

Related guides#

• Best Email Scraper in 2026: Top Tools Compared & Ranked
• B2B Email Scraper: How to Build a Clean Lead Pipeline in 2026
• Bulk Email Scraper: The 2026 Guide to Clean, Safe Lists
• Email Extraction and Scraping: The 2026 B2B Data Playbook