TL;DR
Collecting publicly displayed data from Amazon product pages — title, price, rating, review count, availability — is generally legal in the US, EU, and UK. Public, factual data isn't copyrightable, and the Ninth Circuit's hiQ v. LinkedIn line of cases established that scraping publicly accessible data doesn't violate the Computer Fraud and Abuse Act, because no authorization is being circumvented.
That is not the same as "no legal risk," and the distinctions matter:
- Amazon's Conditions of Use prohibit automated data collection. Breaching them is a contract question, not a criminal one — the realistic consequence is account or IP blocking, and a breach-of-contract claim if you accepted the terms.
- Review text is copyrightable expression, unlike prices. Reproducing reviews wholesale is a copyright problem that reproducing prices isn't.
- Bypassing authentication, rate-limits, or CAPTCHAs changes the analysis — that's where CFAA exposure actually starts.
- Agentic scraping is now its own live front. Amazon obtained an injunction against Perplexity over agentic browsing on Amazon, so "an AI did it for me" is not a shield.
Practically: ScrapeMaster runs in your own browser at browsing speed using your normal session. It does not rotate proxies or fingerprints, does not solve CAPTCHAs, and does not bypass logins — which keeps you on the right side of the line that actually matters, while the pacing keeps you off the line that gets accounts blocked.
This post walks the four separate legal questions people usually collapse into one, then covers what to do in practice. It's general information, not legal advice — for anything commercially significant, talk to a lawyer.
The four questions hiding inside "is it legal?"
Almost every argument about scraping Amazon is two people answering different questions. Separate them and most of the confusion goes away.
1. Computer Fraud and Abuse Act — is it unauthorized access?
The CFAA criminalizes accessing a computer "without authorization" or exceeding authorized access. It's the statute people fear, because it carries criminal penalties.
The current position, after hiQ Labs v. LinkedIn and the Supreme Court's narrowing in Van Buren v. United States: publicly accessible data doesn't require authorization, so accessing it can't be unauthorized. If a page loads for anyone with a browser and no login, the CFAA is largely off the table.
What brings it back:
- Circumventing a technical access control — an authentication requirement, a paywall, an IP block deliberately applied to you.
- Continuing after a specific, targeted revocation (a cease-and-desist naming you), which some courts have treated as ending authorization.
- Using credentials you don't have a right to.
Scraping a public product page: not a CFAA problem. Scraping seller-only dashboards with borrowed credentials: a real one.
2. Contract — Amazon's Conditions of Use
Amazon's terms prohibit automated data collection without permission. This is a genuine restriction, and pretending otherwise would be dishonest.
But it's a contract claim, which means:
- The remedy is contractual, not criminal. Blocking, account termination, and potentially a breach action.
- Formation matters. Browsewrap terms — a link in the footer that nobody clicked — are enforced inconsistently. Clickwrap terms you actively accepted when creating an account are on much firmer ground. If you have an Amazon account, you accepted them.
- It binds you, not the world. Someone with no account who never accepted anything is in a different position from a logged-in seller.
The honest summary: violating Amazon's ToS is a real thing with real consequences, and those consequences are overwhelmingly "you get blocked," not "you get prosecuted."
3. Copyright — what you collect and what you do with it
This is where the data type matters more than the collection method.
Not protected: prices, availability, ratings as numbers, review counts, ASINs, dimensions, specifications. These are facts. Facts aren't copyrightable in the US, and the Feist standard means a database of facts isn't protected simply for existing.
Protected: review text, product description prose, and photography. These are creative expression owned by whoever wrote or shot them. Collecting them for analysis is one thing; republishing them is another.
The July 2026 Google v. SerpApi dismissal reinforced the boundary from a different angle: the court held that the DMCA's anti-circumvention provisions only bite when a technical barrier protects actual copyrighted material, and that search results, URLs, snippets, and factual index data are publicly accessible facts that copyright doesn't reach. We covered the reasoning in what the SerpApi ruling actually means for scrapers.
Applied to Amazon: a price history database is on solid ground. A site that republishes thousands of Amazon reviews verbatim is not.
4. Privacy law — GDPR, CCPA, and personal data
Product data mostly isn't personal data, so this question is often skipped. But:
- Reviewer names and profiles are personal data under GDPR. Collecting and storing them needs a lawful basis and triggers the full set of obligations.
- Seller names can be personal data when the seller is a sole trader rather than a company.
- Aggregating review authorship across products builds a profile of an identifiable person, which is squarely regulated.
If you're scraping reviews, strip or hash the author fields unless you have a specific, defensible reason to keep them and a lawful basis for doing so. The compliance overhead of holding EU personal data is not worth it for a price-tracking project.
The agentic wrinkle: Amazon v. Perplexity
Worth its own section because it's genuinely new and changes the practical picture.
Amazon obtained an injunction against Perplexity relating to agentic browsing on Amazon — an AI agent operating on a user's behalf, logging in and taking actions. We wrote about it at the time in the Amazon–Perplexity injunction.
The load-bearing distinction is authenticated, acting-on-your-behalf agents versus reading public pages. An agent that logs into your Amazon account and operates inside it is doing something categorically different from a tool that reads a public product listing. Amazon's objection was to the former.
Three implications:
- "An AI did it" is not a defence. The legal analysis follows what was accessed and how, not what software drove the browser.
- Authenticated automation is the exposed category. Public reading is not what's being litigated.
- Terms are being rewritten around agents specifically. Expect more platforms to name agentic access explicitly, which strengthens the contract claim even where the CFAA one is weak.
What this means in practice
Reasonably safe
- Extracting title, price, rating, review count, and availability from public product pages.
- Building a price history for competitive monitoring or your own purchasing.
- Analyzing review text for sentiment or themes, without republishing it.
- Collecting your own seller data from your own Seller Central account.
- Browsing-speed collection from your normal session.
Risky
- Republishing review text or product descriptions verbatim.
- Storing reviewer names and profile links, especially for EU users.
- High-volume automated collection that looks like a load problem.
- Building a service that substitutes for Amazon's own product pages.
Don't
- Use proxy rotation or fingerprint spoofing to defeat blocking. That's circumventing a technical control, and it's the behaviour that turns a contract question into a CFAA one.
- Solve or bypass CAPTCHAs.
- Access another account's data, or scrape seller-only areas with credentials you weren't given.
- Continue after receiving a cease-and-desist that names you.
How ScrapeMaster fits
The tool's design deliberately keeps you inside the safe column, and it's worth being explicit about the limits rather than selling around them.
It runs in your browser, in your normal session. It sees pages as you see them — after JavaScript renders, with whatever access you already have. No separate server hitting Amazon from a datacenter IP.
It paces at browsing speed. Extraction proceeds page by page with progress shown in the side panel, and you can configure delays. This isn't a compliance feature so much as a practical one: aggressive extraction on anti-bot-protected sites gets blocked, and Amazon's protection is not gentle.
It does not rotate proxies or fingerprints. This is a deliberate absence. Those features exist to defeat blocking, and defeating blocking is the specific behaviour that converts a terms dispute into an access-control argument.
It does not bypass logins, paywalls, or CAPTCHAs. If you can see it logged in, it can extract it. If you can't see it, neither can it.
Your data stays local. Extracted records live in IndexedDB in your browser. The only network call is during auto-detect, when the page's HTML structure — not its content — is sent to the analysis API to suggest selectors. Exports go to your downloads folder.
Practically, for Amazon: open a search results or category page, click the extension, let it detect the repeating card structure (title, price, rating, review count), rename or drop columns, enable pagination if you want to walk through result pages, and export to CSV. For per-product detail, "follow detail pages" opens each item in a background tab and merges the extra fields back in — use it sparingly, since it multiplies your request count.
Jurisdiction differences in brief
| Jurisdiction | Public data scraping | Key statute | Main risk |
|---|---|---|---|
| US | Generally lawful | CFAA (narrowed by Van Buren, hiQ) | Contract claims; copyright on expressive content |
| EU | Generally lawful | GDPR; Database Directive sui generis right | Personal data in reviews; substantial-extraction from a protected database |
| UK | Generally lawful | Computer Misuse Act; UK GDPR | Similar to EU, post-Brexit divergence limited |
| Canada | Generally lawful | PIPEDA | Personal data; CASL if it feeds email outreach |
| Australia | Generally lawful | Privacy Act | Personal data handling |
The EU's sui generis database right is the one people forget. It protects substantial investment in obtaining, verifying, or presenting a database's contents, independent of copyright. Extracting a substantial part of a protected database can infringe even where none of the individual facts is protected. For a price-monitoring project on a slice of listings, this is rarely the binding constraint — but "we mirrored the whole catalogue" is a different conversation.
Our broader treatment is in the full guide to web scraping legality.
Frequently asked questions
Is scraping Amazon legal?
Collecting publicly displayed product data — title, price, rating, review count, availability — is generally legal in the US, EU, and UK, because that data is factual and publicly accessible, and courts have held that scraping public data doesn't violate the CFAA. Amazon's Conditions of Use separately prohibit automated collection, which is a contract matter whose usual consequence is blocking rather than prosecution.
Does scraping Amazon violate the Computer Fraud and Abuse Act?
Not for public pages. After hiQ v. LinkedIn and Van Buren, accessing publicly available data isn't "unauthorized access." CFAA exposure arises when you circumvent a technical access control — bypassing authentication, defeating an IP block aimed at you, solving CAPTCHAs, or using credentials you have no right to.
Can I get sued for scraping Amazon product prices?
Prices are facts and aren't copyrightable, so a copyright claim over prices alone is weak. The realistic exposure is breach of contract if you accepted Amazon's terms, and the realistic consequence is being blocked. Republishing review text or product photography is a different and considerably riskier matter.
Is it legal to scrape Amazon reviews?
Collecting review text for analysis sits in a grey area; republishing it verbatim does not — review text is copyrightable expression owned by its author. Separately, reviewer names and profile links are personal data under GDPR, so strip or hash author fields unless you have a lawful basis for keeping them.
Will scraping get my Amazon account banned?
It can. Amazon's terms prohibit automated collection, and enforcement is technical: rate-limiting, CAPTCHA challenges, IP blocks, and account action. Browsing-speed extraction from your normal session is far less likely to trigger this than high-volume automated collection, but there's no guarantee.
Does using an AI agent to browse Amazon change the legal position?
Not in your favour. Amazon obtained an injunction against Perplexity over agentic browsing on Amazon, and the analysis follows what was accessed and how — not what software drove the browser. Authenticated agents acting inside your account are the exposed category; reading public pages is not what's being litigated.
What's the difference between scraping Amazon and scraping Google search results?
Legally they rhyme. The July 2026 dismissal of Google's DMCA claims against SerpApi held that anti-circumvention provisions only apply where a technical barrier protects actual copyrighted material, and that search results, URLs, and snippets are publicly accessible facts. Both cases turn on the same distinction between public factual data and protected expression.
Does ScrapeMaster bypass Amazon's bot protection?
No. It runs in your browser using your normal session and paces requests at browsing speed. It doesn't rotate proxies, spoof fingerprints, or solve CAPTCHAs — deliberately, since those are the behaviours that turn a terms dispute into an access-control problem. Aggressive extraction on Amazon can still get you rate-limited.
Bottom line
Public Amazon product data is factual, publicly accessible, and generally lawful to collect. The CFAA isn't your problem unless you're circumventing something. Amazon's terms are your problem, and the consequence is almost always technical rather than legal.
Where people actually get into trouble is predictable: republishing review text, hoarding reviewer identities, and using proxy rotation to defeat blocking. Avoid those three and stick to public factual data at browsing speed, and you're in the well-established part of the law.
ScrapeMaster is free, runs entirely in your browser, keeps extracted data local, and deliberately omits the evasion features that create the risk. CSV, XLSX, JSON, or straight to your clipboard for Sheets.
None of this is legal advice. For anything with commercial stakes, get a lawyer who knows your jurisdiction.
Unrelated and lighter: CineMan AI puts IMDb and Rotten Tomatoes ratings on Netflix, Prime Video, and Disney+ so you stop opening four tabs to pick a film.