Scraping platform data in the Netherlands: what is allowed?

Scraping publicly accessible platform data is not prohibited as such under Dutch law, but reusing it can infringe the platform’s database right, copyright, its terms of use or the GDPR. The main exception on the criminal side: if you break a login wall, a security measure or use a false key to get the data, that can be computer intrusion under Article 138ab of the Dutch Criminal Code (Wetboek van Strafrecht, Sr), punishable by up to two years’ imprisonment.

Whether scraping is lawful therefore depends on how the data is obtained, what is stored and how it is made available again. Below we set out the five legal frameworks, the risk per collection method, AI training data and enforcement.

Is public data free to reuse?

No. Data that is visible without logging in may still be protected. Anyone who collects, stores and reuses platform data works at the intersection of database rights, copyright, contract law, criminal law and data protection law.

The question arises for price comparison sites, recruitment tools, market research firms and, increasingly, for parties collecting training data for AI models. In each case the outcome turns on the method of collection, the nature of the data and the intended use.

Which collection method carries which risk?

Three models can be distinguished: linking and embedding, independent retrieval and storage, and retrieval that circumvents technical restrictions. The risk rises with each step.

This matrix is a first indication, not a rule of law. Linking to freely accessible material does not reach a new public in copyright terms, but framing, misleading presentation or trade mark use can still create liability.

When does the database right protect a platform?

The database right protects the producer of a database if obtaining, verifying or presenting its contents required a substantial investment (Article 1 of the Dutch Databases Act, Databankenwet). The producer may then prohibit the extraction or reuse of a substantial part, and the repeated and systematic extraction of smaller parts where this conflicts with normal exploitation (Article 2 Databankenwet).

The right lasts fifteen years from 1 January of the year after the database was completed (Article 6 Databankenwet). Circumventing effective technical measures that protect a database is unlawful in itself (Article 5a Databankenwet).

Does the investment in creating data count?

No. In British Horseracing Board v William Hill (CJEU 9 November 2004, C-203/02) the Court of Justice held that only investment in obtaining, verifying and presenting existing data counts, not the cost of creating it.

For platforms with user-generated content this cuts both ways. Users upload content themselves, so obtaining it costs the platform little. Protection then depends on proven investment in verification, moderation, indexing and presentation, backed by figures on staff, infrastructure and systems, not on the size of the user base.

Does a meta search engine reuse a database?

It can. In Innoweb v Wegener (CJEU 19 December 2013, C-202/12) the Court held that a service forwarding real-time search queries to another party’s database and showing the results in its own interface reuses that database, even if it stores nothing permanently. That reasoning applies to many scrapers and alternative front ends.

Does the text and data mining exception help?

Partly. Under Article 15o of the Dutch Copyright Act (Auteurswet), reproduction for text and data mining is allowed if you have lawful access and the rightholder has not expressly reserved its rights, for online works by machine-readable means. Article 15n Auteurswet contains a broader exception for research organisations and heritage institutions doing scientific research.

Article 4a Databankenwet applies the same exceptions to the database right. A machine-readable opt-out, for example in robots.txt instructions or API metadata, therefore closes this route for commercial miners.

Who holds the copyright in platform content?

In principle the individual users who wrote or made it, if the content is their own intellectual creation (Infopaq, CJEU 16 July 2009, C-5/08). Short, factual posts often do not meet that threshold, so there may be nothing to protect.

Platforms usually receive only a non-exclusive licence in their terms of use. Under Dutch law a non-exclusive licensee cannot sue for infringement on its own; it needs a mandate from the rightholders. The platform can, however, rely on its own rights in its user interface, icons and trade marks, and a service that copies those elements to look familiar gives the platform a ground for action.

When is linking or copying a new communication to the public?

Three Court of Justice judgments set the line. Linking to a work that is freely accessible is not a new communication to the public (Svensson, 13 February 2014, C-466/12). Copying a work to your own server and making it available is (Renckhoff, 7 August 2018, C-161/17). Framing that circumvents technical protection measures also reaches a new public (VG Bild-Kunst, 9 March 2021, C-392/19).

Are a platform’s terms of use binding on scrapers?

Only if a contract has been formed. A registered user who clicked to accept the terms (click-wrap) is in principle bound; a visitor who only sees a link to the terms at the bottom of the page (browse-wrap) often is not.

Almost every platform prohibits automated access in its terms, and creating accounts automatically to scrape is quickly a breach of contract. A contractual claim has practical limits: it binds only the counterparty, loss is hard to prove for a free platform, and a penalty clause is often missing. Platforms therefore usually combine it with database rights, copyright or tort (Article 6:162 of the Dutch Civil Code, BW).

What is the Ryanair paradox?

In Ryanair v PR Aviation (CJEU 15 January 2015, C-30/14) the Court of Justice held that the user rights in the Database Directive do not apply to a database protected by neither copyright nor the database right. The operator may then restrict reuse by contract. The weaker the intellectual property position, the stronger the contract may be.

The case went back to the Hague Court of Appeal, which assessed whether the browse-wrap terms had been accepted under the law chosen in those terms rather than under Dutch law (Gerechtshof Den Haag 23 January 2018, ECLI:NL:GHDHA:2018:61). Where a database is protected, the opposite applies: the producer may not prevent a lawful user from extracting insubstantial parts, and a contract cannot deviate from that to the user’s detriment (Article 3 Databankenwet).

When is scraping a criminal offence?

When it amounts to computer intrusion (computervredebreuk): intentionally and unlawfully entering an automated system. Under Article 138ab(1) Sr this is in any case so if access is gained by breaking a security measure, a technical intervention, false signals or a false key, or by assuming a false identity; the maximum penalty is two years, or four years if data is then copied (Article 138ab(2) Sr).

Sending requests faster than the provider wants, ignoring robots.txt or registering an account through a public form does not in itself amount to intrusion; it may breach the terms of use, which is a civil matter. The risk rises sharply when technical barriers are defeated, such as reusing intercepted authentication tokens or API keys, or deliberately bypassing CAPTCHA systems. Whether that qualifies as intrusion depends on how the security works and what the user intended.

What does the GDPR require when scraping personal data?

As soon as scraped data can be traced to individuals, such as usernames, profile photos, posts or IP addresses, the GDPR applies and the scraper is usually the controller. The fact that the data is public does not remove the data subjects’ rights.

Scrapers often rely on legitimate interests as the legal basis. That requires a documented assessment of purpose, necessity and a balancing of interests that includes the reasonable expectations of the people concerned; with sensitive data, large-scale monitoring or profiling, the balance often falls against the scraper. The GDPR exempts the duty to inform data subjects where this is impossible or disproportionate, but all other obligations remain: purpose limitation, data minimisation, a record of processing, security, the rights of access, objection and erasure, and a data protection impact assessment for large-scale processing. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises compliance, independent of whether the platform acts.

Can you use scraped data to train an AI model?

Possibly, but collecting, storing and training are separate acts, each with its own test. Collecting and temporarily storing training data may fall under the text and data mining exception of Article 15o Auteurswet, but only as long as the rightholder has not reserved its rights in a machine-readable way.

If the training set includes a substantial part of a protected database, the database right still applies. Under the GDPR you need a sound legal basis and usually an impact assessment, and it is technically difficult to honour erasure or rectification requests once data has been absorbed into a trained model. Platforms with weak intellectual property can still restrict AI training through their terms if a contract has been formed. See also our article on AI systems under the AI Act.

How do platforms enforce against scrapers?

Proving the scraping is rarely the problem: server logs, IP ranges, request patterns and planted canary data show where data came from. Identifying an anonymous operator is harder.

A hosting provider can be obliged to disclose the operator’s identity if the content is plausibly unlawful and harmful, the claimant has a real interest, there is no less intrusive way to obtain the data and the claimant’s interest prevails (HR 25 November 2005, ECLI:NL:HR:2005:AU4019, Lycos v Pessers). Most cases are brought in summary proceedings (kort geding) for an injunction with a penalty. Platforms also send notices to hosting providers, CDN services, app stores and registrars; the EU Digital Services Act provides a standard notice-and-action procedure for this, but does not itself decide what is unlawful.

What should you check if you collect platform data?

Check these points before you start collecting:

• Whether you collect a substantial part of a database, or repeatedly extract smaller parts.
• Whether the platform has a machine-readable text and data mining reservation.
• Whether you accepted terms of use that prohibit automated access.
• Whether your method bypasses a login wall, token, CAPTCHA or other security.
• Which personal data you collect, your legal basis and your retention period.
• Whether you can actually execute access and erasure requests.

What should you check as a platform protecting its data?

Check these points to strengthen your position:

• That your investment in verification, moderation, indexing and presentation is documented in figures.
• That users accept your terms actively on registration, not only through a footer link.
• That you have a machine-readable text and data mining reservation.
• That your technical measures are effective, so circumvention is unlawful under Article 5a Databankenwet.
• Which rights you hold yourself, such as rights in the interface and trade marks.

What can we do for you with scraping and data reuse?

Our IT lawyers advise both companies that collect third-party data and platforms that protect their own. We can:

• Assess your collection method against database rights, copyright and Article 138ab Sr.
• Draft or review terms of use and a machine-readable mining reservation.
• Carry out or review the GDPR balancing test and the impact assessment.
• Send a cease-and-desist letter or a notice to a hosting provider or registrar.
• Bring or defend summary proceedings for an injunction or disclosure of identity.

Summary

• Scraping public data is not prohibited as such; how the data is obtained, stored and reused decides its lawfulness.
• The database right protects substantial investment in obtaining, verifying or presenting data for fifteen years (Articles 1, 2 and 6 Databankenwet).
• Commercial text and data mining is allowed only without a machine-readable reservation (Article 15o Auteurswet).
• Breaking security or using a false key can be computer intrusion under Article 138ab Sr.
• Public personal data remains protected by the GDPR; the scraper is usually the controller.

Frequently asked questions