Scraping, Terms of Service and the Limits
The legal position is unsettled and jurisdiction-dependent; the contractual position usually is not. What to weigh before collecting.
Collecting data from a marketplace by fetching its pages raises questions with no single clean answer. This is a description of the considerations, not legal advice; the position varies by jurisdiction and by facts, and it has moved repeatedly.
The separate questions
Contract. Marketplace terms of service typically prohibit automated access without permission. Accepting the terms — by holding an account, in many formulations — creates a contractual obligation independent of any statute.
Computer access law. Statutes in several jurisdictions address unauthorised access to computer systems. Litigation about whether scraping publicly accessible pages falls within them has produced varying outcomes and the position continues to develop.
Copyright and database rights. The data itself, and any protection over a compiled database, differ substantially between jurisdictions. The European position on database rights is notably different from the US.
Personal data. Rank data is not personal data. Review text and reviewer profiles frequently are, and collecting them engages a different and stricter framework entirely.
These are four separate questions and an answer to one does not settle the others.
What is generally uncontroversial
Using an official API within its terms.
Licensing from a commercial provider who has their own arrangements.
Manual observation by a person.
Using data a marketplace publishes for the purpose, such as bestseller lists intended for public consumption, within the stated terms.
What raises the questions
Automated collection at scale against terms that prohibit it.
Circumventing technical measures — rate limits, blocks, bot detection.
Redistributing collected data, which adds a database and copyright dimension.
Collecting review content, which adds a personal data dimension.
Using a login, which strengthens the contractual argument considerably.
The practical position for a business
Take advice for your jurisdiction and your specific use if collection is going to be significant to your operation. Generic guidance is not sufficient for a business decision.
Prefer the API for your own products, always. There is no reason to scrape your own data.
Prefer licensing for competitive data where the cost is bearable. It transfers the question to a provider whose business is answering it.
If collecting yourself, at minimum: respect published rate limits and robots directives, identify your client honestly, avoid authenticated areas, collect only what you need, do not redistribute, and do not circumvent technical measures.
Document your reasoning. A decision made deliberately with advice is a different position from one made by an engineer who did not consider it.
Review data specifically
Worth separating because the framework is stricter.
Review text and reviewer identities are personal data in most privacy regimes.
Collecting, storing and processing it engages obligations around lawful basis, retention, and the rights of the people concerned.
Aggregate counts and average scores are much less problematic than the text and the identities.
If you need review sentiment, consider whether counts and averages suffice. They frequently do, and they avoid the whole question.
The commercial risk beyond law
Blocking. Marketplaces detect and block collection, and a pipeline that is central to your reporting can stop overnight.
Account consequences. For a seller, an enforcement action against the selling account is a far larger problem than the data.
Reputational exposure if the practice becomes visible.
Continuity. A dataset built by means that may have to stop is a dataset with an unstated dependency.
The recommendation
For a seller: API for your own data, licensed provider for competitive data, manual checks for verification. Do not build scraping infrastructure against the marketplace you depend on for revenue.
For an analyst or researcher without a selling account: the contractual position is different and the other questions remain. Take advice, prefer licensed sources, and keep collection modest and well documented.
For anyone: do not treat "the page is public" as settling the question. It answers none of the four.
Questions to put to counsel
If collection matters to your business, these are the questions worth taking to advice rather than resolving internally.
Which jurisdiction's law governs our position, given where we operate and where the marketplace is established?
Does our relationship with the marketplace create contractual obligations — do we hold accounts, have we accepted terms?
Does the applicable computer access statute reach the activity as we intend to conduct it?
Does database or copyright protection apply to the data we would collect and to any onward use?
Are we collecting personal data, and if so under what basis?
What is our exposure if the marketplace objects — contractual, statutory, and commercial?
Bring a specific description of the intended activity, including volume, technical method and use. Generic questions produce generic answers that do not help.