Is Scraping eBay Legal? Policy, ToS & robots.txt

I wanted a straight answer to one question before I pointed a single crawler at eBay: is scraping eBay legal, and if eBay does not allow it, what actually happens if you do it anyway? So I did the boring part. I read eBay’s User Agreement, I pulled its robots.txt, and I read the case law that gets cited every time this comes up. This article is what I found, written for a working engineer in plain terms.

Short version: eBay’s own rules say no to automated access without permission, the criminal-law picture is narrower than most people fear, and the civil-law picture (breach of contract and trespass to chattels) is where the real exposure sits. The data-protection picture is a separate axis again. I will take each in turn, with the primary sources linked so you can verify every claim yourself. I am an engineer, so treat this as a careful reading of public documents. It is not a substitute for a lawyer’s sign-off.

Is scraping eBay legal?

Whether scraping eBay is legal splits into four separate questions, with the answer yes on some axes and no on others. Scraping eBay’s public pages is unlikely to break US criminal law (the CFAA) after recent court rulings, but it does breach eBay’s own User Agreement, a contract issue that falls outside criminal law. It can also expose you to a civil trespass-to-chattels claim if your request volume burdens eBay’s servers, which is exactly how eBay won an injunction in 2000, and it triggers GDPR the moment you collect personal data, even from public pages.

The rest of this guide takes each axis in turn. The first thing to pin down is what eBay’s own policy says, because that is the question with the clearest answer.

Does eBay allow web scraping?

No. eBay does not allow web scraping without its prior express written permission, and it says so in two places that both bind you.

The first is the User Agreement. Its access-and-interference clause prohibits using “any robot, spider, scraper, data mining tools, data gathering and extraction tools, or other automated means to access the Services for any purpose without our prior express written permission.” That language has been in the agreement for years. In the 2026 update, eBay expanded it to name modern automation directly, adding “buy-for-me agents, LLM-driven bots, or any end-to-end flow that attempts to place orders without human review” to the list of prohibited automated means, a change covered by trade press including Modern Retail and Value Added Resource.

The second is robots.txt. eBay’s file mixes specific Allow and Disallow rules with a plain-English statement that the use of robots or other automated means to access the eBay site without eBay’s express permission is strictly prohibited. So the answer to “does eBay allow web scraping” is the same from both the legal document and the technical one.

Here is the distinction that matters and that most blog posts blur:

A policy prohibition is real and enforceable as a contract term. It is a different thing from a criminal statute. Conflating the two is how people end up either paralyzed or reckless. The rest of this guide separates them.

What does eBay’s anti-scraping policy actually prohibit?

eBay’s anti-scraping policy prohibits automated access, automated data gathering, and interference with the site’s normal operation, all without prior permission. It is broad on purpose.

Reading the User Agreement closely, the prohibited conduct falls into a few buckets. I mapped them so you can see what each one targets:

That last row is the bridge to the civil case law. eBay frames heavy automated access as something that burdens its systems, which is exactly the harm a trespass-to-chattels claim needs. I will come back to that.

One more practical point on robots.txt. It is a voluntary standard from the 1990s, and the Robots Exclusion Protocol was only formalized as RFC 9309 in 2022; no statute says “thou shalt obey robots.txt,” so ignoring it will not by itself send you to court. It does two quieter things: it removes any argument that you did not know automated access was unwelcome, and in the EU it directly weakens a legitimate-interest defense, which the regulators have said in plain terms. Treat it as evidence, because that is how it gets used.

Is scraping eBay illegal under the CFAA?

Scraping eBay’s public pages is unlikely to be a federal crime under the US Computer Fraud and Abuse Act (CFAA) after two recent rulings. This is the area where fear and reality diverge the most, so I will be specific.

The CFAA punishes accessing a computer “without authorization” or in a way that “exceeds authorized access.” For years, companies argued that violating a website’s terms of service flipped your access into “unauthorized” and triggered the statute. Two cases narrowed that sharply.

In Van Buren v. United States (2021), the Supreme Court held 6 to 3 that “exceeds authorized access” applies when you reach areas of a system that are off-limits to you, such as files or databases you were never permitted to touch. Using data you are allowed to see for a purpose someone disapproves of falls outside the statute. The Congressional Research Service summary is a clean read if you want the official gloss.

In hiQ Labs v. LinkedIn, the Ninth Circuit applied that logic to scraping. On its 2022 ruling, the court reaffirmed that scraping data from public profiles, where no login or authorization gate stands in the way, likely does not constitute access “without authorization” under the CFAA. Several firm analyses, including Jenner & Block and Loeb & Loeb, walk through the reasoning.

So where does that leave an eBay scraper? Here is the line I drew for myself:

The hiQ outcome carried an important footnote that the headlines skipped. Even though hiQ won the CFAA question, the litigation ended in a December 2022 settlement that included a $500,000 judgment and an admission of liability under California’s trespass-to-chattels and breach-of-contract theories, as Morgan Lewis reported. Beating the federal statute did not make hiQ home free. That is the cleanest possible bridge to the next section.

What happened in eBay v. Bidder’s Edge?

eBay v. Bidder’s Edge, 100 F. Supp. 2d 1058 (N.D. Cal. 2000), is the case that put eBay scraping on the legal map, and it is still the first thing eBay’s lawyers reach for. Every engineer pointing a crawler at eBay should understand it.

Bidder’s Edge ran an auction-aggregation site. To populate it, the company sent an automated crawler against eBay roughly 80,000 to 100,000 times per day. eBay told it to stop, the two sides failed to agree on a license, and Bidder’s Edge kept crawling. eBay sued and asked for a preliminary injunction.

eBay won, and the theory it won on was trespass to chattels, an old tort about interfering with someone’s personal property. The court reasoned that eBay’s servers are property, that Bidder’s Edge accessed them intentionally and without authorization, and that the automated load consumed eBay’s system capacity. On May 24, 2000, the Northern District of California enjoined Bidder’s Edge from using any automated query program or robot to access eBay’s systems to copy its auction database. The parties settled in March 2001.

Three things from that ruling carry straight into 2026:

• The data being public did not save the defendant. The harm was the unauthorized automated load on eBay’s servers, and a public website does not imply consent to that.
• Volume mattered. Tens of thousands of automated hits a day is what made the interference concrete and the injury provable.
• eBay had already said no. A cease-and-desist plus a failed licensing talk made the access knowingly unauthorized, which strengthened the claim.

The lesson I took is simple. Request rate and server burden are the exact facts a trespass claim is built from. Keeping load light is a legal control in its own right, on top of being good engineering. My step-by-step eBay scraping guide goes into the rate-limiting mechanics in detail.

Does GDPR or personal data change whether eBay scraping is legal?

Yes. The moment you collect personal data, such as seller names, usernames tied to a real person, or buyer details, EU and UK data-protection law applies on top of everything above, and “the data was public” is not a defense.

EU regulators have been blunt about this. The principle they keep repeating is that publicly available does not mean free to process. Privacy obligations attach to personal data whether or not it sits on a public page. France’s data-protection authority, the CNIL, has published a focus sheet on legitimate interest for data collection by web scraping, and it leans on the same point: you need a documented lawful basis, usually legitimate interest, and you must run and record a balancing test.

The fines show this is not theoretical. The Italian DPA fined Clearview AI 20 million euros, and the Dutch DPA followed with a 30.5 million euro penalty, both over scraping personal data without a valid basis, as Morgan Lewis summarized. Those are personal-data cases, and that is the distinction to hold onto.

For an eBay project, the cleanest way to stay out of this entire bucket is to scope your collection to facts and away from people:

If your use case is price intelligence, catalog building, or market research, you can usually get everything you need from the columns in the top half of that table and skip the personal-data minefield entirely. When I build pipelines, I default to dropping personal fields at the parsing stage so they never land in storage. My write-up on exporting eBay data to Excel and CSV shows the field selection I use.

How do I scrape eBay data without crossing the line?

You reduce risk by controlling the things the law actually cares about: access method, request volume, what data you keep, and whether you have permission. None of this is legal advice, and a lawyer should sign off on anything commercial. As an engineering matter, here is the checklist I work from.

• Prefer an official or permissioned route. eBay runs a developer program with APIs such as the Browse and Marketplace Insights APIs. Permissioned access is the cleanest answer to “did eBay allow this,” because the answer becomes yes in writing.
• Keep request rates low and human-like. Bidder’s Edge lost on volume. A slow, steady cadence keeps server burden minimal, which keeps the trespass facts thin.
• Stay on public, logged-out pages. The hiQ line protects public data. Scraping behind your own login pulls accepted terms and an authentication gate into the picture.
• Collect facts, drop personal data. Listing attributes and prices carry far less legal weight than information about identifiable people.
• Respect robots.txt and blocks. Honoring the eBay robots.txt and backing off when you are blocked preserves a good-faith posture and your EU legitimate-interest argument.
• Cache and deduplicate. The request you never send cannot burden anyone’s server. Store IDs and fetch only what changed.

For most teams, the hard part is not knowing these rules. It is implementing the rate control, retries, and clean parsing while staying off logged-in pages and out of personal-data fields. That is the work I hand to a scraper API. ChocoData accepts an eBay URL and returns parsed listing data, handling the request management on its side so I stay on public pages at a controlled rate. Here is the exact call I run against a product page:

curl "https://chocodata.com/api/v1/ebay/product?url=https://www.ebay.com/itm/146512345678&api_key=$CHOCO_API_KEY"

That returns the factual listing fields, the title, price, condition, item specifics, without me logging in or pulling seller personal data into storage. For sold and completed prices, the sold and sales data endpoint follows the same shape. If you want to try it on your own targets, you can grab an API key here. For the broader build, including which endpoint fits which job, my comparison of the best eBay scrapers and APIs in 2026 lays out the options.

Where the eBay scraping legal line actually sits

After reading the documents myself, here is the honest summary. eBay’s policy says no to automated access without permission, full stop. US criminal law under the CFAA is narrower than the policy and probably does not reach scraping of public eBay pages. US civil law (breach of contract and trespass to chattels) is the real exposure, and eBay has won on it before, with request volume as the decisive fact. EU data-protection law is a separate track that switches on the instant you collect personal data, public or not.

The practical takeaway is simple. Use a permissioned or public-page route, keep the request rate gentle, collect listing facts while leaving personal data alone, and document what you are doing and why. That combination keeps you on the right side of the facts that courts and regulators actually weigh. When you are ready to build the pipeline itself, start with my step-by-step eBay scraping guide and the Python walkthrough.