Web crawling: how far does it go — the 4 criteria for collecting data legally

Web crawling can be done legally. In Decision 2021Do1533, the Supreme Court found the defendant not guilty on all three charges — violation of the Information and Communications Network Act, computer-related obstruction of business(컴퓨터등장애업무방해), and copyright infringement — for collecting information from a competitor’s app API server. The dividing lines are three, in target and in method.

Area	Basis provision	What to check in the design
Access rights	Information and Communications Network Act §48(1)	Protective measures such as login or CAPTCHA; does the terms of service prohibit collection
Personal information	Personal Information Protection Act §15(1)	Do names or contact details get mixed in. If they do, settle the legal basis first
Works and databases	Copyright Act §16, §93(1)(2)	Copying everything to reprocess it, or using only the necessary part

① Access rights — did you enter a restricted place

Article 48(1) of the Information and Communications Network Act prohibits “intruding on an information and communications network without legitimate access authority or beyond the permitted access authority.”

How far counts as a “restricted place” is settled by the Supreme Court.

Whether the service provider has restricted access authority must be judged carefully by comprehensively considering the circumstances objectively revealed, such as protective measures and terms of service.

— Supreme Court Decision 2021Do1533, decided May 12, 2022

robots.txt is not a protective measure. The standard (RFC 9309) itself pins down that it is “not a substitute for effective content security measures.” Violating it does not immediately make you unlawful, and following it does not guarantee legality. Read it and follow it, but it alone is no reason to relax.

② Personal information — is information about people mixed in

Article 15(1) of the Personal Information Protection Act enumerates in a closed list the cases in which collection and use are permitted (consent, special provisions of statutes, conclusion and performance of a contract, etc.).

If names, contact details, or addresses get mixed in, you are subject to separate regulation regardless of whether crawling is involved. Settle the purpose and legal basis first, then start.

③ Works and databases — how much you take

The maker of a database has “the right to reproduce, distribute, broadcast, or transmit the whole or a substantial part” of it (Copyright Act §93(1)).

This is where practice gets it wrong. A single item is not a “substantial part,” but scraping a little at a time over a long period is not fine — if the repeated, systematic collection results in the same outcome as reproducing a substantial part, it is treated as infringement (§93(2)).

All you need is the target data and desired method. We outline a legally compliant collection architecture and feasible scope at no cost first, and if you are considering outsourcing, actual data collection projects start from KRW 150,000.

→ Pricing Guide & Our Work · Inquire on scope

To keep beyond the three

• Don’t burden the server — keep the collection interval at a human-use level and limit the number of parallel requests. Sending bursts makes it a way of interfering with a third party’s service.
• Don’t hide that you are a bot — put the purpose and a contact point in the User-Agent.

Order of checking

1. Read the target site’s terms of service and robots.txt yourself
2. Determine whether the collection target is personal information or a substantial part of a database
3. If the matter is tangled, get review from a legal professional

There is a reason step 1 comes first. Apart from the law, there are cases where the terms set the scope — especially owner- and seller-facing systems used after login. Before it is a legal question, it is a contractual one, so checking first means nothing needs to be redone later.

One more thing. 2021Do1533 is a criminal case. The fact that a criminal acquittal came down must not be read as there being no civil liability either.

In short

Most collection can be done without problems. That is exactly why the Supreme Court acquitted on all three charges — as long as you don’t enter places that are blocked, don’t touch personal information, don’t move someone else’s database wholesale, and don’t strain the server.

What gets blocked is usually not “can we” but “how far.” Draw that line first and nothing needs to be undone after it is built.

When you judge for yourself, the place where things actually get stuck is not legal interpretation but what comes after it — when the terms have no explicit provision, when the target is a screen behind login, when it is ambiguous whether personal information is mixed in. These cases cannot be settled by reading the provisions alone; the judgment settles only when the collection design is examined alongside them. Ask for a collection design review and we’ll lay it out for you by target.

---

All we need is the address of the site you want to collect from.

Tell us in one line what you want to collect, and we’ll first check the terms, robots.txt, and whether personal information is involved and lay out whether it’s possible and how far. You can decide whether to start development after the review.

→ Ask whether collection is possible · Work we’ve done

---

References

• Information and Communications Network Act Article 48(1) · Personal Information Protection Act Article 15(1) · Copyright Act Articles 16, 93(1) and 93(2) [verified — National Law Information Center(국가법령정보센터)]
• Supreme Court Decision 2021Do1533, decided May 12, 2022 [verified — original judgment. All 3 indicted charges acquitted]
• RFC 9309 Robots Exclusion Protocol [verified — IETF, 2022]