Yes, web scraping is legal in Brazil when conducted within constitutional and statutory boundaries, but unauthorized access to protected data violates the Marco Civil da Internet (Law No. 12.965/2014) and the Criminal Code (Law No. 2.848/1940). The Brazilian Data Protection Law (LGPD) (Law No. 13.709/2018) further restricts scraping of personal data without explicit consent, effective since August 2020. Courts increasingly scrutinize scraping for commercial use, particularly under Law No. 9.610/1998 (copyright protections). The National Data Protection Authority (ANPD) is expected to issue 2026 guidelines clarifying enforcement priorities, focusing on automated collection of sensitive or proprietary data.
Key Regulations for Web Scraping in Brazil
- LGPD Compliance: Scraping personal data requires a lawful basis (consent, legitimate interest, or contractual necessity) under Articles 7–10, with penalties up to 2% of global revenue for violations.
- Unauthorized Access Prohibitions: Article 154-A of the Criminal Code criminalizes accessing systems without authorization, with penalties of 3 months to 2 years imprisonment or fines.
- Copyright Restrictions: Article 46 of the Copyright Law permits limited scraping for private study or criticism but prohibits systematic extraction of protected content, as affirmed in STJ rulings (e.g., REsp 1.823.122).
Practical Considerations Brazilian jurisprudence distinguishes between public and private data; scraping publicly available information without circumvention tools (e.g., bots bypassing CAPTCHAs) is generally tolerated, but repurposing such data for commercial gain risks litigation. The ANPD’s 2026 framework may introduce mandatory impact assessments for large-scale scraping. Entities should implement robots.txt compliance and data minimization to mitigate risks.