Scraping Instagram is legal or not on three separate layers, and the answer differs by layer. Under US law, reading publicly visible data is generally lawful and is not a crime under the Computer Fraud and Abuse Act. Under Instagram's terms, collecting data by automated means without Meta's permission is prohibited, which is a contract matter rather than a criminal one. Under GDPR, CCPA and similar laws, the question is not the reading but what you do with personal data afterwards.
This is not legal advice; it is the map. Mastros makes a read-only Instagram export that reads only what your own account can see, automates no action on your account, and uploads nothing, and the last section says plainly which of those properties matters on which layer.
Is scraping Instagram a crime?
In the United States, the cases point the same way. In hiQ Labs v. LinkedIn (Ninth Circuit, 2022), the court held that scraping data available to the public without logging in does not violate the Computer Fraud and Abuse Act, the federal anti-hacking statute. In Meta v. Bright Data (2024), a federal court rejected Meta's breach-of-contract claim against a company scraping public Facebook and Instagram data while logged out, because the terms Meta relied on bind logged-in users.
Two boundaries come out of those rulings. Data visible without a login is on the safe side of the criminal line. Bypassing a login, using fake accounts, or reaching data a login wall protects is on the other side, and stays there whatever tool is used.
Outside the US the criminal picture varies by country, and the civil picture is dominated by data protection law, which is the third layer below.
What do Instagram's terms say?
Instagram's Terms of Use prohibit accessing or collecting information in unauthorized ways, and name collecting information in an automated way without Meta's express permission as an example. Meta enforces this with technical measures first: rate limits, action blocks, challenges, and account suspensions for accounts that behave like scripts. Cease-and-desist letters and lawsuits are reserved for commercial operations at scale.
Three things are worth being precise about. Breaching terms is a contract matter between you and Meta, not a crime; the consequence Meta controls is your account and its access. The terms apply to logged-in use, which is the point Bright Data turned on. And the enforcement Meta actually applies falls on accounts that act at machine speed, following, liking, messaging, far more than on accounts that read.
What does GDPR add?
A username, a bio, a follower list: these are personal data under GDPR whenever the person is identifiable, which on Instagram is always. Reading them is processing. So a European organisation, or anyone processing EU residents' data, needs a lawful basis, and for scraping that is almost always legitimate interest, balanced against the person's reasonable expectations.
That balance is where most of the practical rules come from:
- Purpose limitation. A creator who published a booking address expects booking enquiries, not a newsletter. Use data for what it was published for.
- Transparency. Article 14 requires telling people whose data you obtained from somewhere other than themselves, within a month, unless doing so is disproportionate. A one-line notice when you first contact someone satisfies most of it.
- Minimisation and retention. Keep the columns you need and delete the list when the campaign ends.
- Where the data is processed. A copy of the list on a vendor's server is a processor relationship, which needs a contract and, if the vendor is outside the EU, a transfer basis. A file on your own machine needs neither.
CCPA and the other US state laws are lighter on the reading and heavier on the selling: personal data collected from a public profile and sold on is where they bite.
Where does a read-only browser export sit?
Take the three layers in turn, honestly.
Criminal law. A browser extension reading pages your own logged-in account can see is not bypassing any login and reaches nothing the platform did not send you. It is not a hacking tool.
Instagram's terms. You are logged in, so the terms apply, and they restrict automated collection. What a read-only extension does not do is the thing Meta's enforcement is built around: it takes no action on your account, adds no requests of its own for anything already on the page, paces every list it reads, and stops when Instagram signals a limit. That reduces the usual causes of an action block; it does not make the terms not apply, and we would rather say so than pretend otherwise.
Data protection. The rows are processed in your browser and written to your disk. No copy exists on Mastros servers, so there is no processor to contract with and no transfer to justify. The lawful basis, the purpose and the retention are yours to get right; the tool cannot do that part for you.
What is allowed, in practice
| Situation | Reading it | Using it |
|---|---|---|
| Public profiles, posts and comments, logged out | Generally lawful in the US | Subject to GDPR and CCPA if personal data |
| The same, from your logged-in account | Instagram's terms apply | Same |
| Your own followers and following | Your data; the data download also gives it | Yours to use |
| A private account you follow | Visible to you; still their data | Expect the narrowest use |
| A private account you do not follow | Not possible, and bypassing it crosses the criminal line | — |
| Direct messages | Only your own inbox, with your consent | Never anyone else's |
| Automated following, liking, messaging | Not scraping; this is what gets accounts disabled | — |
Who this is not for
- Anyone looking for permission to spam. Bio addresses published for collaborations are not consent to a mailing list under CAN-SPAM, GDPR or common sense.
- Anyone who wants to reach a private account they do not follow. There is no lawful route and no working one.
- Anyone who needs a legal opinion for a specific project. This is a map of the layers; a lawyer in your jurisdiction is the one who can tell you where your project falls on it.
FAQ
Is Instagram scraping allowed?
Reading public Instagram data is generally lawful in the US and not a crime; Instagram's terms restrict automated collection and Meta enforces them on accounts, not in court, except at commercial scale; GDPR and CCPA govern what you do with personal data afterwards. The three answers coexist.
Can I go to jail for scraping Instagram?
For reading public pages, no, on the current US cases. For bypassing a login, using fake accounts or accessing private data, the Computer Fraud and Abuse Act is in play. Automated acting on an account is a terms and enforcement matter rather than a criminal one.
Can Instagram detect scraping?
It detects behaviour: request volume, speed, and actions taken at machine pace. A tool that reads what the page already loaded and paces itself looks like a person reading. A tool that hammers the API or follows 200 accounts an hour does not.
Does GDPR apply if I only scrape public data?
Yes. Public does not mean free of data protection; it changes the balance of the legitimate-interest test, not whether the test applies. Purpose limitation, transparency and retention still bind you.
What does Mastros do differently on the legal question?
It reads only what your session can see, takes no action on your account, and keeps the rows on your machine, so there is no third-party copy and no processor. It does not change Instagram's terms or your obligations under data protection law, and it is not affiliated with or endorsed by Instagram or Meta.
Related reading
- Is Telegram Scraping Legal? Your 2026 Compliance Guide — the same three layers on Telegram.
- LinkedIn Scraping Policy — where the hiQ case came from, and what LinkedIn's terms say.
- GDPR-Compliant Chat Data Export — the data protection layer in depth.
- Instagram Scraper — what the read-only extension does and does not do.