Crawls the web, in the European Union

Directive 96/9/EC, Arts. 7-10 · Read the law's page

• Do not extract or re-utilize the whole or a substantial part, evaluated qualitatively or quantitatively, of a database's contents without the maker's authorization, where the maker shows a substantial investment in obtaining, verifying, or presenting that content and is a national or habitual resident of a Member State, or a company or firm formed under a Member State's law with its registered office, central administration or principal place of business in the Community (Art. 11(1) and (2)). Under Art. 43 of Regulation (EU) 2023/2854 the right does not apply to data obtained from or generated by a connected product or related service within that Regulation's scope.
• Do not repeatedly and systematically extract or re-utilize insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests, even where no single extraction takes a substantial part.
• Where lawfully accessing a database the maker has made available to the public, extracting or re-utilizing insubstantial parts for any purpose does not need the maker's authorization, but stop short of conflicting with the database's normal exploitation or unreasonably prejudicing the maker's interests; where you are authorized to extract or re-utilize only part of the database, this applies only to that part (Art. 8(1)).
• Treat the sui generis right as expiring fifteen years from 1 January of the year following the database's completion or, where the database was made available to the public before that period expired, fifteen years from 1 January of the year following the date it was first made available to the public (Art. 10(1) and (2)), and expect a substantial new investment in its contents to start a new term for the resulting database (Art. 10(3)).

Directive 2001/29/EC, Arts. 6-7 · Read the law's page

• Do not circumvent an effective technological measure, as Article 6(3) defines the term, where you know, or have reasonable grounds to know, that circumventing it is what you are doing (Art. 6(1)).
• Do not manufacture, import, distribute, sell, rent, advertise for sale or rental, or possess for commercial purposes a device, product or component, or provide a service, that is promoted for circumvention, has only a limited commercially significant purpose or use other than circumvention, or is primarily designed to enable or facilitate it (Art. 6(2)).
• Do not knowingly and without authority remove or alter electronic rights-management information, as Article 7(2) defines the term (Art. 7(1)(a)).
• Do not knowingly and without authority distribute, import for distribution, broadcast, communicate or make available to the public a work from which electronic rights-management information has been removed or altered without authority, if you know or have reasonable grounds to know that doing so induces, enables, facilitates or conceals an infringement (Art. 7(1)(b)).

Directive 2013/40/EU, Arts. 2(d), 3-12 · Read the law's page

• This Directive is addressed to the Member States (Article 19), which had to bring into force the measures necessary to comply with it by 4 September 2015 (Article 16(1)), so a service meets these rules through each Member State's criminal law; Denmark is not bound by it (recital 32).
• Do not intentionally access, without right, the whole or any part of an information system by infringing a security measure; Member States must make this a criminal offense, at least for cases which are not minor (Article 3). Without right means not authorized by the owner or another right holder of the system or of part of it, or not permitted under national law (Article 2, point (d)).
• Do not intentionally and without right seriously hinder or interrupt the functioning of an information system by inputting computer data, or by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 4).
• Do not intentionally and without right delete, damage, deteriorate, alter or suppress computer data on an information system, or render such data inaccessible; Member States must make this a criminal offense, at least for cases which are not minor (Article 5).
• Do not intentionally and without right intercept, by technical means, non-public transmissions of computer data to, from or within an information system, including electromagnetic emissions from an information system carrying such data; Member States must make this a criminal offense, at least for cases which are not minor (Article 6).
• Do not, without right and with the intention that it be used to commit an offense under Articles 3 to 6, produce, sell, procure for use, import, distribute or otherwise make available a computer program designed or adapted primarily for committing one of those offenses, or a computer password, access code or similar data by which the whole or any part of an information system can be accessed; Member States must make this a criminal offense, at least for cases which are not minor (Article 7).
• Do not incite, aid or abet an offense under Articles 3 to 7, or attempt one under Articles 4 and 5; Member States must make each of these punishable as a criminal offense (Article 8).
• The offenses reach a legal person as well as an individual: Member States must ensure that a legal person can be held liable where an offense was committed for its benefit by a person with a leading position in it (Article 10(1)), or by a person under its authority because a leading person failed to supervise or control (Article 10(2)).
• Member States must establish jurisdiction over these offenses where one is committed in whole or in part within their territory (Article 12(1), point (a)), and in doing so must ensure that they have jurisdiction where the offender commits it while physically present on their territory, whether or not the offense is against an information system there, and where the offense is against an information system on their territory, whether or not the offender is physically present there (Article 12(2)).

Regulation (EU) 2016/679, Art. 9 · Read the law's page

• Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
• Treat any biometric identifier your system derives through its own technical processing for the purpose of uniquely identifying a person as special category data, even where the underlying image or audio was lawfully public.

Directive (EU) 2016/943, Arts. 2-5 · Read the law's page

• This Directive is addressed to the Member States (Article 21), which had to bring into force the measures necessary to comply with it by 9 June 2018 (Article 19(1)), so a service meets these rules through national law.
• Do not acquire a trade secret without its holder's consent by unauthorized access to, appropriation of, or copying of documents, objects, materials, substances or electronic files lawfully under the holder's control that contain the trade secret or from which it can be deduced, or by any other conduct which, under the circumstances, is considered contrary to fair dealing in commercial practice (Article 4(2)).
• Do not use or disclose a trade secret without its holder's consent where you acquired it unlawfully, are in breach of a confidentiality agreement or any other duty not to disclose it, or are in breach of a contractual or any other duty to limit its use (Article 4(3)); the same applies where you knew or ought, under the circumstances, to have known that it had come directly or indirectly from a person using or disclosing it unlawfully (Article 4(4)).
• Acquisition of a trade secret by observation, study, disassembly or testing of a product or object that has been made available to the public, or that is lawfully in your possession as acquirer and free from any legally valid duty to limit the acquisition, is lawful (Article 3(1), point (b)), as is acquisition by any other practice which, under the circumstances, is in conformity with fair dealing in commercial practice (Article 3(1), point (d)).
• Information is a trade secret only if it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question, has commercial value because it is secret, and has been subject to reasonable steps under the circumstances, by the person lawfully in control of it, to keep it secret (Article 2, point (1)).
• An application for the Directive's remedies must be dismissed where the acquisition, use or disclosure was for exercising freedom of expression and information, for revealing misconduct, wrongdoing or illegal activity where the respondent acted for the purpose of protecting the general public interest, for disclosure by workers to their representatives as part of the legitimate exercise by those representatives of their functions where the disclosure was necessary for that exercise, or for the purpose of protecting a legitimate interest recognized by Union or national law (Article 5).

Directive (EU) 2019/790, Article 4 · Read the law's page

• Before relying on the Article 4 exception, check whether the rightholder has expressly reserved the use in an appropriate manner (Art. 4(3)); for content made publicly available online, recital 18 treats machine-readable means, including metadata and the terms and conditions of a website or service, as the appropriate way to reserve it.
• Skip or license content whose rightholder has expressly reserved the use in an appropriate manner, unless the mining involves no protected reproduction or extraction (recital 9) or another exception covers it, such as Article 3 for research organisations and cultural heritage institutions or Article 5(1) of Directive 2001/29/EC for temporary acts of reproduction.
• Mine only content you access lawfully in the first place

Directive 2005/29/EC, Annex I, point 23a · Read the law's page

• This Directive is addressed to the Member States, so a trader meets this rule through national law; Member States had to apply their measures implementing point 23a from 28 May 2022 (Article 7(1) of Directive (EU) 2019/2161).
• Do not resell event tickets to consumers if you acquired them by using automated means to circumvent any limit imposed on the number of tickets that a person can buy or any other rules applicable to the purchase of tickets (Annex I, point 23a); the practice is in all circumstances regarded as unfair (Article 5(5)).
• The rule reaches a trader, meaning a natural or legal person acting for purposes relating to a trade, business, craft or profession, or anyone acting in the name of or on behalf of a trader, in a commercial practice directed at consumers (Article 2, point (b), and Article 3(1)).

Regulation (EU) 2024/1689, Article 5 · Read the law's page

• Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
• Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
• Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
• Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
• Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
• Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.when it serves a public body

Regulation (EU) 2023/2854, Art. 11 · Read the law's page

• This Regulation is binding in its entirety and directly applicable in all Member States (Article 50). Article 11 sits in Chapter III, which applies where, in business-to-business relations, a data holder is obliged under Article 5 or under applicable Union law or national legislation adopted in accordance with Union law to make data available to a data recipient (Article 12(1)), and Article 11 binds users, third parties and data recipients.
• Do not alter or remove the technical protection measures a data holder applies to prevent unauthorized access to data, including metadata, unless the data holder agrees (Article 11(1)).
• Where you are a third party or data recipient who, for the purposes of obtaining data, provided false information to a data holder, deployed deceptive or coercive means or abused gaps in the technical infrastructure of the data holder designed to protect the data, or who altered or removed the data holder's technical protection measures without its agreement, comply without undue delay with the requests of the data holder (and, where applicable and where they are not the same person, of the trade secret holder or the user) to erase the data made available and any copies, to end the production, offering or placing on the market or use of goods, derivative data or services produced on the basis of knowledge obtained through the data in the cases Article 11(2), point (b), describes, to inform the user of the unauthorized use or disclosure and of the measures taken to end it, and to compensate the party suffering from the misuse or disclosure (Article 11(2) and (3)).
• The same duties apply where a third party or data recipient used the data made available for unauthorized purposes, unlawfully disclosed data to another party or did not maintain the technical and organizational measures agreed under Article 5(9) (Article 11(3), points (b) to (d)), and where a user alters or removes the data holder's technical protection measures (Article 11(4)).

Regulation (EU) 2023/2854, Art. 43 · Read the law's page

• This Regulation is binding in its entirety and directly applicable in all Member States, and applies from 12 September 2025 (Article 50).
• Treat data obtained from or generated by a connected product or related service within the scope of the Regulation, in particular in relation to Articles 4 and 5, as outside the sui generis right of Article 7 of Directive 96/9/EC, which does not apply to such data (Article 43).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).