Crawls the web, in Israel
Each law's tag says when it binds: since in force proposed proposed
Computers Law, unlawful penetration of computer materialsince 2 lines
Computers Law, 5755-1995 (as amended 2012), s. 4 (unlawful penetration of computer material), s. 5 (penetration to commit another offence) · Read the law's page
- Do not connect with, communicate with, or operate a computer or its material without authorization; doing so to commit a further offence under another law raises the maximum term to five years.
- Whether reading a public, unauthenticated page without defeating any access control falls inside this section has not been confirmed by a reported decision.
Copyright Act, Fair Usesince 1 line
Copyright Act, 5768-2007, s. 19 (Fair Use) · Read the law's page
- A general fair-use exception may cover using copyrighted text to train a machine-learning model, judged case by case against the four fair-use factors, but no text-and-data-mining-specific carve-out or opt-out mechanism exists to rely on instead.
Privacy Protection Regulations (Data Security), information security programmesince 5 lines
Privacy Protection Regulations (Data Security), 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement) · Read the law's page
- An app operating a database of the personal data of a person in Israel, above the small-collection thresholds already recorded on this jurisdiction's privacy-topic row, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption, and incident handling, scaled to the security-level tier (basic, medium, or high) that the volume and sensitivity of the data it holds places it in.
- At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.
- At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.
- At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.
- Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.
Privacy Protection Authority — Guidance on Privacy-Enhancing Technologies (PETs) in Artificial Intelligence Systems (2025)since 0 lines
Privacy Protection Authority (Rashut Haganat Hapratiyut), Guide on Privacy-Enhancing Technologies for Artificial Intelligence Systems, published late December 2025
Privacy Protection Authority — Draft Guidelines on the Application of the Privacy Protection Law to Artificial Intelligence Systems (2025)proposed6 lines
Privacy Protection Authority (Rashut Haganat Hapratiyut), Draft Guidance on Application of the Privacy Protection Law, 5741-1981 to Artificial Intelligence Systems, published ; public comment period closed
- This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Disclose to users when they are interacting with a chatbot or other automated system.
- Provide a meaningful description of how your AI functions.
- Offer users a path to human review for decisions with significant consequences.
- Have a lawful basis before collecting personal data with AI crawlers.
- Apply purpose limitation and data minimization to personal data used to train AI models.