Crawl only public pages that need no login; do not bypass anti-scraping, do not touch personal information, and do not sell the data you crawl

Bypassing login, token, signature, and similar protections to take data, when circumstances are serious, brings up to 3 years, or 3 to 7 years if especially serious. Crawling personal information is worse. Location tracks, communication content, credit, and property-type information at 50 records already counts as serious circumstances. Accommodation, health, and transaction types at 500 records, other types at 5000 records, or earning 5000 yuan, likewise

Cost

No money spent. A crawler is a program that automatically flips through web pages and pulls down the data on them. Before crawling, glance at the robots file and any API authorization notes; robots is the file a site puts in its root directory listing which pages must not be scraped. Data that needs a login, a token (a temporary pass string), or a cracked signature to obtain — do not crawl it. The hard part is that technically these data are one grab away; holding back is all self-discipline

Benefit

Taking system data by bypassing protections has the same sentencing range as item 3 (ticket-snatching, flash-sale, and fake-order scripts): up to 3 years, or 3 to 7 years. Illegally obtaining, selling, or providing citizens’ personal information meets “serious circumstances” at any of the following: location tracks, communication content, credit, or property information of 50 records or more; accommodation, communication records, health, or transaction information of 500 records or more; other personal information of 5000 records or more; illegal gains of 5000 yuan or more. Serious circumstances bring up to 3 years and a fine concurrently or alone; especially serious cases bring 3 to 7 years. Official case: software developer Li disguised a function that stole phone albums as a “looks rating” app and obtained 1751 face photos. He also resold social-engineering database material and got 3 years suspended for 3 years. A social-engineering database is a database that aggregates personal information leaked from various places. A network technology company used a crawler to take store and order data from a food-delivery platform, caused over 40000 yuan in losses, and was prosecuted for illegally obtaining computer information system data (nationwide)

Notes

A 2017 judicial interpretation provides that “providing to others information lawfully collected, without the person’s consent” also counts as “providing.” Exporting a user table inside a company to an outside partner falls under the same sentence. 5000 records is only the size of a small table.

Sources · 4

1. 全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款、第二百五十三条之一）. jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925…
2. 最高人民法院、最高人民检察院 (2017). 关于办理侵犯公民个人信息刑事案件适用法律若干问题的解释（第三、四、五条）. spp.gov.cn/xwfbh/wsfbt/201705/t20170509_19008…
3. 最高人民检察院 (2022). 检察机关依法惩治侵犯公民个人信息犯罪典型案例（案例二）. spp.gov.cn/spp/xwfbh/wsfbt/202212/t20221207_5…
4. 最高人民检察院 (2025). 检察机关依法惩治侵害企业数据安全犯罪 服务保障企业创新发展（案例一）. spp.gov.cn/xwfbh/wsfbh/202501/t20250124_68067…