Limit crawlers to public pages requiring no login; do not bypass protections, collect personal data or sell the results
Bypassing access protection can carry up to 3 years, or 3–7 years in serious cases, under Chinese law. Personal information adds further risk: 50 records of movements, communications content, credit or assets can meet a serious-offense threshold; so can 500 accommodation, health or transaction records, 5,000 other personal records, or RMB 5,000 in proceeds.
What it takes
Free. A crawler automatically visits pages and extracts data. Read robots.txt—the site's root-level file specifying crawling restrictions—and API authorization terms first. Do not collect data requiring login, a token (a temporary access credential) or a cracked signature. Technical ease makes restraint difficult.
What you may gain
Bypassing protection to obtain system data carries the penalties described in entry 3: up to 3 years or 3–7 years. Illegally obtaining, selling or providing personal information is serious if any threshold is met: at least 50 records of movements, communication contents, credit or property; 500 records of accommodation, communication logs, health or transactions; 5,000 other personal-information records; or RMB 5,000 illegal proceeds. Serious cases carry up to 3 years and/or a fine; particularly serious cases carry 3–7 years. Developer Li disguised photo-album theft as an attractiveness-rating app, obtained 1,751 facial photos and resold information from a database aggregating leaked personal data; Li received 3 years suspended for 3 years. A technology company crawled a food-delivery platform's store and order data, causing over RMB 40,000 losses, and was prosecuted for illegal acquisition of computer-system data. These are Chinese cases.
Context & considerations
The 2017 interpretation includes giving others lawfully collected information without the person's consent within “providing.” Exporting a company's user table to an outside partner can fall within that wording. Five thousand records fit in a small table.
Research & references
National People's Congress of China (2020). Criminal Law incorporating Amendment XI, Articles 285(2) and 253-1. https://jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925/index.html; Supreme People's Court and Supreme People's Procuratorate (2017). Interpretation on Criminal Cases Infringing Citizens' Personal Information, Articles 3–5. https://www.spp.gov.cn/xwfbh/wsfbt/201705/t20170509_190088.shtml; Supreme People's Procuratorate (2022). Typical Cases of Punishing Crimes Infringing Citizens' Personal Information, case 2. https://www.spp.gov.cn/spp/xwfbh/wsfbt/202212/t20221207_594915.shtml; Supreme People's Procuratorate (2025). Punishing Crimes Against Enterprise Data Security and Supporting Innovation, case 1. https://www.spp.gov.cn/xwfbh/wsfbh/202501/t20250124_680670.shtml