Every team that starts collecting public data asks the same question, usually in the same anxious tone: is this allowed?
It is the right question, but it is almost always aimed at the wrong half of the process. Collecting publicly accessible information is the part most teams get right by default. Contacting the people in that data is where the actual obligations live, and it is where teams get into trouble.
This is a practical guide, not legal advice. If you are operating at scale or in a regulated sector, talk to a lawyer who knows your jurisdiction.
The two questions are separate
**Question one: can I collect this?** This concerns access — whether retrieving the information is permitted.
**Question two: what can I do with it?** This concerns processing and communication — data protection law, anti-spam law, and the rules about contacting people.
These are governed by different bodies of law, and the answer to the first tells you nothing about the second. Public availability is not consent. A phone number published on a business website is published so customers can call about that business, not so that anyone may add it to a marketing sequence.
The collection side
The distinction that matters is whether information is genuinely public — visible to anyone with a browser and no account — or behind some form of access control.
Collecting genuinely public pages is broadly established as lawful in several jurisdictions, and courts in the US have repeatedly declined to treat scraping public pages as unauthorised access. That is the settled-ish end of the spectrum.
The unsettled end involves anything behind a login, a paywall, or a technical restriction. Bypassing authentication moves you from "reading a public page" into territory covered by computer-misuse law, and the fact that the underlying data feels public does not help you.
This is why every VoxScrape source collects public pages only. Nothing logs into an account, defeats an access control, or retrieves data from behind a paywall. It is also why "can you scrape private profiles?" has a short answer.
Platform terms of service are a separate axis. They are a contract between the platform and its users, and breaching them is generally a contractual matter rather than a criminal one — but it can still get an account restricted, and "technically not illegal" is thin comfort when your account is gone.
The use side, which is where the risk actually is
Here is the part that gets skipped.
**Under GDPR**, business contact data about identifiable individuals is personal data. Someone's work email is personal data. Their name and job title are personal data. You need a lawful basis to process it, and for B2B outreach that is usually legitimate interests — which requires an actual assessment, documented, weighing your interest against their reasonable expectations. You also owe transparency: people have the right to know you hold their data and where you got it.
**Anti-spam law** operates independently of data protection. CAN-SPAM in the US requires accurate headers, a functioning unsubscribe mechanism, and a physical postal address in the message. CASL in Canada is materially stricter, generally requiring consent before the first message rather than after. Several EU states impose stricter national rules on top of GDPR.
**Do-not-call registers** apply to phone outreach in many markets, with real penalties, and they are checked against rather than negotiated with.
The practical consequence: the compliance work is not in the collection step you were worried about. It is in the outreach step you were planning to do next week.
Special categories, and lists not to build
Some data is off-limits regardless of how public it appears. Health information, biometric data, political opinions, religious belief, trade union membership, and sexual orientation are special categories under GDPR with a much higher bar for processing.
Related: do not build dossiers on private individuals. B2B prospecting means contacting people in a professional capacity about their work. Compiling comprehensive profiles of private persons is a different activity with a different risk profile, and no amount of "but it was all public" makes it acceptable.
Our terms prohibit both, along with using the service to collect data in violation of applicable law, to build spam lists, or to target anyone on the basis of a protected characteristic. Those are not decorative clauses.
A workable checklist
Before a campaign:
- **Document your lawful basis.** For legitimate interests, write the assessment down. An undocumented basis is functionally no basis when someone asks.
- **Check the recipient's jurisdiction, not just yours.** Canadian recipients bring CASL regardless of where you sit.
- **Include a genuine opt-out**, honour it immediately, and keep a suppression list that survives your next list rebuild.
- **Be able to say where the data came from.** People have the right to ask, and "we bought a list" is a worse answer than "collected from publicly available business listings".
- **Keep the data current.** Retaining a stale contact list indefinitely is its own compliance problem. Rebuilding beats hoarding.
- **Contact people about their work**, in their professional capacity, about something plausibly relevant to their role.
The uncomfortable but useful summary
If your outreach only works because the recipient has no idea how you found them and no way to make you stop, the problem is not really legal — it is that the outreach is bad. The compliance requirements and the practices that produce good reply rates point in almost exactly the same direction: contact fewer, more relevant people, with a clear reason, and make it easy to opt out.
Teams that treat compliance as a constraint on volume usually discover their results improve when they comply, because volume was never what was working.
