Is Email Scraping Legal? Complete Guide to Regulations and Lawful Uses

What is email scraping (definition and how it works)

Email scraping – also called email harvesting – is the practice of automatically collecting email addresses from online sources. In plain terms, it means using software or scripts (known as scrapers, bots or harvesters) to comb through web pages, social networks, public databases or other digital documents looking for strings of text that match the format of an email address. These programs can follow links from one site to another and sift through huge numbers of pages in a short time, building lists of email contacts along the way. Scraping often goes beyond a single source: for example, some scrapers use search engines themselves, firing off automated queries to find pages that contain email addresses, and then extract that data.

How does it work in practice? Picture a web crawler similar to the ones search engines use: it visits a site, copies its HTML content and looks for any text shaped like an email (for example “something@domain.com”). Every address it finds is “harvested” and added to a list. Some advanced tools can also extract related information, such as the name associated with the email, phone numbers or linked social profiles. The process is largely automated: instead of manually copying addresses from a web page, the software does it for you, even across hundreds or thousands of pages.

It is worth making clear that email scraping does not send any email by itself: it is just a data collection technique. However, the reason it is done is often to send messages to those addresses (for example for email marketing campaigns). And that is where the biggest legal and ethical problems arise. Email scraping is a double-edged sword: on one hand it can serve legitimate and useful purposes, on the other it is sadly notorious for being used by spammers and bad actors.

Why would anyone scrape emails? The reasons vary: some people use it to quickly build a mailing list of potential customers, others to network and find B2B contacts, others to collect data for analysis or market research. For example, a company might extract emails from public LinkedIn profiles or from the members of an industry forum to identify leads interested in its services. There are also virtuous cases: journalists or researchers who collect email addresses published on institutional websites in order to contact experts, or developers who build directories of professionals from public sources. So yes, lawful uses exist and they are not necessarily bad.

Unfortunately, though, the most common (and problematic) intent is to collect a large number of emails in order to send unsolicited communications – in other words, spam. Many spammers and cybercriminals have automated address collection to launch mass phishing or unwanted advertising campaigns. This abuse has made email scraping a controversial practice, often associated with privacy violations and illegal activity. So much so that in many contexts the question “Is it legal to collect emails online?” comes precisely from the fear of straying into spamming or illegality.

To sum up the definition: email scraping is a technique (neither good nor bad in absolute terms) for extracting email addresses from the web in an automated way. Like any tool, it must be used responsibly. In the next sections we will look at when this tool can be used lawfully and when it becomes illegal, in light of current regulations and best practices.

Regulations: GDPR, privacy and email marketing laws in Italy

Let’s talk about the law now. In Europe (and therefore in Italy) the key framework is the GDPR – the General Data Protection Regulation (EU 2016/679) – together with the national rules that transpose the so-called ePrivacy Directive (Directive 2002/58/EC) on electronic communications. In addition, Italy has Legislative Decree 196/2003 (the Privacy Code), updated by Legislative Decree 101/2018, which supplements the GDPR on specific aspects such as promotional communications by email. Before acronyms and article numbers scare you off, let’s look at what these rules actually provide regarding scraping and the use of email addresses collected online.

Email = personal data: what the GDPR implies

The first thing to understand is that an email address is considered personal data (unless it is a generic business email like info@company.com, but if it contains a first name/surname or identifies a person, it counts as personal data). The GDPR protects personal data across the board: every time you “process” (that is, collect, store or use) information that identifies a natural person, you must comply with specific obligations. This applies even if the data is publicly available on the internet. So, extracting emails from the web means carrying out personal data processing and requires a lawful legal basis and compliance with principles such as transparency and purpose limitation.

Careful: the fact that data is public does not mean it is “free for all”. On this point the Italian Data Protection Authority (the Garante) has been clear, stating that taking personal data from publicly accessible sources without authorization can violate the GDPR. In other words, even if you find an email on a public website, you are not automatically allowed to capture it and use it as you please, especially if the use you intend to make of it is sending unsolicited commercial communications.

The GDPR does not explicitly mention “web scraping”, but it lays down general rules on the collection of personal data. In short, to comply with the law you should: have the data subject’s explicit consent (or another valid legal basis) to collect and use that data; collect data only for specific and legitimate purposes; inform the person about what data you are collecting and why. You can easily see that in the context of email scraping for marketing these conditions are hard to meet: people who scrape rarely ask each individual for prior consent (it would be a contradiction, since you are collecting them precisely because you do not already have contact with them), and informing every person after taking their email is logistically complex – even though, strictly speaking under the GDPR, there would be an obligation to provide a privacy notice under Art. 14 when data is not obtained directly from the data subject.

Are there legal bases other than consent? In theory yes: the GDPR also provides for legitimate interest as a possible basis for processing personal data, and Recital 47 even explicitly mentions that “legitimate interest could exist, for example, where personal data is processed for direct marketing purposes”. Some people might therefore think: “Great, then I can collect emails without consent by relying on my commercial legitimate interest in finding customers.” But careful: when it comes to sending electronic communications (email, SMS, etc.) for promotional purposes, the ePrivacy rules step in, and in Europe they require the user’s consent as a general rule, overriding the more flexible GDPR approach. In other words, for promotional emails the special law still requires prior consent, and legitimate interest cannot be used to justify spam. The Italian Garante has repeated this in several decisions: consent remains the indispensable basis for sending commercial emails to people you have never contacted before.

To sum up from the GDPR/privacy side: scraping in itself is not prohibited, but if it collects personal data you must comply with legal obligations. Without a legitimate basis (which, for direct marketing, is practically only consent, except for the exceptions below) you are breaking the law. In addition, the GDPR imposes the principles of minimization and purpose limitation: you should not use data collected for one purpose for a different one without permission (e.g. taking emails from a public register created for institutional purposes and using them for advertising is considered unlawful “purpose shifting”). And don’t forget data subjects’ rights: even if you collect emails from public sources, people have the right to know you hold them in your files, to ask for their deletion, and so on – rights that are hard to guarantee if you are operating “under the radar”. Further on we will see how to mitigate these problems, but first let’s clarify the other side of the regulatory coin: anti-spam and email marketing laws.

Consent, spam and soft opt-in: the rules for email marketing

Besides the GDPR, anyone who wants to send commercial emails must comply with the rules on unsolicited communications. In Italy and in Europe, sending promotional emails to someone without their explicit consent is generally illegal. This is the golden rule laid down by Art. 130 of the Italian Privacy Code, which transposes the ePrivacy directive. Translated: you cannot send newsletters, offers or marketing messages by email unless the person (or company) has first given you permission. The only exceptions concern very specific cases, as we will see in a moment.

The Garante also stressed this recently, penalizing companies that had collected email addresses from public online lists and sent advertising without consent. In a 2023 case, for example, a company had extracted professionals’ emails from websites and public registers, claiming to have a legitimate interest in contacting them and invoking Recital 47 of the GDPR. The result? A fine and a stop to the processing: the Authority reaffirmed that it is not lawful to send promotional communications by email without consent, even if the addresses come from public sources such as registers, directories or websites accessible to anyone. It also clarified that the presence of personal data in public directories or on social networks does not authorize its use for marketing purposes, since those purposes are incompatible with the original purpose of publication and beyond the data subject’s legitimate expectations. In short, the fact that a professional publishes their email in a professional register, or that a user writes their contact on a forum, does not at all mean they agree to receive advertising. From a legal standpoint, without a manifestation of consent, that use is considered spam.

Let’s now look at the one important exception provided by Italian law: the famous soft opt-in (or “soft spam”). This is what is set out in Art. 130, paragraph 4, of the Privacy Code. Under this rule, you can send commercial communications by email without having collected new consent only if: (1) you obtained that email address in the context of selling a product or service (so the recipient is already your customer); (2) your emails concern products or services similar to those already purchased by that person; (3) the data subject, at the time the data was collected, was informed that they could object to the use of the email for promotional purposes, and is always given an easy way to unsubscribe. In practice, the soft opt-in lets you send offers on your products to your current customers without having to ask for permission every time, but only as long as you meet those conditions. As soon as you step outside that perimeter (for example you contact someone who is not your customer, or you promote something completely different from what they bought), you are back under the general rule: consent is required.

It is important to understand that the soft opt-in is not a “green light” for scraping: it applies only to those with a prior commercial relationship. If you are thinking of exploiting it to send emails to contacts you found online who don’t know you, know that it doesn’t work that way. The Garante has stated that this exception does not apply if there is no prior relationship between sender and recipient. Even in the case of the professionals contacted by the fined company, the defense tried to invoke Art. 130(4), but the Authority rejected the argument precisely because those recipients “had no prior relationship” with the company, nor could they have expected to receive those emails.

In short, to do lawful email marketing you must have the recipient’s permission before emailing them, unless they are already your current customer. Forget about hoping to find some loophole in the GDPR: for promotional emails the path is set by the explicit consent requirement. This puts a huge limit on the “wild” use of email scraping: if you intend to use those addresses for generalized commercial campaigns, without having consent, you are essentially preparing a spam shipment, with all the legal (and reputational) risks that come with it.

Before moving on to practical cases, one last important regulatory distinction: B2C vs B2B.

Email scraping in a B2B (business) context: do the same rules apply?

Many people wonder whether the rules change when the recipients are not private consumers but companies or professionals (so-called B2B email marketing). There is a widespread idea that “if I email VAT-registered professionals or companies it’s different, I can do it even without consent”. Let’s clear this up.

On one hand, the GDPR protects the data of natural persons, so formally it does not apply to the data of legal entities (such as a company’s generic email). This would mean that sending a message to info@company.com is not personal data processing, and so the GDPR is not relevant. In addition, the ePrivacy directive leaves it to individual Member States to decide whether to also protect communications to legal entities. Some EU countries in fact allow opt-out for B2B emails (that is, you can email companies without consent as long as they are given the chance to unsubscribe).

In Italy, however, the situation is peculiar: our Privacy Code extends the consent requirement to communications to “contracting parties”, who can be collective entities. Art. 130 in fact speaks of the consent of the contracting party or user both for natural persons and, in effect, for legal ones. As a result, Italian practice treats B2B email marketing the same as B2C: the recipient company’s prior consent is still required. Not only that: if the business email address is personal (e.g. first.last@company.it), you are in fact processing that person’s personal data, and so you fall fully under the GDPR as well as the anti-spam rules.

What does this mean in practice? That even collecting the email addresses of companies or professionals from the web does not authorize you to spam them. For example, you might think: “I found a purchasing director’s email on an industry directory, it’s a business contact so I can pitch my services.” From a strictly legal standpoint, even that purchasing director has the right not to receive unsolicited promotional communications, exactly like a private citizen. The Garante has explicitly stated that without consent you cannot send promotional emails even if the data comes from websites or professional public directories, and it has penalized companies for B2B spam in the same way. The logic is that even a professional has a right to “privacy of communications” and not to be bothered by unwanted commercial messages.

That said, in practice many businesses run B2B cold email activity (cold-contacting other companies), trying to frame it not as “spam” but as normal commercial communication between two parties potentially interested in doing business. For example, emailing a company to propose a collaboration or present a service could be seen as similar to a sales phone call. Some consultants suggest that a single personalized contact, addressed to a business manager and relevant to their business, could fall under a sort of legitimate interest (especially if the address is public and professional). However, this remains a gray and risky area: formally, in Italy, any promotional email without consent is prohibited, barring a prior relationship. If the recipient company complains, the sender may face penalties.

In conclusion, B2B email scraping does not get around the rules: if you collect the addresses of companies or professionals from the web, you can use them legally only in very limited ways (for example to contact someone once, in a personalized and non-recurring form, hoping not to annoy them – and being ready to apologize and delete the contact if they’re not interested). For large-scale email marketing campaigns, on the other hand, you will always need to have obtained the recipients’ consent, even if they are companies. In the tips section we will see how to proceed with caution in these cases.

After this necessary regulatory overview, let’s move on to analyze the concrete cases in which email scraping can be considered legal or not, with practical examples.

When email scraping is legal and when it is banned

We have seen that the legality of email scraping depends mainly on how and for what purpose the collected addresses are used. So let’s look at some typical situations, separating the lawful ones from the unlawful or inadvisable ones.

Cases where email scraping is legal (or acceptable)

• Non-personal data or non-commercial uses: If you extract only non-personal data or aggregated information, the GDPR does not apply at all. For example, collecting generic email addresses like info@company.com, with no reference to individuals, does not involve personal data (but careful: if that address is read by an identifiable natural person, you could still touch their personal sphere). Another example: a statistical study that counts how many “@domain.it” emails exist on certain pages, without storing individual data, violates no privacy rule. In general, extracting public information for statistical research purposes, without identifying or contacting people, is lawful and outside the scope of the GDPR. Many cases of legal web scraping concern precisely non-personal data: product prices, anonymous reviews, market data. If you limit yourself to that, no problem. But as soon as you enter the territory of personal data and contacts (name, email, phone), you must follow the rules seen above.

• With the data subject’s consent: The simplest case (although extremely rare in practice) is when you have prior consent. For example, suppose you run a site where users publish their profile (including email) and explicitly accept that others may contact them with job offers. In that case, if someone else “scrapes” that data to contact the users, consent to the use could be considered implicit in the terms accepted. A real example: some public classified ad sites show sellers’ emails; whoever copies that email to make an offer on the item for sale is using the contact for its intended purpose (buying and selling) and is therefore legitimate. In general, though, when there is consent, we are no longer even talking about “cold” scraping – it is simply an authorized use of the data.

• Soft opt-in / contacts from existing customers: We described the soft spam exception. Well, if you collect the email addresses of your customers (for example you export them from your CRM or your e-commerce store) and use them to send communications about products or services similar to those they have already purchased, you are in the clear as long as you meet the conditions (privacy notice, clear opt-out in every email, etc.). Careful: here we are not strictly talking about “scraping from the web”, because you got the data directly from customers, but it is worth mentioning among the lawful cases: you do not need new consent to upsell through a newsletter to that customer base. Of course it remains prohibited to expand that list with addresses found online that are not your customers: you cannot “mix” consenting and non-consenting contacts and claim it is soft opt-in for all of them.

• Business contacts published for business-contact purposes: A somewhat borderline but generally accepted case: if a company (or a professional) voluntarily publishes its email address inviting people to contact it for work reasons, then using that email for a consistent purpose could be considered lawful or at least tolerated. For example, if on a supplier’s site you find “Write to sales@supplier.com to request a price list”, you can certainly write to that email to request the price list. Or, on LinkedIn, a professional lists their email saying “contact me for professional opportunities”: if you contact them with a relevant job proposal, you are within their expectations. This falls under normal B2B communications, not perceived as spam because they relate to the data subject’s activity. Here too, though, the line is thin: contacting a company through an official channel (like the sales email) is very different from taking an employee’s personal email and pitching them at random. When in doubt, keep the contact personal and respectful (e.g. “Dear Mr. Rossi, I found your details on your company’s website. I am writing to you because…”). A single targeted, contextual, non-automated email will hardly trigger spam accusations, especially if the recipient sees a legitimate interest in the proposal. The important thing is to stop if you get no reply or if disapproval is expressed.

• Scraping for internal and analytical purposes (without sending emails): It can happen that a marketer scrapes emails not to send messages, but for analysis or data enrichment. Example: I extract lists of emails from a forum only to understand how many users use certain email domains (gmail, yahoo, etc.) and calibrate my campaigns accordingly. Or I cross-reference the collected emails with other databases to profile an audience (without contacting anyone directly). These are rare scenarios, but in theory, if there is no unwanted communication and the data stays in aggregate form, the legal risk is much lower. You still need to be careful: even holding archives of “scraped” personal emails without a legitimate reason is unlawful processing. If that data serves only to extract anonymous statistics and you then delete it, you might fall within GDPR exceptions (such as processing for statistical purposes in aggregate form). In any case, this is a situation that concerns data analysts more than marketers.

• Scraping at the request of the user themselves: Then there is the case where the owner of the email address has an interest in spreading their contact. For example, imagine a freelancer who uses Mailerfind to collect the public emails of the members of a certain Facebook group, but only after getting authorization from the group’s administrators or the users (perhaps through an initiative in which members agreed to share their contacts for networking). In that case there is no problem, because you are simply automating data collection with the blessing of those involved. These, however, are very specific, agreed-upon situations, not “wild scraping”.

In general, email scraping is safe and legal when it violates no one’s privacy or expectations. If you extract anonymous data or don’t use it for commercial purposes, you’re fine. If instead you obtain addresses with consent or at least with a clear expectation of being contacted, you are in reasonably safe territory, although you still need to handle the communication well (for example by including the privacy notice when you then contact the person).

Cases where email scraping is illegal or inadvisable

• Collecting emails to send spam/promotions without consent: This is the classic case and it is decidedly illegal. If you use a scraper to collect hundreds or thousands of generic email addresses from the web and then launch an email campaign pitching your product, you are violating Art. 130 of the Privacy Code and the GDPR, which amounts to spam. It doesn’t matter if the addresses were published on a website: as we have seen, the law still requires consent. And it doesn’t matter if your message “might interest them”: that judgment is not yours to make but the recipient’s, who should have had the chance to choose beforehand. This scenario is exactly what you would not want: throwing away your reputation by sending unsolicited emails, risking complaints and fines. To give you an idea, GDPR penalties for unlawful processing (such as mass emailing without a legal basis) can reach up to 20 million euros or 4% of annual turnover, in the most serious cases. More realistically, the Garante could impose fines in the order of tens or hundreds of thousands of euros, as has already happened for telephone or email spam campaigns. In a nutshell: scraping + mass sending = illegal and strongly discouraged.

• Selling scraped email lists: Even worse than the previous case: if besides collecting emails, you resell or share them with third parties for commercial purposes, you are aggravating the violation. First of all, whoever buys those lists and uses them for spam commits an offense in turn, but you yourself could be held responsible as a “supplier” of unlawfully obtained data. Some rulings have established that creating email databases from the web and reselling them entails unlawful use of personal data and contributes to any penalties. Incidentally, these lists are often low quality (full of outdated or irrelevant contacts) and harm those who use them. Profiting from reselling scraped data is not legal and can cost you dearly if you are found out.

• Violating Terms of Service or anti-scraping measures: Besides privacy laws, there is another legal aspect: many websites expressly prohibit scraping in their Terms and Conditions. If to collect emails you have to break the site’s rules (for example getting past a CAPTCHA, ignoring a robots.txt file that excludes certain pages, or circumventing access restrictions), you could incur contractual or even criminal violations. In the US there was the well-known case LinkedIn vs HiQ: LinkedIn tried to block a company that scraped public profiles. In court HiQ prevailed on the criminal front (no violation of the CFAA, the anti-hacking law, because the data was public), but LinkedIn can still take civil action for violation of its terms. In Italy, using bots on social platforms or sites could breach the terms of use and lead to cease-and-desist letters or lawsuits for unauthorized access to computer systems if you push it too far. Even the Italian Garante suggests that sites include anti-scraping clauses in their terms of service to protect themselves. So, if you are thinking of scraping emails from a platform, first check whether they allow it: if it is explicitly prohibited, strictly speaking you are acting illegally (besides risking a ban).

• Extracting “special” or sensitive data: So far we have talked about generic emails. But be careful not to stumble into special categories of data. If you are incidentally also collecting information about the person (for example the email is “first.last@association.doctors.it” and from the context you infer they are a doctor, hence data relating to their membership of a professional order; or the email belongs to someone and you end up processing related sensitive data published next to it), you risk even more serious violations. The GDPR prohibits processing sensitive personal data (ethnic origin, health, beliefs, etc.) except under specific exceptions. So, never scrape emails in the context of health, religious, political data, etc. (e.g. don’t extract emails from a forum of sick people to pitch miracle cures – besides being ethically reprehensible, it would be illegal to the highest degree!).

• Targeted spam via PEC or “official” channels: A special case is sending spam to PEC addresses (certified email) taken from the public register of businesses/professionals. On this point the Garante has expressly intervened: it declared it unlawful to use PEC addresses taken from the national register to send advertising or commercial proposals. PEC was created for institutional and legal communications, so clogging it with promos is prohibited (besides being highly irritating for those who receive it). The same goes for institutional emails or official channels: don’t take the email of a municipality or a public body to send commercial proposals – it amounts to spam toward a public administration, with possible consequences.

• “Blind” mass scraping with no target: Even though strictly speaking it adds no new offenses, it is worth citing as a worst practice the indiscriminate scraping of any email you find, without regard to relevance. Besides being illegal as seen, it is also a strategic disaster: you would send communications to lots of people outside your target, getting terrible results and spam reports. This “spray and pray” approach is that of Nigerian-prince scammers, not serious marketers. If you really want to use contact-collection techniques, do it in a targeted way, as we will see shortly.

In short, any scenario in which you are collecting emails without people’s knowledge and then contacting them for promotional purposes without their prior consent is prohibited or highly inadvisable. This is the heart of the legal issue: protecting privacy and the voluntary nature of receiving marketing communications.

Lawful scraping vs spamming: what’s the difference?

By now you will have understood that “email scraping” and “spamming” are not synonyms, but they can often overlap if you’re not careful. Let’s draw a sharp distinction to avoid misunderstandings:

• Scraping is a data collection method. In itself it is neutral: you can scrape any public information on the web (emails, numbers, prices, texts) and, if you stay within the technical and legal limits, you are not yet “bothering” anyone. For example, if I extract 100 emails from websites and save them in an Excel file, no one has received anything from me yet. I may have broken some privacy rule if I keep that data for no reason, but the real impact on third parties is still nil. Scraping therefore becomes problematic when it is aimed at an improper use.

• Spamming is the act of sending unwanted communications. It is spam when you send messages (emails, SMS, calls) to recipients who did not ask for them and have no prior relationship with you, in bulk or at least repeatedly. Spam is what the law explicitly penalizes and what users hate: inboxes clogged with unwanted commercial emails.

How do the two concepts connect? Often, those who spam obtained the addresses precisely through scraping (or by buying lists that in turn derive from scraping). But it’s not the only way: you could also spam by sending emails at random (generating username combinations, for example), or by contacting addresses taken from business cards without permission. On the other hand, you could scrape emails with no intention of spamming, for example for analysis as mentioned, or for good purposes (imagine collecting NGOs’ emails from their website to send a charitable partnership request – it is still unsolicited contact, but it would hardly be seen as “malicious spam”).

The substantial difference lies in respect and relevance. Lawful scraping happens when the collected data is used in a way that conforms to the data subjects’ expectations or to the rules: for example, I collect emails of users who consented to receive a newsletter – technically I am “scraping” from my own CRM database, but of course it is lawful. Or I use a scraper to extract the addresses of conference attendees that were made public on the website (knowing they probably want to network) and I contact them by sending material related to that conference. In these cases, even though automation is involved, there is no “spam” because there is either consent, a shared interest, or at least a clear relevance between sender and recipient.

The border with spam therefore lies in the absence of permission and relevance. If you send emails in bulk without permission and without a real connection to the recipients, then you are spamming – regardless of whether you obtained the addresses via scraping or otherwise. And legally, as we have seen, that falls under prohibited practices. Conversely, if you contact someone in a targeted way, with a personal and potentially useful message, and you respect their wishes, you can’t be labeled a spammer even if the contact was not initially “opt-in”. For example, in B2B many cold email approaches try not to be spam precisely by focusing on personalization and value: if I write to a company saying “I read your site and I think my service X could save you on costs – if you like, let’s talk, otherwise sorry for the interruption”, I am trying to create a desirable communication, or at least a relevant one. I won’t necessarily succeed, but it is certainly different from sending a generic flyer to 10,000 emails in BCC.

To sum up: lawful scraping fits into ethical and compliant data collection and use strategies (permissions, transparency, relevance); spamming is the opposite, that is, the indiscriminate use of data for aggressive marketing without authorization. In the next section we will see exactly how to use scraping in a compliant and strategic way, citing a practical example of cold email from Instagram with the help of Mailerfind – so you can understand how to find a balance between exploiting the potential of scraping and not slipping into the illegal or the ineffective.

Scraping emails from Instagram and sending cold emails: the Mailerfind case

A very common scenario today: extracting emails from social networks (e.g. Instagram) and cold-contacting those users with a commercial proposal. Is it legal to do so? And how can you do it in practice without falling into spam? Let me tell you about my personal experience with Mailerfind, a tool specialized precisely in finding contacts on Instagram and sending targeted cold emails, which I use in my day-to-day work.

Is it legal to extract emails from Instagram?

Instagram, like other social networks, does not directly show the email of private users. However, many business or creator profiles on Instagram make a contact email public (there is often an “Email” button on the profile). In addition, there are methods to infer or discover emails linked to an account through links in the bio, personal websites or external services. In principle, if the user has voluntarily made a contact public on Instagram (for example an influencer who writes “📩 for collaborations: name@email.com” in their bio), that information is public. Collecting it with a scraper is not very different from copying it by hand – technically you are not breaching a private area, nor “hacking” Instagram. So, the purest act of scraping in itself is lawful (Instagram might object if it were against their terms, but here we are talking about taking data the user themselves exposed).

The real question is: can I legally use those emails to contact people? We always come back to the usual point of consent. If that user published their email “for collaborations”, they implicitly expect to receive proposals – in that case sending an email introducing yourself and proposing a collaboration falls within legitimate expectations. For example, many influencers put their email precisely so that brands or agencies contact them with partnership offers: writing to them about it will not be perceived as spam, indeed it is often part of the game. It is different if you take the non-public emails of followers or of random users and send them advertising for your product: those users don’t expect it and will see it as spam. In addition, as we have established, the law still requires consent to send promotional communications to natural persons. So even with Instagram contacts you need to be careful: the fact that an email is public on a social network does not give you carte blanche for mass advertising. You need to approach it strategically and in a compliant way.

How to use Mailerfind ethically and in compliance

Mailerfind is a tool I started using because it lets me automate lead generation on Instagram really efficiently. In practice, the platform lets you enter any Instagram profile (for example that of an influencer in my industry, or of a competitor) and then collects for me the email addresses and other public data of that profile’s followers. Usually, the followers of a given account have related interests: if I choose the “source” account well, I get lists of potential customers interested in my industry. Mailerfind extracts not only emails (when available), but also other useful information such as the IG username, phone number, website, geographic location and even interests, if it can infer them. All of this from public sources – I stress: Mailerfind does not “break into” private accounts, it collects what is visible (for example, many business profiles on Instagram show the contact email).

Once you have this data, Mailerfind’s real strength is that it directly integrates a bulk email sending platform (Mailerhub) designed for cold outreach. This means I can immediately prepare an email campaign to the contacts found, all within the same tool. The sending platform is optimized: it has anti-spam filters, gradual sending systems, open tracking and a claimed delivery rate of 97%. In practice, it is built to make sure my cold emails don’t end up in spam and that the reputation of my sending domain stays clean (which is crucial, because a few mistakes are enough to get your emails blocked by providers).

But how do you reconcile this with legality and ethics? Here is how I personally use Mailerfind responsibly:

• Accurate targeting: First of all, I carefully choose the Instagram profiles to extract contacts from. For example, I recently promoted my web marketing agency’s services. I identified a popular Italian Instagram account that shares business and marketing tips for small businesses (@lucenathor, for instance) – assuming that its followers are business owners or aspiring entrepreneurs interested in marketing. Using Mailerfind, I extracted the contacts of its most relevant followers (those who had a public email in their bio or linked to it). That way I got a list of highly targeted potential leads, instead of a generic mass of random people. This is essential: fewer but more qualified contacts is always better than shooting into the crowd. I also avoid including those who are clearly private individuals with no relevance (if Mailerfind hypothetically found the email of some random user who follows the profile only out of curiosity and has no professional interest, I would generally discard it).

• Personalized and transparent messages: Once the list is ready, I prepare the outreach email. This is where the art of not looking like spam lies: I write an email that is personal, short and shows value and context right away. For example, in the email in question I wrote something like: “Hi [Name], I discovered you through the [IG profile name] community on Instagram. I see you are an entrepreneur in the [X] industry – on your profile I noticed your passion for improving your business’s marketing. I also work in this field: my agency helps businesses like yours get more clients online. I took the liberty of contacting you because I’ve prepared a short free report with some specific ideas for companies in your industry, and I think it might interest you. I’d be happy to send it to you, just let me know! In any case, if you’d rather not receive any more emails from me, just click below. Thanks for your time.”. As you can see, I mention how I got the contact (Instagram), I highlight a shared interest and I offer something useful (the free report) instead of selling right away. Very important: I always include an opt-out sentence, a polite one, along the lines of “if you no longer want to receive emails from me, click here and I won’t bother you any further”. Mailerfind/Mailerhub makes it easy to include the unsubscribe option and handles list management automatically. This way, even if I initially didn’t have formal consent, I am giving the recipient full control: they can ignore me, they can tell me “no thanks”, or – hopefully – they may be interested and reply.

• Gradual sending and monitoring reactions: I never fire off thousands of emails all at once. Mailerfind lets you limit the number of sends per day, somewhat simulating “manual” sending to avoid alarming anti-spam filters. For example, I can decide to send 50 emails a day for 10 days instead of 500 at once. I also monitor opens and replies: if I see that nobody opens or everyone trashes them, I stop and rethink the approach. If someone asks to be removed, I remove them immediately. This is both out of respect and to protect reputation: fewer annoyed people = fewer spam reports.

• Data verification and cleaning: Another crucial aspect: Mailerfind has an email address verification feature before sending. This means it checks whether the extracted emails actually exist and can receive mail (reducing bounces, that is, messages that come back). This matters because sending to non-existent addresses damages the sender’s reputation. In addition, I myself filter the list to remove any duplicates or clearly odd contacts. Better a small, valid list than a huge one full of errors.

Thanks to these precautions, I have managed to use email scraping in a compliant and profitable way. For example, from the campaign described I got some positive replies and we started commercial negotiations. Nobody insulted me for spam (those who weren’t interested simply didn’t reply or clicked unsubscribe, and that’s perfectly fine). This confirms that a well-done cold email can open doors, as long as you stay ethical and respectful.

Mailerfind, for its part, advertises that it wants to offer an ethical tool for scraping and email marketing. On their site and blog you will find guidelines on how to use data in a “clean” and legal way. For example, they suggest how to extract contacts in a targeted way, verify leads and manage automatic follow-ups without being intrusive. In practice the platform gives you the technical means to be compliant, but it is up to you to use it correctly. It’s not that by using Mailerfind you are magically authorized to spam: applying what we have discussed on the regulatory side remains your responsibility. Personally, I really appreciate that they have integrated anti-spam controls and the automatic unsubscribe option, because that way even a less experienced user is guided toward more respectful sending practices (for example, you can’t forget to put the unsubscribe link because it is part of the Mailerhub template).

And the legal side? If you follow the scheme I described, you are still operating somewhat outside the letter of the law (in theory you don’t have consent), but you get close to the spirit of the law: you contact only those who might be interested, you immediately give them the chance to decline, and above all you don’t repeatedly harass those who don’t engage. In B2B, this “responsible cold email” method is fairly tolerated and widespread. As long as the numbers are contained and the messages relevant, it is unlikely that anyone will report you over a single polite email. After all, even the Garante, when it steps in, does so on massive and repeated campaigns, not on a single reasonable commercial approach. Clearly, if you want zero legal risk, the only way would be to obtain explicit consent before every send – but how do you get consent from someone you still have to write to? It’s a paradox. That is why in real life those who do cold lead generation operate in this “light gray” zone: with common sense and moderation, managing to generate business without irritating anyone and without ending up in the authorities’ sights.

In short, Mailerfind legally handles scraping on Instagram and cold email sending by giving you a controlled environment: it collects only public data (thus respecting Instagram and basic privacy), gives you tools to verify and segment that data, and integrates a sending system with anti-spam best practices (opt-out links, limited volumes, high deliverability). It is then up to you to write honest content, target the right people and respect those who are not interested. By doing so, you turn a potentially “borderline” technique into a marketing strategy that is ethically sustainable and also effective. I can testify that it works: in my day-to-day, Mailerfind has saved me hours of manual work and brought concrete contacts that turned into clients, all without landing me in the spam folder.

Tips for using email scraping responsibly and profitably

Let’s close the discursive part with some practical tips I have learned in the field. If you want to use email scraping without getting into trouble and actually benefit your business from it, always keep these key points in mind:

• Stay informed about the rules and keep up to date: Privacy regulation can change and interpretations evolve. We have seen how the Garante issues guidelines (like the one from May 2024 against indiscriminate scraping) and decisions that clarify the lawful boundaries. Make an effort to stay up to date on the GDPR and Italian law (perhaps by following legal blogs or using services like Iubenda). When in doubt, better to be cautious. Don’t take for granted that “everyone does it anyway”: often “everyone” does it badly. Compliance is not just bureaucracy, it is also quality for your contact base.

• Be selective: quality > quantity. I will never tire of repeating this: better to have 50 good, interested contacts than 5000 picked at random. When you scrape, set filters, segment by industry, geographic area, interests – any criterion that sharpens relevance. Avoid collecting addresses that clearly have nothing to do with your goal: they are just noise that will increase the chances of complaints. A well-defined audience will let you create more targeted and welcome messages. For example, if you sell software for restaurants, you don’t need a lawyer’s email just because you found it online! Focus on restaurateurs.

• Always do opt-in when possible: Scraping should be the last resort, not the first. It is always better to build lists organically, making sure people are the ones who leave you their email (perhaps through a form on your site, in exchange for useful content, etc.). I know, here we are talking about scraping because maybe you are in a hurry to find fresh leads – fine, but consider scraping as a way to break the ice, after which you should still get that contact to give you real consent. For example, after the first cold contact, if you see interest, explicitly ask whether they would like to subscribe to your newsletter or receive updates. That way you turn a “cold” contact into a “warm” and consenting one. Don’t keep sending promotional emails to a cold lead if you have never obtained their clear OK.

• Transparency and respect from the very first message: In the initial communication, introduce yourself clearly, explain in one line how you got their details (e.g. “I found you in the X group on Facebook” or “I saw your profile on Instagram”) and above all offer something of value right away before asking. It can be a tip, free content, a personalized suggestion. Make it clear that you did your homework: the email must not look like mass-produced junk. And of course, always include the option to stop receiving communications: it is a legal obligation for newsletters, but I recommend adding it to one-to-one emails too if they are part of a commercial action. A simple “P.S. If you’d rather I not contact you again, just let me know – no problem at all” is already fine in a personal B2B context. In more automated campaigns, on the other hand, include the classic unsubscribe link. This transparent approach builds trust: many people appreciate honesty and, even if they are not interested, they won’t report you as spam because you gave them control.

• Protect data and respect rights: Once you have collected email addresses, safeguard them carefully. You are, to all intents and purposes, a data controller for that data, so apply security measures: keep it in protected environments, don’t leave CSV files full of emails on public desktops or on cloud services without a password. In addition, if someone replies asking “Where did you get my data?” or exercising the right to erasure, you must be ready to provide answers and delete their data. For this reason too, as a best practice, keep track of the source from which you extracted each contact (e.g. “this address came from the Instagram profile @xyz, collected on date X”). It will help you demonstrate good faith and handle any requests.

• Don’t ignore the signals: adapt quickly. If your scraping-based emails don’t work – for example you have very low open rates or you receive negative replies – don’t persist out of pride. Analyze what you are doing wrong: maybe the targeting is off, maybe the subject line and text need revising. Maybe you are trying to approach an industry where cold emails are not appreciated. Listen to the feedback (even silence is feedback) and correct course. Remember, too, that tools like Mailerfind offer statistics and sometimes suggestions: use them to improve. For example, you might discover that certain company domains block all external mail: no point continuing with those, better to change strategy (maybe try a contact on LinkedIn rather than by email, in that case).

• Frequency and follow-ups: keep them reasonable. A mistake that slides you into spam is bombarding with messages someone who has never replied. My advice: no more than a couple of follow-ups spaced days/weeks apart, and only if you have something new to add. If after 2-3 attempts the contact doesn’t react, leave them in peace. If instead someone showed interest but then disappeared, a reminder can be useful – but always graciously. Here too, many tools (Mailerfind included) let you automate conditional follow-ups (e.g. “if they don’t open the first email within 5 days, resend a slightly different second message”). Use them but in moderation: don’t do 10 follow-ups, you would get the opposite effect.

• Respect technical limits (rate, volumes, etc.): On the technical side, to avoid problems, respect any indications from the site you scrape (e.g. the sections allowed by robots.txt) and don’t overload servers. This is not only a legal matter but also one of netiquette: if you launch a scraper that makes 100 requests per second to a small site to collect emails, you could crash it – and that could actually amount to an offense (service disruption). Serious scraping tools let you set a delay between requests. In addition, as already said, if a site clearly says “extracting our data is prohibited”, consider whether to take the risk or ask for permission. For example, you could contact a forum’s administrator asking whether you can get the list of members’ emails (perhaps offering something in return): often they will say no, but at least you avoided doing it behind their back. In general, act ethically on the technical side too: don’t be the “bad bot” that ruins other people’s experience.

• Document your process: It might seem excessive, but keeping a log of scraping activities and of the campaigns that derive from them is useful. Note down dates, sources, purposes, measures adopted. This is even recommended by the GDPR (Art. 30, record of processing activities) and demonstrates accountability. If anyone ever challenged your activity, being able to show that you planned it carefully and considered the privacy aspects works in your favor. Even just for internal use, these notes help you replicate what worked and avoid what failed.

• Put people first, not your own needs: This is an almost philosophical but fundamental principle. If you see email addresses only as numbers or “targets to bombard”, you will end up spamming. If instead you remember that behind every email there is a person with desires, problems and daily annoyances like all of us, then you will write and act more empathetically. Effective email marketing (even cold) is not about talking to an address, but to a real person. So always ask yourself: “Would I appreciate this email I’m about to send if I were the one receiving it? Does it offer something useful or is it just noise?”. This will help you keep a human tone and build relationships instead of annoyances.

With these tips, I hope I have given you a complete and honest overview of how to reconcile the opportunities offered by email scraping with respect for the rules and for the people involved. Email scraping can be a very powerful tool for freelancers, marketers and entrepreneurs, but it must be used with intelligence, tact and respect for the rules. Doing it “by the book” takes a bit more effort than carpet-bombing with spam, but the results are far better: genuinely interested contacts, a clean reputation, no legal hassles and even a competitive advantage because you present yourself from the start as a serious professional.

Let’s now move on to the frequently asked questions (FAQ) to recap the key points and clear up any last specific doubts.

FAQ – Frequently asked questions about email scraping, GDPR and regulations

Is collecting email addresses published online legal?

It is legal to collect email addresses if they are publicly visible and there is no explicit prohibition (you are not breaching access systems). However, using those addresses for marketing purposes without consent is not legal in Italy. So: you can copy or extract emails from a public site (they generally won’t come after you for reading a web page), but if you then send promotional emails to those contacts without permission you are violating the anti-spam rules. Exceptions: if you use them for personal, statistical or other non-commercial purposes, or if the data subject expects that contact (e.g. they published the email saying “write to me for information”), the legal risk is minimal. In short, scraping in itself is generally lawful, sending unsolicited commercial communications is not.

Does the GDPR allow scraping of personal data?

The GDPR does not expressly prohibit web scraping, but it requires that every processing of personal data have a legal basis and comply with certain principles. So if you scrape personal data (emails, names, etc.), you must have, for example, the data subjects’ consent, or another basis (legitimate interest, performance of a contract, etc.) and you must inform people about the data collected and its use. In the case of scraping for marketing purposes, as explained, the only valid basis is practically consent. Without consent, collecting and using that data “represents a clear infringement of the GDPR” according to the Garante. So the GDPR itself does not punish using a bot to collect public information, but it punishes the use of that information in a way that is incompatible with people’s privacy. In addition, if you scrape personal data online on a massive scale, you might fall under the obligation of a data protection impact assessment (DPIA) or other measures provided by the GDPR for large-scale processing. In practice: you can scrape while respecting the GDPR only if you collect non-personal data, or if you obtain consent, or if you then use the data for very limited purposes (e.g. research) and non-identifying ones.

Can I send promotional emails to a company or professional without consent? (B2B)

In Italy, no, it is not permitted to send commercial communications by email to anyone (not even companies, organizations or professionals) without having obtained prior consent. Our legal system treats the private user and the professional user the same as regards protection from unwanted communications. So, if you take a company’s email from its site and send it advertising, you are violating Art. 130 of the Privacy Code. The only exception is if that company is already your customer and you fall under the soft opt-in (offers similar to those already purchased). It must be said, however, that in practice personalized B2B cold emails are tolerated, especially if sent individually and relevantly. For example, contacting a potential business partner with an email will almost never be pursued as spam, unless it becomes harassing or massive. But from a strictly legal standpoint, consent would be required even for “business” recipients. So the advice is: maximum moderation in B2B and behave as if the same rules as B2C applied. If you run campaigns to many companies, better to collect consents (e.g. invitations to subscribe to a business mailing list). If you make single approaches, make sure they are welcome and one-off.

What is soft opt-in (or soft spam) in email?

It is the exception to the consent rule for email marketing. It allows a company to send promotional emails to its customers without having collected specific consent for those communications, provided that:

• the email address was provided directly by the data subject in the context of a sale of a product/service (e.g. they gave it to me when they bought from me);
• the messages concern similar products or services to those already purchased by the customer (so no completely different or third-party offers);
• in every message the recipient has the possibility to opt out (unsubscribe) easily;
• when you collected the email, you informed the person that you would use it to send them offers, giving them the chance to object right away.
  This exception, provided for by Art. 130 paragraph 4 of the Privacy Code, allows for example an e-commerce store to send promotional newsletters to its customers without having to ask for consent for the newsletter (as long as it meets the conditions above). It is called soft because it presupposes an existing relationship and a sort of “soft interest” on the customer’s part in staying updated. Important: it applies only to active customers and similar products. You cannot use the soft opt-in for contacts who have never bought anything from you, nor to push just anything (there must be consistency with the purchase made). If in doubt, it is safer to collect explicit consent anyway.

What penalties do you risk with illegal scraping and spam?

Violations can lead to heavy administrative penalties. For email spam, the Garante can impose fines under the GDPR: for processing without a legal basis (such as sending marketing without consent) the theoretical maximum penalty is 20 million euros or 4% of annual worldwide turnover, but in practice fines depend on severity, number of people involved, any prior offenses, cooperation, etc. For example, there have been fines of a few thousand euros for small businesses caught spamming, up to hundreds of thousands for improper mass marketing operations. Besides the Garante’s fines, remember that the annoyed recipient could take legal action: in theory they can sue for unlawful use of data or, more concretely, they can report the spam to email providers, leading to your account or domain being blocked. Another serious consequence is reputational damage: if you are labeled a spammer, your future messages will automatically end up in spam, wasting every email marketing effort (even legitimate communications). In extreme cases, if to scrape you breach protected computer systems, a criminal offense could arise (unauthorized access to a computer system, Art. 615-ter of the Criminal Code). But usually the scenario is: fine + order to delete the data + ban on further use if you get caught spamming with scraped lists. Better to avoid it altogether.

How to do email scraping without turning it into spam?

The secret lies in doing it with judgment, in a targeted and respectful way. In short:

• Collect addresses only of people potentially interested in what you offer (targeted audience).
• Contact them with personalized messages of value, not anonymous mass mailings.
• Introduce yourself honestly and explain why you are writing to them in particular.
• Always include the option to stop receiving emails (unsubscribe).
• Don’t overdo the frequency: if they don’t reply, don’t keep pestering them.
• As soon as possible, obtain explicit consent: for example by inviting them to subscribe to your newsletter, so that later communications will be 100% legitimate.
• Manage data properly: verify emails (to avoid bounces), don’t send to inactive addresses, keep the list clean of the uninterested.
  In practice, you must behave almost as if you already had a relationship of trust, even though you know you are starting cold. The purpose of the first contact should not be to sell right away, but to establish a dialogue or get permission to continue the conversation. By following these guidelines, you can use scraping as a starting point to build professional relationships, without spamming. Of course, it takes more work than a mass mailing, but the results (if you have a good product) will prove you right.

Is Mailerfind compliant with the GDPR and anti-spam rules?

Mailerfind, in itself, is a tool. As such, it is as compliant as the use the user makes of it. The software itself collects public data (so it does not breach access or privacy by design) and provides the means to send emails with good practices (it inserts unsubscribe links, allows controlled volumes, etc.). Mailerfind states on its site that it wants to support ethical and safe scraping. However, if a user used Mailerfind to extract 10,000 emails and send indiscriminate spam, that user would still be breaking the law, and Mailerfind could suspend their account for improper use. Conversely, if you use Mailerfind as described in this guide – targeted audiences, personalized messages, respect for opt-outs – then you are using the tool in a compliant way and can benefit from it with no problems. In short: Mailerfind makes compliance easier, but the responsibility remains yours. Personally, I find the platform helps a lot in staying within the lawful sphere, because it immediately integrates what you need (e.g. it handles automatic unsubscribes, verifies contacts, etc.). So yes, Mailerfind can be used in compliance with the GDPR and email marketing regulations, as long as you follow the compliance guidelines. It is not a magic wand that makes spam legal, but a powerful tool that, in the hands of a careful marketer, allows respectful and effective lead generation.

I hope this guide has definitively clarified whether and how email scraping can be legal. We have explored both the regulatory aspects and the practical/strategic ones, going beyond the usual superficial information you find online. As you have seen, legality depends on use: scraping in itself is not prohibited, but it must be placed within a strategy that respects privacy and regulations. In the first person, I have shown you how it is possible to reconcile the needs of a freelance marketer (who wants to find new clients) with adherence to the rules and professional ethics.

At the end of the day, success in digital marketing is not achieved by getting around the law, but by working in harmony with it. Using innovative tools like Mailerfind can give you an enormous competitive advantage, as long as you are aware of how you use them. If you follow the tips shared, you will be able to use email scraping to grow your business in a safe, legal and sustainable way over time. Good luck and happy lead collecting – the ethical way!