If it's public, what's the problem?

It's in the assembly. Each piece of information taken alone says nothing; put together, they give a complete profile — employer, habits, circle, address — that makes a targeted message credible. The problem isn't the public nature of each element, it's the speed at which a machine assembles them.

Not in itself: reading a public page isn't an intrusion. Reusing personal data nonetheless stays regulated, and most platforms forbid it in their terms. In other words, it isn't an offense you should expect to see prosecuted, which is why the practical answer is to reduce what's exposed.

Data scraping

In plain terms

The automated, large-scale collection of what's already public about you. Nothing is hacked: it's the gathering that creates the information, not any single piece taken on its own.

Definition

Scraping is the automated collection of publicly accessible information — social media profiles, directories, listing sites, open registries — in order to build usable databases. No system is forced open: the technique consists of reading very fast what anyone could read slowly, which is what makes this topic different from the other fiches on this site.

How it works

A program crawls pages, extracts the fields it's after, and stores them in a file. The operation is unremarkable taken one at a time; what matters is the change of scale and, above all, the cross-referencing. Your first name on a profile, your employer on a professional network, your city in a listing, a photo of your street, your children's first names in a comment: each piece is mundane, the assembly no longer is. It supplies exactly what other methods described on this site require — a message made credible because it knows your employer, an answer to a security question, an impersonation-of-a-relative scenario that cites the right first names. The legal status is worth stating clearly: collecting public data isn't in itself an intrusion, but reusing it stays governed by data-protection law, and platform terms of use most often prohibit it.

Warning signs

Messages that cite accurate information about you that you never shared
Your profile reappears on directories or aggregators you've never visited
Professional solicitations that precisely reuse your job title and employer
Your profile photo reused elsewhere, on an account that isn't yours
Nothing in particular — scraping leaves no visible trace for the person affected

How to verify

Do the exercise in their place: search your name, email address, and phone number in a search engine, and see what a stranger gets in a minute. Also search your profile photos with a reverse image search. What you find is exactly the material that's available.

What to do

Restrict your profiles' visibility to your contacts rather than the public, and remove from public profiles whatever serves as an answer to a security question: date of birth, city of birth, pet names, school attended. Think about what your published photos reveal — a license plate, a building front, a badge, a document in the background. Data that's never published is the only kind that can't be scraped.

If it already happened

You can ask a site to remove your data and refer the matter to the CNIL if it doesn't respond; that's useful site by site, and has no effect on copies already made. The most worthwhile effort is therefore forward-looking: reduce what's publicly readable, and treat what has already been exposed as known. If the gathered information is used to harm you publicly, the doxxing fiche covers that case.

Frequently asked questions

If it's public, what's the problem?: It's in the assembly. Each piece of information taken alone says nothing; put together, they give a complete profile — employer, habits, circle, address — that makes a targeted message credible. The problem isn't the public nature of each element, it's the speed at which a machine assembles them.
Is it illegal?: Not in itself: reading a public page isn't an intrusion. Reusing personal data nonetheless stays regulated, and most platforms forbid it in their terms. In other words, it isn't an offense you should expect to see prosecuted, which is why the practical answer is to reduce what's exposed.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Data and digital identity family. Last updated: 2026-09-03.