Automated Messaging and Data Scraping: The Legal Limits on Using Online Bots in Brazil

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Using bots to sweep web pages, capture information, and send messages at scale has become routine in marketing, market research, and competitive intelligence. But the practice walks a fine line: what begins as legitimate automation can lead to civil, criminal, and administrative liability when it ignores terms of use, data protection rules, and the limits of fair competition.

Where Automation Stops Being Lawful

There is no blanket prohibition on automated programs on the internet. Search engines index billions of pages through bots, and that activity underpins much of the digital economy. The problem arises when a tool goes beyond accepted purposes, circumvents technical barriers, or exploits third-party data without any legitimate basis.

Unlawfulness rarely comes from the technology itself. It comes from the context: how the data was obtained, the nature of the data collected, what was done with the information, and the harm caused to whoever runs the website or whose data was captured. It is the combination of these elements that turns automated collection into an act subject to sanctions.

Three fronts are usually pursued at the same time against this kind of conduct: the contractual front, based on the platform’s terms of use; the regulatory front, grounded in data protection law; and the competition front, aimed at stopping free-riding on someone else’s work. Each front has its own evidentiary requirements and different levels of sanctions, but they often overlap in a single episode of abusive collection, increasing the exposure of the person responsible.

Terms of Use and the Contractual Boundary

Almost every major platform expressly prohibits data scraping and automated messaging in its terms of use. By accepting those terms, even through mere browsing, a user enters into a contract. Violating it amounts to breach of contract, with a potential duty to pay damages and the risk of a permanent ban from the platform.

The legal debate becomes more substantive when collection takes place without prior registration, on pages open to the public. In those cases, it is argued that no contract was formed. Even so, courts have recognized that deliberately breaking through technical protection measures, such as address-based blocks or authentication requirements, shows bad faith and undermines any claim of good-faith browsing.

The presence of a file that signals the site’s crawling rules reinforces this view. Ignoring those directives is not, by itself, a crime, but it serves as evidence that the operator knew the limits that had been set and chose to disregard them, a factor that weighs in determining liability.

Violating it amounts to breach of contract, with a potential duty to pay damages and the risk of a permanent ban from the platform.

Data Protection and Your Duties Under the LGPD

When automated collection reaches information that identifies individuals (names, phone numbers, profiles, purchase histories), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, or LGPD) applies. The fact that data is publicly accessible does not permit its unrestricted processing. Information being public is not the same as consent for new and undefined purposes.

An operator who builds a database through scraping takes on the role of controller and becomes responsible for the entire processing cycle. The operator must identify a valid legal basis, inform the data subjects, guarantee the right to object, and adopt security measures. Failing to meet these requirements exposes the responsible party to administrative sanctions that can reach a significant percentage of revenue.

Sending mass messages makes matters worse. Besides violating the original purpose of the collection, it usually amounts to unsolicited communication, a practice that adds a data protection violation to the intrusion on the peace and privacy of people who receive the contact without ever having authorized it.

Brazil’s national data protection authority has signaled growing strictness toward databases built without the data subjects’ knowledge. The mere existence of a large database with no trace of a lawful origin is enough to trigger an inspection and to require proof of every step of the processing.

Unfair Competition and Free-Riding

Systematically scraping a competitor’s content to feed your own service amounts, in many cases, to unfair competition. The law punishes the improper exploitation of someone else’s work, especially when the offender saves on investment by appropriating databases that another company built with significant effort and expense.

Classified-ad platforms, marketplaces, and price-comparison portals have already won favorable rulings against companies that copied their catalogs using bots. The central basis is disloyalty: the wrongdoer enjoys a competitive advantage without bearing the cost of producing the information, which throws the market out of balance.

Damage to infrastructure comes on top of that. Aggressive collection overloads servers, degrades the experience of legitimate users, and imposes additional costs on the targeted site. This material harm can be quantified and strengthens the claim for compensation in court. Traffic records, access logs, and technical reports are often decisive in measuring the extent of the overload and identifying who carried out the collection.

Civil and Criminal Liability

In civil law, the conduct can give rise to an obligation to compensate for material damages, such as infrastructure costs and lost business, and for pain-and-suffering damages (danos morais), when the affected company’s reputation or the data subjects’ privacy has been harmed. Compensation can be combined with orders to act, including the removal of databases built improperly.

In criminal law, breaking into a computing device by violating a security mechanism is defined as a crime. Mass sending that impairs the functioning of systems may come close to offenses involving service disruption. Fraudulent use of captured data, whether to run scams or to mislead third parties, triggers separate and more serious criminal offenses.

Liability is not limited to whoever runs the bot. Companies that hire the collection service, managers who approve the strategy, and developers who build the tool knowing its unlawful purpose can also be held responsible, depending on their degree of participation and what they knew about the plan.

This landscape calls for extra caution. Before implementing any automated routine, it is prudent to map where the data comes from, check the applicable terms of use, establish a solid legal basis, and document every decision. Well-designed automation is legitimate and valuable; automation that ignores legal limits turns efficiency gains into a liability that is hard to undo.

Frequently Asked Questions

Is it always permitted to collect data from public pages?

No. Public access makes collection easier, but it does not allow indiscriminate use. If the data identifies people, data protection law applies, and it requires a legal basis, a defined purpose, and respect for the right to object. Even non-personal data can create liability when collection violates terms of use, overloads the server, or amounts to free-riding on a competitor’s content.

Can sending automated mass messages be a crime?

It can, depending on how it is done and what effect it has. Sending that compromises the functioning of systems, that uses data obtained through a security breach, or that is used to defraud recipients triggers specific criminal offenses. Even when it does not amount to a crime, the practice usually violates data protection law and platform terms, exposing the responsible party to administrative sanctions and a duty to pay damages.

How can you reduce legal risk when automating online tasks?

The starting point is to map where each piece of data comes from and to review the terms of use of the platform involved. Next, you define an appropriate legal basis for processing, inform data subjects when required, and respect the site’s technical barriers. Documenting these decisions and limiting collection to what is strictly necessary shows good faith and supports your defense if the conduct is ever challenged.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.