France

Summary

France presents medium risk for commercial web scraping. Code pénal arts. 323-1 to 323-3 (STAD — atteintes aux systèmes de traitement automatisé de données) criminalise fraudulent introduction into, or fraudulent maintenance within, an automated data-processing system, as well as fraudulent extraction or reproduction of data. Courts construe "fraudulent" broadly — circumventing a CAPTCHA or IP-block, or exceeding ToS-implied authorisation scope, all carry criminal exposure. Public pages reached without circumventing any technical measure carry no art. 323-1 liability. France fully transposed DSM Directive 2019/790 via Ordonnance 2021-1518 and Décret 2022-928, adding CPI art. L122-5-3 (commercial TDM with machine-readable opt-out) and art. L122-5-1 (research TDM). Commercial TDM is lawful where the rightsholder has not reserved rights via robots.txt or equivalent; honouring that opt-out is now legally binding under CPI and EU AI Act Art. 53 (in force Aug 2025). The CNIL issued AI-training scraping guidelines in June 2025, requiring developers to exclude sites that disallow scraping via robots.txt or CAPTCHAs. France retains the full EU sui generis database right (CPI arts. L341-1 to L343-7). The parasitisme unfair-competition doctrine supplements IP law where a competitor misappropriates another entity's substantial investment.