Iraq
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Iraq has no comprehensive data-protection law and no enacted cybercrime statute as of 2026. A draft Cybercrime Law has been under parliamentary consideration since 2011; multiple iterations have been suspended after civil society objections over overbroad restrictions on free expression, and no version had been enacted as of early 2026. A draft Personal Data Protection Law was approved by cabinet in 2019, re-introduced to parliament in 2021, and remains unenacted. Copyright is governed by Law No. 3 of 1971 (as amended by CPA Order No. 83 of 2004), which provides no TDM exception and no EU-style sui generis database right; databases receive protection only under general originality/compilation principles. The general Penal Code may be applied to computer-related conduct but has not been authoritatively construed to cover web scraping. Enforcement capacity is limited by ongoing institutional challenges. The overall posture is minimal_or_unclear.
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | unsettled |
| Public-page carve-out | unsettled |
| Terms-of-service browsewrap enforceable | unsettled |
| Terms-of-service clickwrap enforceable | unsettled |
| Copyright exception model | closed list |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | No comprehensive data-protection law enacted (draft PDPL pending) |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: low. Not legal advice.