Italy

Summary

Italy presents medium risk for commercial web scraping. Codice penale art. 615-ter criminalises unlawful access to a computer or telematic system protected by security measures, or remaining within it against the will of the person entitled to exclude access. Ignoring ToS anti-scraping provisions or bypassing technical protections can constitute art. 615-ter criminal liability. Law 28 June 2024 n. 90 (Cybersecurity Act) tightened the art. 615-ter framework. Italy transposed DSM Directive 2019/790 via Decreto Legislativo 8 November 2021 n. 177, adding arts. 70-ter (research TDM, mandatory exception) and 70-quater (commercial TDM, subject to machine-readable opt-out) to the Legge sul Diritto d'Autore (LDA). Commercial TDM is lawful where the rightsholder has not set a machine-readable reservation. The Garante per la protezione dei dati personali issued comprehensive scraping guidance in September 2023 and, in May 2024 (decision n. 329), issued a dedicated guidance document on web scraping for generative AI training recommending counter-measures including robots.txt intervention. In December 2024 the Garante fined OpenAI €15 million — the first GDPR generative-AI fine in Europe (later annulled by the Court of Rome in March 2026 on procedural grounds). Italy retains the full EU sui generis database right (LDA arts. 102-bis to 102-quater). GDPR applies through robust Garante enforcement. No scraping-specific statute exists beyond the general criminal and IP framework.