Luxembourg

Summary

Luxembourg presents a moderate crawling risk. Code penal art. 509-1 criminalises fraudulent access to or maintenance in an automated data-processing system; the offence requires fraudulent intent and is not triggered by ordinary crawling of publicly accessible pages. Luxembourg transposed the DSM Directive via the Law of 1 April 2022 (in force 9 April 2022), amending the Law of 18 April 2001 on copyright, related rights and databases; this established dual-track TDM exceptions aligned with Arts. 3 and 4 of the Directive, with machine-readable opt-out for commercial TDM. The full EU sui generis database right applies under the 2001 law. GDPR is enforced by the Commission nationale pour la protection des donnees (CNPD), which issued 7 corrective measures and 6 fines in 2025 (ranging from EUR 1,277 to EUR 175,000). Luxembourg hosts European headquarters of many major tech companies but the CNPD is not typically the lead supervisory authority for those entities (Ireland's DPC is lead for most US big tech). No Luxembourg-specific scraping case law has been identified. The EU AI Act Art. 53 GPAI opt-out obligation has been binding since August 2025.