TrustpilotTrustpilotThe honest answer to “is it legal” is that it depends on three separate questions that people tend to collapse into one: what the platform’s terms say, who owns the text, and whether personal data is involved. They have different answers, and only one of them is really about scraping.
This is a practical overview, not legal advice. If money depends on the answer, pay a lawyer in your jurisdiction; the cost is trivial next to a takedown or a regulatory complaint.
Trustpilot’s terms of use, like those of essentially every review platform, restrict automated collection of content from the service. That restriction is a contract between you and the platform, not a criminal statute. Breaching it exposes you to the remedies a platform actually has: rate limiting, blocking your access, closing your account, or a cease and desist.
What this means in practice is that the risk is proportional to how much you look like an industrial operation. Someone exporting one competitor’s reviews once a quarter, from their own browser, at reading pace, is a different proposition from a service pulling a hundred thousand profiles a night from a data centre. Both may be covered by the same clause. Only one is going to attract attention.
There is also a real legal distinction between the two that is worth understanding. Courts in several jurisdictions have taken a dim view of treating access to publicly available web pages as unauthorised computer access, particularly in the United States. But those cases have not made platform terms unenforceable, and they say nothing about the other two questions below. Nobody should read “scraping public data was allowed in that case” as “this is fine”.
A review is a piece of writing. In most jurisdictions the person who wrote it holds copyright in it, and the platform holds a licence to publish it. Neither of them granted you anything.
For internal analysis this rarely matters. Copyright restricts copying and public communication, and reading a corpus to count complaint themes is a use that most legal systems accommodate, sometimes explicitly under text and data mining exceptions. The EU, for instance, has a text and data mining exception that covers lawful access, subject to the rights holder having reserved their rights.
Where it matters is republication. Putting collected reviews on your own site is copying and communicating someone else’s work to the public. If your plan involves displaying reviews you did not receive, treat that as the legally serious part of the project, not the export.
This is the one people underestimate. A file containing display names, countries, review text and dates is personal data under the GDPR and comparable regimes, because those elements together can identify a person. The fact that the person published it themselves does not remove it from the scope of the rules.
What follows from that is manageable but not nothing. You need a lawful basis for processing, which for competitive analysis is usually legitimate interests, and legitimate interests requires you to have actually weighed your interest against the reviewer’s expectations. You need to keep only what you need, for only as long as you need it. And you have to be able to answer a request from someone who asks what you hold about them.
Two lines are worth drawing clearly:
Aggregate analysis is defensible. Counting how often “late delivery” appears across 3,000 reviews, and how that trends by month, involves personal data at the input and produces no personal data at the output.
Profiling individuals is not. Building a file on specific reviewers, tracking one person’s reviews across platforms, or merging review data with other sources to identify people, is a different activity that a regulator will read differently. There is no version of this that is a good idea.
If you want a short list to work from:
Tools differ in ways that map directly onto the risks above. An exporter that reads the page you opened, in your session, and writes the file to your device, keeps everything on your side of the line: no server-side collection, no third party holding review content, no transfer to disclose. An exporter that runs collection on its own infrastructure and hands you the result has made itself the collector, and has made you the recipient of data someone else gathered.
ExportReviews is built the first way, deliberately. Extraction runs in your browser and review content never reaches our servers. That is a design choice about liability as much as about privacy, and it is worth checking which side any tool you use falls on.
Exporting reviews for internal analysis, from your own browser, at reasonable pace, without republishing and without profiling individuals, is the low-risk end of a spectrum that has a genuinely risky end. The risk does not come from the word “scraping”. It comes from volume, from republication, and from what you do with names.
No. Publicly readable and free to reuse are different things. A review is a piece of writing whose author holds copyright, published on a platform whose terms govern automated collection. Being able to read something in a browser settles neither question.
That is the riskiest thing on this list, and it is where most complaints actually come from. Republishing someone else's reviews as if they were feedback about you is misleading to shoppers and, in many jurisdictions, a consumer protection problem quite apart from copyright. If you display collected reviews at all, attribute the source clearly and take advice first.
It applies as soon as the file identifies people, and a display name plus a country plus review text often does. Analysing complaint themes in aggregate is a very different activity from building a file on individual reviewers, and regulators treat them differently too. Keep the data minimal, keep it for a defined period, and do not merge it with other sources to identify individuals.
It is a meaningfully different activity, and generally a more defensible one. A browser extension reads a page you opened yourself, in your own session, at human pace. A server-side scraper hits the platform from infrastructure you control, at a volume no human produces. The second is what platform anti-abuse systems and terms are mainly aimed at.
Internal analysis of your own reviews, or aggregate competitive research where the output is themes and counts rather than a republished corpus. Nothing leaves your organisation, nobody is individually profiled, and no third party sees content presented as something it is not.
Ready to export Trustpilot reviews?
Export any Trustpilot review page to CSV, Excel (XLSX) or JSON in one click, directly in your browser. No copy-paste, no server, your data never leaves your device.
See the Trustpilot exporter