The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.

No cost at all. A crawler is simply a program that automatically browses web pages and extracts the data on them. Before running one, check the robots.txt file and any API authorization guidelines — robots.txt is a file placed by website owners in their root directory that lists pages they do not want crawlers to access. Any data that requires a login, a token (a temporary access credential), or signature decryption to obtain is not targeted. The real challenge is resisting the temptation to collect such data even when technical means make it easy to do so — this depends entirely on self-discipline.

Illegally accessing system data by bypassing protective measures carries the same sentencing range as the third item (scripts used for ticket scalping or flash sale fraud): up to 3 years in prison, or 3 to 7 years in more serious cases. Illegally obtaining, selling, or providing citizens’ personal information also triggers heavy penalties if any of the following thresholds are met: 50 or more records on personal movement, communications, credit history, or financial details; 500 or more records on accommodation, communications, health, or transaction information; 5000 or more records of other types; or illegal earnings of 5000 yuan or more. Serious violations result in up to 3 years in prison, plus a fine or fine alone; extremely serious cases are punished with 3 to 7 years in prison. A real-world example: software developer Li used a feature disguised as a “face beauty detection” tool to steal 1751 facial photos from users’ phone albums, then sold data from a social engineering database he had compiled — he was sentenced to 3 years in prison, suspended for 3 years. A social engineering database is a collection of personal information leaked from various sources. Another case: an internet technology firm used a crawler to harvest store and order data from a food delivery platform, causing over 40,000 yuan in losses; it was prosecuted for illegally obtaining data from a computer information system (this case is documented nationwide).

全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款、第二百五十三条之一）. https://jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925/index.html；最高人民法院、最高人民检察院 (2017). 关于办理侵犯公民个人信息刑事案件适用法律若干问题的解释（第三、四、五条）. https://www.spp.gov.cn/xwfbh/wsfbt/201705/t20170509_190088.shtml；最高人民检察院 (2022). 检察机关依法惩治侵犯公民个人信息犯罪典型案例（案例二）. https://www.spp.gov.cn/spp/xwfbh/wsfbt/202212/t20221207_594915.shtml；最高人民检察院 (2025). 检察机关依法惩治侵害企业数据安全犯罪 服务保障企业创新发展（案例一）. https://www.spp.gov.cn/xwfbh/wsfbh/202501/t20250124_680670.shtml

A 2017 judicial interpretation states that “providing information lawfully collected from others without their consent” also counts as “providing personal information” under the law. This provision also applies to companies that share user databases with external partners. 5000 records is roughly the size of a small database table.