The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.

4. The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold.

Cost: No cost at all. A crawler is simply a program that automatically browses web pages and extracts the data on them. Before running one, check the robots.txt file and any API authorization guidelines — robots.txt is a file placed by website owners in their root directory that lists pages they do not want crawlers to access. Any data that requires a login, a token (a temporary access credential), or signature decryption to obtain is not targeted. The real challenge is resisting the temptation to collect such data even when technical means make it easy to do so — this depends entirely on self-discipline.

In plain terms: Any data that requires a login, a token, or signature decryption to access falls under bypassing protective measures; violations are punishable by up to 3 years in prison, or 3 to 7 years in more serious cases. Collecting personal information brings even heavier penalties. Possessing 50 or more records related to personal movement, communications, credit history, or financial information is already considered a serious offense. The same applies if you collect 500 or more records on accommodation, health, or transaction details, 5000 or more records of other types, or earn 5000 yuan or more from such activities.

Benefit: Illegally accessing system data by bypassing protective measures carries the same sentencing range as the third item (scripts used for ticket scalping or flash sale fraud): up to 3 years in prison, or 3 to 7 years in more serious cases. Illegally obtaining, selling, or providing citizens’ personal information also triggers heavy penalties if any of the following thresholds are met: 50 or more records on personal movement, communications, credit history, or financial details; 500 or more records on accommodation, communications, health, or transaction information; 5000 or more records of other types; or illegal earnings of 5000 yuan or more. Serious violations result in up to 3 years in prison, plus a fine or fine alone; extremely serious cases are punished with 3 to 7 years in prison. A real-world example: software developer Li used a feature disguised as a “face beauty detection” tool to steal 1751 facial photos from users’ phone albums, then sold data from a social engineering database he had compiled — he was sentenced to 3 years in prison, suspended for 3 years. A social engineering database is a collection of personal information leaked from various sources. Another case: an internet technology firm used a crawler to harvest store and order data from a food delivery platform, causing over 40,000 yuan in losses; it was prosecuted for illegally obtaining data from a computer information system (this case is documented nationwide).

Evidence grade: A

Sources: National People's Congress (2020). Criminal Law (Amended in accordance with the Criminal Law Amendment (11), Article 285, Paragraph 2, Article 253-1). <https://jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925/index.html>; Supreme People's Court of China, Supreme People's Procuratorate of China (2017). Interpretation of Several Issues Concerning the Application of Laws in Handling Criminal Cases of Infringement of Citizens' Personal Information (Articles 3, 4, and 5). <https://www.spp.gov.cn/xwfbh/wsfbt/201705/t20170509_190088.shtml>; Supreme People's Procuratorate of China (2022). Typical cases of procuratorial organs punishing crimes of infringement of citizens' personal information in accordance with the law (Case 2). <https://www.spp.gov.cn/spp/xwfbh/wsfbt/202212/t20221207_594915.shtml>; Supreme People's Procuratorate of China (2025). Procuratorates punish crimes that infringe on corporate data security in accordance with the law and provide services to ensure corporate innovation and development (Case 1). <https://www.spp.gov.cn/xwfbh/wsfbh/202501/t20250124_680670.shtml>

Notes: A 2017 judicial interpretation states that “providing information lawfully collected from others without their consent” also counts as “providing personal information” under the law. This provision also applies to companies that share user databases with external partners. 5000 records is roughly the size of a small database table.