Is Competitor Price Monitoring Legal and Ethical?

Walking into a competitor's shop and writing down their prices has been legal for as long as shops have existed. Doing the same thing with a browser tab is equally uncontroversial. The moment you automate it — a script, a cron job, an app that checks fifteen stores every morning — people start to get nervous, and reasonably so: that's where "reading a public page" starts to feel like something else.

Here's an honest map of where the actual lines are. We are not a law firm and this is not legal advice; rules differ by country and any specific situation deserves a real lawyer. But most small merchants worry about the wrong thing entirely, so it's worth being concrete.

The starting point: public prices are public

A price on a public product page is not a secret, not confidential, and not copyrightable. Copyright protects creative expression, not facts — a number like $24.00 is a fact. That's why price comparison sites, Google Shopping, and every retail analyst on the planet have operated for decades without this being an open legal question.

The same logic covers the public /products.json catalog that every Shopify store serves by default. It isn't a hidden back door or a leak; it's the same data the storefront theme itself uses, published by Shopify at a documented URL, with no authentication in front of it. If a merchant doesn't want a piece of data public, the way to keep it private is not to publish it on the storefront.

In the US, the case people usually cite is hiQ Labs v. LinkedIn, where the Ninth Circuit held that scraping publicly accessible pages doesn't amount to accessing a computer "without authorization" under the Computer Fraud and Abuse Act. The Supreme Court's Van Buren decision in 2021 pushed in the same direction, narrowing the CFAA to something close to a gates-up-or-down test: if the gate is open to the public, walking through it isn't hacking.

The four places it does get complicated

"Not a computer crime" is a low bar. Four other things matter more in practice.

1. Terms of service. This is the real one. hiQ won on the CFAA question and still lost on breach of contract. If you created an account, clicked "I agree", or logged in, you're bound by whatever those terms say — and many say no automated collection. Terms buried in a footer that you never clicked ("browsewrap") are weaker, and courts treat them inconsistently, but weaker isn't nothing. Practical rule: never log in to collect data. Anything behind an account is off the table for monitoring.

2. Copyright in the content, not the facts. Prices, availability flags and dates are facts. Product photography, marketing copy, and descriptions are somebody's creative work. Reading a description to understand a competitor's positioning is fine. Copying it onto your own product page is copyright infringement, and it's also the single most common way small stores get a real legal letter. The line is between informing your decisions and republishing their work.

3. EU database rights. Europe has a sui generis database right with no US equivalent: a database whose compilation required substantial investment can be protected even when its individual contents aren't. Extracting a substantial part of such a database can infringe. The CJEU's Ryanair v. PR Aviation ruling also confirmed that where a database isn't protected, the owner may still restrict use through contract terms. For a merchant checking prices on a handful of competitors this is unlikely to bite — you're taking a small slice, and a product catalog isn't obviously a protected database — but wholesale copying of an entire large catalog is a different act with a different risk profile.

4. Personal data. Prices aren't personal data and GDPR doesn't apply to them. Reviews with names attached are personal data, and collecting those at scale drags you into a much heavier regime. Skip them. There's no version of competitor pricing work that requires storing someone's name.

The risk small merchants actually get wrong

Almost nobody asks about this one, and it's the only item on this page that can produce a serious problem for a small business: antitrust.

Observing a competitor's price and independently deciding to match it is normal competition. Agreeing with a competitor about prices is price fixing, and it's illegal in essentially every developed market — in the US under Sherman Act §1, in the EU under Article 101. It doesn't require a contract, a handshake, or even a meeting. A friendly message in a niche group chat along the lines of "let's both hold at $40" is enough to be an agreement.

The uncomfortable corollary in 2026: regulators are actively looking at algorithmic pricing, where competitors don't talk to each other but all feed data into the same system that sets their prices. Watching public prices yourself is fine. Handing your pricing decisions to a shared mechanism that also sets your competitors' prices is where merchants get into genuine trouble.

So: monitor freely, decide unilaterally, and never discuss your pricing intentions with a competitor. If you sell someone else's brand under a MAP policy, monitoring is often something the brand actively expects of you — different situation, same rule about not coordinating with fellow resellers.

Etiquette: how to be a good citizen about it

Legal and decent aren't the same thing. The difference between acceptable monitoring and being a nuisance is almost entirely about request volume and what you take.

• Once a day is plenty. For most niches, daily is more than enough resolution — we made the case for this in how often you should check competitor prices. One request per store per day is invisible in a server log. One every five minutes is a load you're imposing on someone else's business.
• Prefer one catalog request over crawling every page. Pulling /products.json once costs the target a single request; crawling 400 product pages costs 400. The cheap method is also the polite one.
• Send an honest User-Agent. Identify what you are. Disguising a script as a browser is a choice about deception, and it's the thing you'd have to explain later.
• Read robots.txt and respect it. It isn't legally binding in most places, but ignoring an explicit "please don't" is a decision you're making knowingly.
• Never inflate their numbers. Adding items to a cart to probe inventory counts, or hitting checkout endpoints, pollutes a real business's analytics and conversion rates. Availability flags in the public catalog answer the same question without touching anything.
• Take facts, leave content. Prices, stock states, launch dates, variant counts: yes. Photos and descriptions: no.

A useful gut check is reciprocity. Your own Shopify store publishes exactly the same catalog file, and somebody may well be reading it right now. Would the way you're collecting their data bother you if they did it to you at the same rate? If yes, slow down.

What we'd tell a nervous merchant

If you're watching three to fifteen competitors, pulling their public catalogs once a day, storing prices and availability, and using it to inform your own decisions — you are doing an ordinary thing that retail has done forever. The risky version looks different: logging in, hammering servers, copying product descriptions, hoovering up reviews with names attached, or talking to a competitor about what you both plan to charge.

Two closing caveats worth being clear about. Jurisdiction matters — the analysis above leans on US and EU law, and other markets differ. And the fact that something is legal doesn't make it a good business use of your time: monitoring is only worth doing if it changes a decision, which is why we keep coming back to frameworks like whether you should match a competitor's price at all rather than to dashboards. If you're betting the business on a data-collection strategy at real scale, talk to an actual lawyer. If you're a small store checking what the shop down the street charges, you already knew the answer.