Competitor review data is among the most valuable inputs for product decisions, but collecting it at scale raises legitimate legal and ethical questions. This guide covers what is actually permitted, which official APIs exist, and how to collect review data responsibly without exposing yourself to legal risk.
The Legal Landscape in 2026
The legality of web scraping has been clarified significantly in recent years. The landmark hiQ v. LinkedIn case and subsequent rulings in the United States established that scraping publicly available data generally does not violate the Computer Fraud and Abuse Act. However, that does not mean all scraping is permitted — Terms of Service violations remain a contractual issue, and some jurisdictions (notably the EU under GDPR) impose additional constraints on data collection.
The practical framework for legal review collection:
- Publicly visible data can generally be collected
- Data behind authentication walls requires explicit permission
- ToS violations are contractual issues, not criminal ones (but can result in account bans)
- Personally identifiable information has additional restrictions under GDPR and CCPA
- Rate limiting and robots.txt should be respected regardless of legality
Official APIs: The Gold Standard
When official APIs exist, use them. They provide stable, structured data with clear terms of use and no legal ambiguity.
Apple App Store
Apple does not provide a public API for app reviews. However, the RSS feed endpoint at https://itunes.apple.com/[country]/rss/customerreviews/id=[app-id]/json is publicly accessible and commonly used for review collection. This endpoint is not officially documented but has been stable for years and is widely used by analytics platforms.
Google Play
Google Play does not offer a public review API, but the Google Play Developer API allows app developers to access reviews for their own apps. For competitor review research, the google-play-scraper npm package is widely used and respected among developers for accessing publicly visible review data.
Product Hunt
Product Hunt provides a GraphQL API with OAuth2 authentication. After obtaining API credentials, you can query posts, comments, and votes. The API is well-documented and the terms of service permit research and non-commercial use.
Reddit's public JSON API (append .json to any Reddit URL) and the official Reddit API are both available. Note that Reddit's API terms changed in 2023, restricting high-volume automated access. For research purposes, the public JSON endpoint with appropriate rate limiting (1 request per second) remains usable.
Ethical Scraping Practices
Even when scraping is legally permissible, ethical collection practices protect both the platforms you collect from and the integrity of your research:
- Respect robots.txt — Check the
/robots.txtfile of any site before scraping - Rate limit aggressively — Never send requests faster than a human would browse
- Identify yourself — Use descriptive User-Agent strings that identify your tool and contact
- Cache results — Don't repeatedly fetch the same data; cache with a reasonable TTL (7 days is standard)
- Only collect what you need — Minimize data collection to what's relevant to your research
- Don't collect PII — Strip or anonymize reviewer names and identifiers
Recommended Tools and Libraries
For App Store Reviews
- app-store-scraper (
@perttu/app-store-scraper) — Node.js library for App Store review collection - AppFollow — Paid platform with official data partnerships
- Sensor Tower — Enterprise-grade with official data access agreements
For Google Play Reviews
- google-play-scraper — Well-maintained Node.js library for Play Store data
- AppBot — Paid tool with Google Play integration
For Multi-Source Collection
- GoShipOrSkip — Combines App Store, Google Play, Product Hunt, and Reddit review collection with AI analysis. No setup required — analyze your idea directly.
- Apify — General-purpose scraping platform with pre-built actors for many review sources
Handling ToS Violations
If a platform's ToS explicitly prohibits scraping (as many do), you have three options:
- Use the official API if one exists
- Use a third-party data provider that has licensing agreements with the platform
- Collect data manually if volume is small enough
For most competitive research purposes, official APIs and publicly documented endpoints cover the data you need. The cases where you'd need to violate ToS to get meaningful data are rare.
GDPR and Privacy Considerations
If you're collecting reviews from EU users or operating in the EU, GDPR applies. Key considerations:
- Review text paired with usernames may constitute personal data
- You typically need a legitimate interest basis for research purposes
- Data minimization principle applies — don't store what you don't use
- Set reasonable retention periods and delete data when no longer needed
For competitive research where you're analyzing patterns rather than tracking individuals, the legitimate interest basis generally applies. Document your reasoning in a privacy impact assessment if you're storing significant volumes.
The Practical Bottom Line
For most founder research needs — understanding what users complain about in competitor apps, identifying feature gaps, and validating demand — the combination of official APIs, publicly documented endpoints, and tools like GoShipOrSkip covers everything you need without any legal gray areas. Start with official channels, respect rate limits, and use an AI analysis layer to make sense of the data at scale.