If you're scraping personal data - e.g. people's names, email addresses, employment info or similar - then you probably fall under GDPR here, unless you can somehow exclude all EU users from scraping entirely. Companies have been fined for this, e.g. Poland fined a small marketing firm £200,000 for scraping in 2019: https://techcrunch.com/2019/03/30/covert-data-scraping-on-wa...