How to Scrape Trustpilot Reviews with Proxies

Get the framing right before you write a line of code, because "the reviews are public" only answers part of the question.

In the United States, the Ninth Circuit's ruling in hiQ Labs v. LinkedIn (2022) held that scraping data that is publicly accessible, meaning no login and no authentication wall, generally does not violate the Computer Fraud and Abuse Act. That decision is about unauthorized access, not a blanket license. Trustpilot's Terms of Use separately prohibit automated collection, so scraping can still be a breach of contract even where it is not a CFAA violation. Those are two different legal questions.

There is a second layer here that Amazon or price scraping does not have: reviews contain a person's name, country, and history. That makes review data personal data under the EU's GDPR and similar laws, regardless of the fact that it is published. We cover the practical handling in the GDPR section below, but keep it in mind from the first request.

Practical guardrails that keep a project defensible:

• Collect public review content only: rating, title, text, dates, and the company reply. Treat reviewer identity as sensitive.
• Rate-limit yourself and back off on errors so you are not degrading Trustpilot's service.
• Do not republish full review text or reviewer identities beyond what fair use and privacy law allow.
• Prefer the official Trustpilot Business API when you need reviews for your own company profile. It is the compliant route and it hands you clean JSON with no anti-bot fight.
• If the data feeds a commercial product, run it past a lawyer. This is engineering guidance, not legal advice.

Brand monitoring, competitor sentiment tracking, and market research on public reviews are common, legitimate uses. The infrastructure and business context for that sit in Using Proxies for Review Monitoring and Sentiment Analysis.

A public Trustpilot review page (reachable at /review/, for example /review/sparkproxy.io) exposes a consistent set of fields per review. Because Trustpilot is a Next.js app, every one of these fields lives inside the embedded __NEXT_DATA__ JSON, which is far more stable than the visible DOM. Here is the reference set worth pulling, with the JSON key and a CSS fallback for each.

The review ID is the anchor. Store it as your primary key so re-running a scrape updates existing rows instead of duplicating them. The exact JSON keys are current as of mid-2026; Trustpilot can rename them, so treat the table as a starting point and inspect the blob (the next sections show a resilient way to find the array even if the path moves).

Trustpilot is not the hardest target on the public web, but it has four traits that break naive scrapers.

Cloudflare in front. Trustpilot sits behind Cloudflare, which fingerprints the TLS handshake and can serve a "Checking your browser" challenge or a 403 before you ever see a review. A plain requests.get from a datacenter IP gets flagged fast.

CSS class names that churn. Trustpilot uses Next.js CSS Modules, which generate hashed class names like styles_reviewCardInner__EwDq2. That hash changes on nearly every frontend deploy, roughly every few weeks. Any scraper keyed on those classes silently returns empty fields the morning after a deploy.

A login wall on deep pages. Trustpilot serves review pages openly for roughly the first 10 pages, then starts prompting you to log in for older reviews. You cannot page past that anonymously.

Rate limiting. Request pages too fast, past roughly 20 page loads per minute, and you draw 429s and temporary blocks.

A managed scraping API absorbs the first and last of these for you. The class-churn problem is solved by reading the JSON, and the login wall is a hard limit you plan around with filters. If you want the proxy-side theory behind clearing Cloudflare, How to Avoid Getting Your Proxy Blocked goes deep on TLS fingerprinting and header consistency.

The SparkProxy Scraping API takes a target URL and handles the proxy, rotation, and anti-bot layer for you. You send one request, you get the HTML back. For Trustpilot, the parameter choice is a little different from a JavaScript-heavy site, and it saves you credits.

Here is the key point most guides miss: the reviews are server-side rendered into __NEXT_DATA__, so you do not need a headless browser to read them. The full first page of reviews is already in the initial HTML. That means you can often run with render_js=false, which is cheaper (1 credit on a rotating proxy, or 10 credits on a premium residential proxy, versus 25 for a rendered premium request). Two parameters carry the weight:

• premium_proxy=true: routes through residential IPs, which clear Trustpilot's Cloudflare where datacenter IPs get challenged.
• render_js=false: skip the browser, because the data is in the SSR JSON. Only turn this on (true) plus stealth=true if you hit a persistent Cloudflare challenge.

The base endpoint is https://scrape.sparkproxy.io/api/v1 and auth is a single header, X-API-Key. A minimal request in cURL:

curl -G "https://scrape.sparkproxy.io/api/v1" \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "url=https://www.trustpilot.com/review/sparkproxy.io" \
  --data-urlencode "render_js=false" \
  --data-urlencode "premium_proxy=true"

Full parameter list and response fields live in the Scraping API docs. If you are weighing this against running your own residential pool, Web Scraping API vs Self-Managed Proxies lays out the trade-off.

Wrap the call so every request carries the Trustpilot-specific parameters and a page number:

import requests

API = "https://scrape.sparkproxy.io/api/v1"
API_KEY = "YOUR_API_KEY"

def fetch_reviews_page(domain: str, page: int = 1) -> str:
    """Fetch one Trustpilot review page. Reviews are server-rendered into
    __NEXT_DATA__, so render_js can stay off (cheaper). Escalate if challenged."""
    resp = requests.get(
        API,
        headers={"X-API-Key": API_KEY},
        params={
            "url": f"https://www.trustpilot.com/review/{domain}?page={page}",
            "render_js": "false",      # data is in the SSR JSON, no browser needed
            "premium_proxy": "true",   # residential IPs clear Trustpilot's Cloudflare
        },
        timeout=60,
    )
    resp.raise_for_status()
    return resp.text

Every Trustpilot page ships a