Is Scraping Google Maps Legal?

This question gets two kinds of answer online, both useless. One is "totally legal, it's public data!" from people selling scrapers. The other is "absolutely not, it's against the Terms of Service" from people who have not read the Terms of Service.

The real answer requires separating three completely different questions that get mashed together. None of what follows is legal advice — it is a map of what the questions are, so you can ask a lawyer the right one.

The three questions people conflate#

1. Does collecting this data break a criminal law? That is computer-misuse law — the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK, and equivalents elsewhere.

2. Does using this data infringe someone's rights? That is copyright and database rights.

3. Does collecting it breach a contract you agreed to? That is terms of service, and it is a civil matter between you and the platform — not a crime.

These have different answers, different consequences, and different people who can come after you. Treating them as one question is why the internet argument never resolves.

Question 1: computer-misuse law#

The relevant US line of authority is hiQ Labs v. LinkedIn. LinkedIn tried to use the CFAA to stop a company scraping public LinkedIn profiles. The Ninth Circuit held that scraping data which is publicly available — no login, no authentication, no barrier — is unlikely to be "unauthorised access" under the CFAA, reasoning that you cannot be unauthorised to visit a page anyone can visit.

The Supreme Court's decision in Van Buren v. United States pointed the same way, narrowing "exceeds authorised access" to mean obtaining information from areas of a system you are not entitled to reach — not merely using information you were entitled to see for a purpose the owner dislikes.

The practical distinction that survives all of this:

• Public and unauthenticated — a page a logged-out browser can load. Weak ground for a computer-misuse claim.
• Behind a login — you accepted terms to get in, and you are inside a system you were granted conditional access to. Materially riskier, in every direction.

Google Maps listings are the first kind. A business listing loads without an account.

This is US law. Other jurisdictions differ, and the analysis is fact-specific.

Question 2: copyright and database rights#

Facts are not copyrightable. That a dental clinic exists, is called what it is called, sits at an address and has a phone number — these are facts, and nobody owns them.

What can be protected is a creative selection or arrangement of facts, and in the EU and UK, a sui generis database right protects substantial investment in obtaining and verifying a database's contents, independently of copyright. That right is about extracting a substantial part of someone's database — a real consideration if you systematically drain a directory, less so if you look up businesses matching a description.

Reviews are a separate matter entirely. A review is somebody's original writing and is protected by copyright. Collecting business names and addresses is a different act from copying review text, and the second one carries risk the first does not.

Question 3: terms of service#

Here the answer is clear and uncomfortable: Google's Terms of Service prohibit automated access to its properties without permission. Reading them and pretending otherwise does not help anyone.

Breaching terms of service is a contract matter. The realistic consequences are Google's own remedies — rate-limiting, IP blocking, account termination, and in rare and extreme commercial cases, a civil suit. It is not a criminal act, and a ToS clause does not convert one into another. That was much of the point of Van Buren.

The clean way out of question 3 is to not be in it. Google publishes the Places API, which is an explicit licence to query the same business data programmatically, with quotas, pricing, and terms written for exactly this use. Using the official API means you are not breaching the terms — you are paying for a documented product. It costs money, and that cost is the point: it is the difference between operating inside an agreement and outside one.

This is why serious tools use the Places API rather than driving a headless browser at maps.google.com, and it is what GoLeadX does.

The part that actually matters: it is personal data#

Everything above concerns the platform. The bigger exposure in Europe concerns the people.

Under GDPR, "personal data" means information relating to an identified or identifiable living person. info@bakery.com is probably not personal data. maria.gonzalez@bakery.com almost certainly is — it identifies a specific human being. A sole trader's business address is frequently both a business detail and personal data at once.

The relevant consequences, in brief:

• You need a lawful basis. For B2B outreach, that is usually legitimate interest, which is a real basis and is not a free pass — it requires you to actually balance your interest against the person's reasonable expectations and to be able to show that you did.
• You owe transparency. Article 14 requires telling people you hold their data when you did not collect it from them directly, generally within a month or at first contact. In practice, the first email is where that happens.
• People can object, and objection is absolute for direct marketing. No balancing test. They say stop, you stop, permanently.
• Electronic marketing has its own rules. In the EU and UK, PECR-style rules govern unsolicited electronic mail, and the treatment of corporate subscribers differs from that of individuals and sole traders.

In the US, CAN-SPAM is far more permissive: no prior consent required for commercial email, but you must not use deceptive headers or subject lines, must identify the message as an advertisement, must include a valid physical postal address, and must honour opt-outs within ten business days.

Between these, the honest summary is that collecting is the smaller legal question and sending is the larger one.

A defensible operating position#

Not advice, but the posture that keeps you out of most of the trouble:

1. Use official APIs where one exists. For Google Maps, that is the Places API. You are then licensed, not tolerated.
2. Collect only what the business published about itself. A business email on a contact page was put there to be contacted. That is the whole justification for legitimate interest, and it evaporates the moment you start guessing addresses or buying lists.
3. Do not collect what you do not need. Copying review text, photographs or personal profiles adds copyright and privacy exposure for data you were never going to use.
4. Do not touch anything behind a login. It changes the analysis on every one of the three questions at once.
5. Be identifiable when you contact people. Real company name, real postal address, working opt-out, honoured immediately.
6. Keep records. Where each contact came from, when, and on what basis. This is the difference between answering a complaint in ten minutes and not being able to answer it at all.
7. Never sell the list on. Onward transfer is where legitimate interest collapses entirely.

Where the ethical line sits, separately from the legal one#

Legal minimums are not the same as behaving well, and in outbound the two diverge in a predictable place: relevance.

A short, honest message to a business you have a genuine reason to contact, with an easy way to opt out, is a normal commercial act. The same infrastructure pointed at everyone with an email address is spam, and it is spam whether or not a lawyer could defend it.

The practical test is whether you would be comfortable if the recipient could see exactly how they ended up on your list. If the answer is "I found your clinic on Google Maps and read the email off your contact page", that is fine. If it is "I bought a file of 400,000 addresses", it is not.

FAQ#

Is it legal to collect business emails from websites?#

Collecting contact details a business has published on its own website is generally lawful in most jurisdictions — those details were published to be used for contact. The constraints come from data-protection law when the address identifies a person, and from marketing law when you send. Business-to-business outreach in the US under CAN-SPAM is permissive; the EU and UK impose more, including a lawful basis, transparency, and an absolute right to object.

Does using the Google Places API make scraping legal?#

It makes the terms-of-service question go away, which is one of the three questions in this article. Using the official API means you are accessing the data under a licence Google grants and charges for, rather than in breach of its terms. It does not change your obligations under data-protection law once you hold contact details, and it does not change the rules on how you may send.

Can Google sue me for scraping Maps?#

Google's remedy for a terms breach is usually technical rather than legal — rate limits, blocks, and account termination. Civil action is rare and reserved for large-scale commercial cases. Breaching terms of service is a contract matter and not a criminal offence, and a court narrowing the CFAA in Van Buren made exactly that distinction.

Is a business email address personal data under GDPR?#

It depends on whether it identifies a person. A generic info@ or contact@ address usually does not. A named address like firstname.lastname@company.com generally does, and for a sole trader even the generic address may. When in doubt, treat it as personal data — the obligations are not onerous and the downside of guessing wrong is.

Do I need consent to send B2B cold email?#

Not in the US, where CAN-SPAM requires honesty, identification and a working opt-out rather than prior consent. In the EU and UK, most B2B cold email is sent under legitimate interest rather than consent, which is permissible but conditional: the message must be relevant to the recipient's professional role, you must disclose where you got their details, and you must stop immediately when asked. Rules for sole traders and individuals are stricter than for corporate subscribers.