Lead Finder by WappBlaster

Is it legal to scrape Google Maps?

Short version: collecting public business listings is generally lawful, Google's terms prohibit it contractually, and the rules that can actually hurt you govern the outreach you do afterwards. Here is the whole picture, plainly. This is general information, not legal advice.

Last reviewed

Three separate questions people merge into one

"Is it legal" bundles three different questions with three different answers. Untangling them is most of the clarity available here.

  1. Is collecting the data lawful? A question of computer-access and data law.
  2. Does it breach Google's terms? A question of contract.
  3. Is what you do with it lawful? A question of privacy and marketing law, and the one with real enforcement behind it.

1. Collecting public business data

Business listings on Google Maps are published for anyone to view without logging in. In the United States, the long-running hiQ v. LinkedIn litigation established that accessing publicly available web data is not "unauthorized access" under the Computer Fraud and Abuse Act, which removed the main criminal-law theory against scraping public pages. Most other jurisdictions treat public business directory information similarly: names, addresses, phone numbers and ratings of businesses are about as low-sensitivity as data gets.

That settles less than it seems to, because collection is the easy part of the question.

2. Google's terms of service

Google's Terms of Service prohibit accessing its services with automated tools without permission. Using any scraper on Google Maps sits against that term; there is no honest way to describe it otherwise, and a vendor who tells you their tool is somehow exempt is telling you marketing.

What that means in practice: a terms breach is a contract matter between you and Google, not a criminal one. Google's observable response to scraping is technical (rate limiting, blocks on traffic that looks robotic), and its legal actions in this area have historically targeted large-scale republishing of its content, not businesses building internal prospect lists. You should know that is the deal you are accepting, and decide with open eyes.

The fully sanctioned alternative exists: the Google Places API, licensed and billed per request, with its own storage restrictions. The extraction guide covers when it is the right choice.

3. What you do with the data, where the real rules are

GDPR and UK GDPR

Data about a company is not personal data; data about a person is. The trap in extracted lists is that small-business rows are frequently both: "Dave Smith Plumbing" with Dave's mobile number is personal data. The workable approach for EU and UK outreach is to treat lists as mixed, rely on documented legitimate interest for relevant B2B contact, say who you are and why you are contacting them, and honour objections immediately and permanently.

Email: CAN-SPAM, PECR and national rules

The US permits cold B2B email with identification, a postal address and working opt-outs. The EU picture varies by member state: corporate addresses (info@company) are generally reachable under legitimate interest, individual addresses less so, and states like Germany apply stricter consent standards. Verify per market before a volume send, and verify the addresses themselves for entirely separate deliverability reasons.

Calls and messaging

Cold B2B calling is broadly permitted but several markets operate do-not-call registries that apply to businesses too; screening against them is your obligation, not the registry's. SMS and WhatsApp are the most tightly regulated channels, and platform policy (account bans) will reach you faster than regulation does.

Per-country specifics

The frame above is general; registries, email regimes and calling rules differ sharply by market. Dedicated pages cover the United States, United Kingdom (where the CTPS covers businesses), India, Canada (where CASL rewrites the email rules), Australia and Germany (the strictest of the six).

The practices that keep you out of trouble

  • Collect business-directory fields and nothing more exotic.
  • Keep a suppression list and honour every opt-out across all channels, permanently.
  • Screen call lists against do-not-call registries where your market has them.
  • Send relevant offers to relevant categories; volume spam is what triggers complaints, and complaints are what trigger everything else.
  • Delete what you have no use for. Old lists are liability without value; they decay anyway.

Where this leaves you

Extracting Google Maps business data for B2B prospecting is a low-risk, widely practised activity whose main legal weight sits on the outreach side, where the rules are clear and followable. The honest statement of the tradeoff: collection is generally lawful but sits against Google's terms as a contract matter, and compliance effort belongs on how you contact people, which is the part regulators actually police. If your situation is unusual (consumer data, sensitive categories, high-volume messaging), pay a lawyer in your jurisdiction for an hour; this page is context for that conversation, not a substitute for it.

Frequently asked

Is scraping Google Maps illegal?
Collecting publicly displayed business information is not a criminal act in most jurisdictions, and US case law (notably the hiQ v. LinkedIn litigation) has treated access to public web data as outside the Computer Fraud and Abuse Act. But lawful-to-collect is not the end of the question: Google’s Terms of Service prohibit automated access without permission, which is a contract matter rather than a criminal one, and how you subsequently use the data is separately regulated by privacy and marketing law. This page is general information, not legal advice.
Is business data covered by GDPR?
Data about a company as such (a trading name, a shop address, a business category) is not personal data. It becomes personal data when it identifies a person: a sole trader operating under their own name, a mobile number belonging to an individual, or a named partner’s email. In practice, extracted lists in trades and small services contain plenty of such rows, so the safe working assumption in the EU and UK is that GDPR applies to at least part of every list, with legitimate interest as the usual lawful basis for relevant B2B outreach, documented and balanced.
Can I cold-call or cold-email extracted businesses?
Usually yes for genuine B2B outreach, subject to channel rules that differ by country. Cold B2B email is permitted in the US under CAN-SPAM (identify yourself, include a postal address, honour opt-outs) and in most of the EU to corporate addresses under legitimate interest, while some member states are stricter. Cold calls are legal in most places but several markets require screening against do-not-call registries first. WhatsApp and SMS are the most restricted channels and platform rules apply on top of law.
Could Google block or sue me for scraping?
The practical risk from Google is technical, not legal: rate limiting and blocking of traffic that looks automated. Contract-based claims against scrapers of public data have been rare and mostly aimed at large-scale commercial re-publishers of Google’s own content, not at businesses building prospect lists. That is a description of observed practice, not a guarantee.
What should I actually do to stay safe?
Keep to business-directory fields, honour opt-outs immediately and keep a suppression list, screen calls against do-not-call registries where they exist, verify before mass emailing, and delete rows you have no use for. Most enforcement in this space is triggered by outreach behaviour (spam volume, ignoring opt-outs) rather than by the act of collection.