Is Scraping Google Maps Legal? What the Law and Google's Terms Say (2026)

Q: Is it illegal to scrape Google Maps?

In most jurisdictions, scraping publicly visible business data from Google Maps is not a criminal offense. US courts have repeatedly held that collecting public data does not violate anti-hacking law. It does violate Google's Terms of Service, which is a contract matter: the realistic consequences are blocked requests or a terminated Google account, not prosecution.

Q: Can Google sue you for scraping Maps?

In principle yes, breach of contract claims exist. In practice Google enforces its terms technically, with rate limits, blocks and account bans. Public lawsuits from Google have targeted fraud like fake business profiles and fake reviews rather than the collection of public listing data.

Q: Can I use scraped Google Maps data for cold email or cold calls?

The scraping and the outreach are regulated separately. B2B cold email and calls are legal in most countries when you identify yourself, tell the truth, honor opt-outs and respect rules like CAN-SPAM, GDPR, CASL and national do-not-call lists. The data source does not exempt you from any of those duties.

Q: Does GDPR apply to Google Maps business listings?

GDPR protects natural persons, not companies. A company name, business address, category, rating and switchboard number are generally not personal data. Data about sole proprietors and named individuals is personal data, even when public, so you still need a lawful basis, transparency and a way to honor deletion requests.

Q: Is the official Places API automatically the safer choice?

It removes the terms-of-service conflict but adds strict storage limits: most Places API content may not be cached long term, which makes building a permanent lead database against the rules you agreed to. Compliant third-party tools that collect only public business data are how most teams build exportable lists.

Q: Do I need a lawyer before building a lead list?

For ordinary B2B lead lists built from public business listings, most teams operate on documented good practices: business-level fields only, published contact data with sources, honoring removals and complying with outreach laws. Get legal advice when you process consumer or sensitive personal data, or operate in a heavily regulated sector.

Ask this question to ten people and you get ten confident, contradictory answers. Here is the accurate one: in most jurisdictions, scraping publicly visible business data from Google Maps is not a crime, and courts have repeatedly declined to treat public-data scraping as illegal hacking. It does, however, violate Google's Terms of Service, which is a contract issue between you and Google, not a criminal one. Those are two very different kinds of risk, and almost every bad take on this topic comes from mixing them up.

This guide separates them. It covers what Google's terms actually prohibit, what courts have actually ruled, where the real legal exposure sits (spoiler: personal data and outreach law, not the scraping itself), and how to build lead lists that you can defend. None of it is legal advice; it is the map of the terrain.

The Short Answer, Question by Question

Question	Short answer
Is scraping Google Maps a crime?	Generally no, for public business data. Anti-hacking laws target bypassing access controls, not reading public pages.
Does it break Google's rules?	Yes. Google's terms prohibit scraping and bulk extraction of Maps content.
What can Google do about it?	Block requests, ban accounts and IPs. That is the enforcement you will actually meet.
Is the data itself protected?	Facts like a business name, address or rating are not copyrightable. Personal data is regulated separately.
Where is the real legal risk?	Processing personal data without a basis, and breaking outreach laws when you contact the list.

"Illegal" and "Against the Terms" Are Different Things

A law is enforced by the state. Break it and you face fines or prosecution. A terms-of-service document is a contract. Break it and the other party can end the relationship or, in theory, sue for breach. Nobody goes to jail over a contract.

Google's terms for Maps prohibit scraping, mass downloading and creating databases from Maps content. Collecting listings with an automated tool breaches that contract. What follows from a breach is Google's side of the deal: it can throttle you, serve CAPTCHAs, block your IP range and terminate Google accounts involved. If your business runs on a Google account you cannot afford to lose, that risk is worth taking seriously on its own.

What does not follow from a breach is criminal liability. For that, prosecutors in the US would need something like the Computer Fraud and Abuse Act (CFAA), and the courts have spent the last few years narrowing exactly that path.

What Courts Have Actually Said

Three decisions shape the current landscape:

hiQ Labs v. LinkedIn (US, 9th Circuit, 2019 and 2022). The court held that scraping data from publicly accessible pages does not violate the CFAA, because there is no "unauthorized access" when no gate was bypassed. The saga still ended with hiQ on the hook for breach of contract in the district court, and the parties settled in late 2022. The lesson cuts both ways: public scraping is not hacking, but contracts you accepted still bind you.
Van Buren v. United States (US Supreme Court, 2021). The Supreme Court narrowed the CFAA to a gates-up-or-down model: the law punishes going where you were never allowed, not misusing access you legitimately have. This decision is why purely public scraping keeps surviving CFAA claims.
Meta v. Bright Data (US, N.D. California, 2024). Meta sued a data collection company over scraping public Facebook and Instagram pages. The court granted summary judgment for Bright Data on the contract claims, reasoning that logged-out scraping of public pages was not bound by the terms that govern account holders. X Corp's similar suit against the same company was dismissed the same year.

None of these cases involved Google Maps directly, and none of them make scraping a free-for-all. But the pattern is consistent: US courts protect access to public data from hacking claims, and they scrutinize whether a contract even applies to logged-out collection. In the EU, there is no equivalent of the CFAA drama; the live questions are database rights and, far more importantly, data protection.

Google's own public enforcement, meanwhile, has focused on fraud. Its lawsuits around Maps have targeted networks selling fake business profiles and fake reviews. We are not aware of a public case where Google sued a company purely for collecting public listing data; its answer to that is technical blocking.

The Real Legal Risk: Personal Data, Not Business Data

Here is where careless lead generation actually gets expensive. Privacy law does not care how you obtained data; it cares that you process it.

Business-level data is largely outside privacy law. GDPR (and Turkey's KVKK, California's CCPA and their siblings) protect natural persons. "Central Plumbing Ltd, 12 High Street, 4.6 stars, category: plumber, phone: the shop line" is data about a company.
Sole proprietors blur the line. In much of Europe, a one-person business is a natural person. Their listing data can qualify as personal data even though it is public.
"It was public" is not a GDPR basis. Publicly available personal data is still personal data. Processing it needs a lawful basis (for B2B prospecting, usually legitimate interest), plus transparency and a working way to honor objection and deletion requests.
Using the list has its own laws. CAN-SPAM in the US, GDPR plus ePrivacy rules in the EU, CASL in Canada and national do-not-call registries govern what you may send and to whom. Our cold email guide and cold calling guide walk through those duties in practice.

For the wider privacy picture, including how to handle removal requests properly, see the legal and privacy guide to finding business contacts.

What About Just Using the Official API?

The Places API is Google's sanctioned door, and for showing fresh data inside an app it is the right one. For lead lists it has a structural problem: the license restricts caching and storing most of what it returns. Building a permanent, exportable database is precisely what the storage terms rule out, and the per-request pricing is designed for app traffic, not bulk collection. The full comparison lives in Google Places API vs scraping.

That is why the practical market splits in two: developers embedding Maps features use the API, and sales teams building lists use collection tools, accepting the terms-of-service tradeoff described above with eyes open.

How to Keep a Google Maps Lead List Defensible

A short checklist that keeps you on the boring, safe side of everything above:

Collect business-level fields. Name, category, address, business phone, website, rating, review count. Skip anything aimed at private individuals.
Only use published contact data, with sources. An email printed on the company's own website is a business reaching out to be reached. A guessed or "enriched from who knows where" address is a liability, legally and for deliverability.
Honor objections instantly. If a business asks to be removed from your list, remove it and record that you did.
Run outreach by the rules of each market. Identify yourself, no deceptive subjects, working opt-out, checked against do-not-call lists where they apply.
Keep provenance. Know when and where each record came from. If anyone ever asks, the answer "public listing, collected on this date, source attached" ends most conversations.

This checklist is also, not coincidentally, how BasedOnBusiness is built. It collects public business listing data, and when a business has a website it reads only that public site for published work emails, keeping the source page with every address. It never guesses emails and never probes inboxes, and removal requests are honored. If you use an AI assistant for prospecting, the same data is available inside ChatGPT and Claude through a connector; the AI lead generation guide shows that workflow.

FAQ

Is it illegal to scrape Google Maps? In most jurisdictions, no. Collecting publicly visible business data is not a criminal offense, and US courts have held that public scraping does not violate anti-hacking law. It does breach Google's Terms of Service, a contract matter whose realistic consequences are blocks and account bans.

Can Google sue you for scraping Maps? In theory, breach of contract claims exist. In practice Google enforces technically: rate limits, CAPTCHAs, IP and account bans. Its public lawsuits have gone after fake-listing and fake-review fraud, not the collection of public business data.

Can I use scraped Google Maps data for cold email or cold calls? Yes in most B2B contexts, but outreach law applies regardless of the source: honest identification, truthful content, working opt-outs, do-not-call checks. The scraping question and the outreach question are separate legal questions.

Does GDPR apply to Google Maps business listings? Company data is not personal data, so most listing fields fall outside GDPR. Sole proprietors and named individuals are the exception: their data is personal even when public, so a lawful basis and deletion handling are required.

Is the official Places API automatically the safer choice? It resolves the terms conflict but forbids exactly what lead generation needs: long-term storage of results. Most teams building exportable lists use dedicated tools and reserve the API for in-app features.

Do I need a lawyer before building a lead list? For public business-level data used in normal B2B outreach, documented good practice is usually enough. Bring in counsel when personal or consumer data enters the picture, or when you operate in a regulated industry.

Build the List Without the Gray Areas

The safest lead list is one made of public business data with documented sources, and that is the only kind BasedOnBusiness produces: business listings from Google Maps across 195 countries, published emails read from each company's own website with the source page attached, exported to CSV or Excel. You get 50 free credits at signup with no card required, one credit equals one business record, and paid plans start at $39 per month for 20,000 credits with a 7-day money-back guarantee. See plans and pricing or start at basedonb.com.