Is scraping Google Maps legal? An honest answer

Three different questions people are actually asking

"Is it legal" collapses three separate questions that have three different answers. Untangling them is most of the work.

1. Does it breach Google's terms? Yes, plainly. Not arguable.
2. Is it a crime? Almost certainly not, for public data, in the US and UK.
3. Can I lawfully use the resulting data to market? That depends far more on where your prospects are than on how you got the list — and this is the one that actually generates fines.

1. Google's terms

Google's Terms of Service prohibit automated access to their services except through published APIs. There is no ambiguity and no clever reading that gets around it. Anyone who tells you their tool is "fully compliant" while automating a browser session against Maps is either confused or lying.

What that means concretely: this is a contract question, not a criminal one. The remedy available to Google is the remedy available to any service whose terms you breach — they can restrict or terminate your access. For most people that means a CAPTCHA, then a temporary block.

2. The criminal and civil position

In the United States, the key case is hiQ Labs v LinkedIn. Over several years of litigation the Ninth Circuit held that scraping publicly accessible data — data not behind a login — does not constitute "unauthorised access" under the Computer Fraud and Abuse Act. The CFAA is the statute that would turn scraping into a federal crime, and it was found not to reach public pages.

Two important caveats that get dropped from most summaries of that case:

• hiQ still lost on contract. The CFAA claim failed, but breach of LinkedIn's user agreement was a separate matter, and hiQ ultimately settled under an injunction. "Not a crime" is not the same as "no consequences".
• It turns on data being public. Data behind a login is a different analysis entirely. Google Maps search results are public — you do not need an account to see them — which is why the reasoning applies.

In the UK and EU, there is no direct CFAA equivalent for public data. The Computer Misuse Act 1990 concerns unauthorised access to computer material, and viewing a public web page is not that. The relevant risks are contractual and data-protection ones instead.

3. The part that actually carries fines: what you do next

Here is the reframe most articles miss. Regulators have shown very little interest in how you obtained a list of business names. They have shown a great deal of interest in what you did with it.

UK and EU: GDPR and PECR

Business contact details are still personal data when they identify a person — john@smithplumbing.co.uk is personal data; info@smithplumbing.co.uk generally is not. A sole trader's business details are personal data, because the sole trader and the business are the same legal person.

If you collect and process that data you are the data controller. That carries real obligations:

• A lawful basis. For B2B prospecting this is normally legitimate interests, which requires you to actually carry out and record a balancing test.
• Notification. Under Article 14, where you collect data from somewhere other than the person themselves, you generally have to tell them within a month or at first contact.
• Honouring objections, and deleting on request.

For electronic marketing specifically, PECR in the UK is stricter than GDPR: unsolicited marketing email to individual subscribers and sole traders needs consent or an existing customer relationship. Email to a registered company's corporate address does not. That distinction is why "scraped emails" gets people into trouble and "scraped phone numbers for B2B calls" mostly does not — though for calls you must screen against the TPS and CTPS.

United States

CAN-SPAM does not require prior consent for commercial email, which makes the US far more permissive than the UK or EU. It does require accurate headers, a non-deceptive subject line, a physical postal address, and a working opt-out honoured within ten business days. State law adds to this — California's CCPA and CPRA give consumers deletion rights that can extend to sole proprietors.

Nobody has ever been fined for how they built a list. People are fined regularly for how they emailed it.

What actually happens in practice

Setting law aside, here is the realistic risk ladder, in the order you will encounter it:

1. A CAPTCHA. By far the most common outcome. Google notices unusual request patterns from your IP and asks you to prove you are human. Any tool worth using stops at this point rather than trying to push through.
2. Thinner results. Before an outright block, Maps quietly returns fewer results for the same search. People usually misread this as the tool breaking.
3. A temporary IP block. Hours, occasionally a day. Resolves itself.
4. A cease and desist. Rare, and aimed at businesses operating at scale or reselling the data as a product — not at an agency pulling a few hundred rows a week.
5. Litigation. Vanishingly rare against small operators. Google's enforcement effort goes to large-scale commercial redistribution.

How to keep yourself at the bottom of that ladder

• Do not run flat out. Deliberate pacing between listing visits is what keeps you below the detection threshold. A tool that boasts about speed is optimising for a demo, not for your account.
• Stop when told. If a verification prompt appears, stop for a few hours. Solving it and continuing is what escalates you a rung.
• Take less. Filtering to the forty businesses you will actually call means forty listing visits, not twelve hundred. Narrow targeting is a compliance measure as well as a time saver.
• Keep the data local. Data on your own machine is not part of a redistributed database, which is the pattern that attracts attention.
• Do not resell the raw data. Using a list to find your own customers is a different activity from packaging it up and selling it, both legally and in terms of who gets noticed.

The licensed alternative, honestly described

Google's Places API returns much of the same information under a proper commercial licence. If you need a defensible data-provenance trail — a regulated industry, a funded research project, a client who will ask where the data came from — use it. We would rather say so than take your money and have you want it back.

The honest trade-offs:

• For: fully licensed, no terms problem, stable and documented.
• Against: priced per request and expensive at prospecting volumes; no email addresses at all; and the filtering you actually want — "no website", "unclaimed", "under ten reviews" — is not something you can ask the API for. You would pull everything and filter afterwards, which is the problem you were trying to solve.

So: should you?

If you are an agency or a sales team building a targeted list of local businesses to contact yourself, keeping the data on your own machine, pacing sensibly and following the marketing rules in your market — the risk is a CAPTCHA, and thousands of businesses operate this way.

If you plan to resell the data, operate at industrial volume, or need to tell a regulator exactly where every record came from — use the Places API, and budget for it.

The thing not to do is assume it is a settled non-issue because a tool's marketing page did not mention it.

---

Sources worth reading directly: hiQ Labs, Inc. v LinkedIn Corp. (9th Cir.); the UK ICO's guidance on direct marketing and legitimate interests; the FTC's CAN-SPAM compliance guide; and Google's own Terms of Service.