Scraping Google Maps is not automatically illegal, but it isn't risk-free either. In the US, courts have held that collecting publicly visible, logged-out web pages is not "unauthorized access" under the federal anti-hacking law (hiQ v. LinkedIn, 2022). Google's own terms, though, prohibit mass downloading Maps content and using it to build business listings databases or mailing lists, so scraping can still breach a contract. And once you hold the data, privacy laws such as the GDPR, KVKK and CCPA, plus email laws such as CAN-SPAM and PECR, decide what you may do with it. The legal risk depends less on the scraping itself than on how you collect it, what you keep and how you use it.
This guide is general information, not legal advice. It walks through the four separate legal layers, quotes Google's current terms (checked on 28 October 2026), and explains what the key court cases did and didn't decide. If you're building a product on Maps data or running outreach at scale, have a lawyer review your specific use.
The four legal questions hiding in one
"Is it legal?" is really four questions. Most of the confusion comes from treating them as one.
| Layer | The question | What decides it | Typical consequence |
|---|---|---|---|
| Computer-access law | Is collecting the data "unauthorized access"? | CFAA in the US, similar laws elsewhere | Criminal or civil liability, the biggest risk if it applies |
| Contract | Does it break Google's terms? | Google Maps Additional Terms, Google Terms of Service, Maps Platform terms | Blocking, account action, breach-of-contract claims |
| Data protection | Can you hold and process this data? | GDPR (EU), UK GDPR, KVKK (Türkiye), CCPA/CPRA (California) | Regulator fines, deletion orders |
| Marketing law | Can you contact these businesses? | CAN-SPAM (US), PECR (UK), CASL (Canada), ePrivacy rules in the EU | Per-message penalties, complaints |
A list of restaurant phone numbers might be fine under one layer and a problem under another.
What Google's terms actually say
Three Google documents matter, and they apply to different people.
1. Google Maps/Google Earth Additional Terms of Service (last modified 27 January 2026). These apply to anyone using Google Maps. Section 2, "Prohibited Conduct", says you may not:
- "mass download or create bulk feeds of the content (or let anyone else do so)";
- "copy the content", except as the Street View permissions page or intellectual property law allows;
- "use Google Maps to create or augment any other mapping-related dataset (including a mapping or navigation dataset, business listings database, mailing list, or telemarketing list)" for use in a service that substitutes for or substantially resembles Google Maps;
- "redistribute or sell any part of Google Maps".
The word "scrape" doesn't appear, but bulk downloading and building a business listings database or mailing list are named directly.
2. Google Terms of Service (effective 30 July 2026). Under "Don't abuse our services", they prohibit "using automated means to access content from any of our services in violation of the machine-readable instructions on our web pages (for example, robots.txt files that disallow crawling, training, or other activities)".
3. Google Maps Platform Terms of Service. These bind developers who use the Maps APIs. Section 3.2.3 says customers must not "export, extract, or otherwise scrape Google Maps Content for use outside the Services". If you have a Maps Platform account and API key, this clause binds you contractually. Our API vs scraping comparison covers what the API terms allow you to store.
The takeaway: Google does not permit scraping Maps. The open legal question is how far those terms can be enforced against someone, and what the consequences are, which is where the court cases come in.
What the courts have decided
We did not find a published court decision about scraping Google Maps specifically. The cases everyone cites involve LinkedIn and Meta, so read them as guidance, not as rulings about Maps.
| Case | Date | What it decided | What it left open |
|---|---|---|---|
| Van Buren v. United States (US Supreme Court) | 2021 | Read the CFAA's "exceeds authorized access" narrowly: the question is whether a "gate" is up or down for you | Contract, privacy and copyright claims |
| hiQ Labs v. LinkedIn (9th Circuit) | 18 April 2022 | Scraping public profiles that need no login is unlikely to be access "without authorization" under the CFAA; a public site "has erected no gates to lift or lower" | Breach of contract, copyright, trespass to chattels |
| hiQ Labs v. LinkedIn (district court, then settlement) | November–December 2022 | The court found hiQ breached LinkedIn's user agreement, which it had accepted when it created an account, and had used fake profiles. The case settled with a permanent injunction and a $500,000 consent judgment | Settlement terms aren't precedent |
| Meta Platforms v. Bright Data (N.D. Cal.) | 23 January 2024 | Meta's terms didn't cover Bright Data's logged-off scraping, because a logged-off scraper "stands in the same shoes as a visitor to whom the Terms cannot apply" | A tortious interference claim remained; facts and wording of terms matter |
Three practical lessons follow.
- Logged-out and public is the safest position. Both the hiQ appeal and Bright Data turned on the data being visible without an account.
- Logging in changes things. hiQ ultimately lost on contract because it had accepted LinkedIn's terms and used fake accounts. Scraping while signed in to a Google account you created, or with an API key, is a different position from browsing as a visitor.
- These are US cases. Outside the US, contract, database and computer-misuse laws differ, and none of these rulings binds a European court.
Business data vs personal data
This is the layer that catches most lead-generation projects, especially in Europe.
GDPR applies to personal data: information that identifies a living person. Google Maps listings mix the two kinds.
| Field | Usually personal data? | Why |
|---|---|---|
| Company name, category, address of a limited company | No | Identifies a business, not a person |
| Main switchboard phone, info@ / contact@ address | Usually no | A role contact, not an individual |
| Sole trader's trading name, mobile number, name@ email | Yes | Identifies a specific person |
| Review text and reviewer names | Yes | Written by identifiable individuals |
| Rating, review count, opening hours | No | Describes the business |
Being public does not take data outside the GDPR. If you collect personal data, you need a lawful basis (for B2B prospecting this is usually legitimate interests, backed by a documented balancing test). You also have to tell people where you got their data (Article 14), keep it only as long as you need it, and answer access and deletion requests. KVKK in Türkiye and the CCPA/CPRA in California set comparable rules.
A real enforcement example. On 5 December 2024 the French regulator CNIL fined KASPR €240,000. KASPR sold a Chrome extension that pulled professional contact details from LinkedIn profiles into a database of about 160 million contacts. The CNIL found four failures:
- it collected details of people who had limited their visibility, beyond what they "could reasonably expect";
- it kept data for five years and restarted the clock on every update;
- it only began informing people about four years after launch, in an English-only email;
- when people asked where their data came from, it answered only "publicly accessible sources" instead of naming the source.
It wasn't a Google Maps case, but the lessons carry over to lead tools: respect what people chose to make visible, set a retention period, be able to say where each record came from, and tell people in their own language.
Rules for contacting the businesses
Even a lawfully collected list can be used unlawfully. Before the first email:
- US (CAN-SPAM). The FTC says the law "makes no exception for business-to-business email". Identify yourself, include a valid physical postal address, give a working opt-out, and honor it within 10 business days. Each violating email can draw a penalty of up to $53,088.
- UK (PECR). You can email corporate subscribers (limited companies) without consent, as long as you identify yourself and offer an opt-out. Individual subscribers, which include sole traders and some partnerships, need consent or a soft opt-in.
- EU and elsewhere. Rules on unsolicited B2B email vary by country, and Canada's CASL is stricter than CAN-SPAM. Check the rules where your recipients are, not just where you are.
A practical checklist before you scrape
None of this guarantees compliance, but it addresses the risks the cases and regulators actually point to.
- Define the purpose. Write down why you need the data, for example "prospecting dental clinics in Leeds for a booking product". Every other decision follows from this.
- Collect logged-out, public data only. Don't scrape through an account or API key whose terms you've accepted, and don't get around login walls or blocks.
- Take only the fields you need. If you're calling businesses, you may not need review text or reviewer names at all.
- Keep provenance. Record where each record and email address came from and when it was collected.
- Set a retention period. Delete or refresh old rows instead of keeping them indefinitely. Business details go stale quickly anyway.
- Separate companies from individuals. Treat sole traders and personal-looking email addresses as personal data with stricter outreach rules.
- Honor opt-outs everywhere. Keep a suppression list and check every new import against it.
- Don't republish or resell the raw dataset. That moves you closest to what Google's terms describe as a substitute listings database.
- Get advice for anything large. A commercial product or a high-volume campaign deserves a lawyer's review of your specific use.
Where MapScraper fits
MapScraper extracts publicly listed business data from Google Maps and Bing Maps. A few parts of how it works line up with the checklist above:
- Provenance per row. Every email comes with an email source column, the exact page on the business's own website where the address was published. Every row has a scraped at timestamp, so you can show where and when you got a record and know when it's time to refresh it.
- Emails from the business's own site. Addresses are crawled from each business's website (home, /contact, /about), not from directories or aggregators. Our email extraction guide explains how this works.
- Fewer columns when you need fewer. Besides the full export, there's a clean 13-column CSV. The field reference lists all 41 fields so you can decide what you actually need.
- Count before you collect. A free pre-count tells you how many businesses an area holds before anything is charged or downloaded.
What MapScraper can't do is make your use lawful. Choosing a lawful basis, informing people, honoring opt-outs and following email rules are the responsibility of whoever uses the data. If you're prospecting a specific sector, the industry pages such as dentists and restaurants, or use cases like cold calling lists, show what a list looks like before you build one.
Summary
- Computer-access law (US): scraping public, logged-out pages has so far not been treated as unauthorized access under the CFAA (hiQ, 2022; Van Buren, 2021).
- Google's terms: they prohibit mass downloading Maps content and building listings databases or mailing lists from it, and the Maps Platform terms bar API customers from scraping. Breaking them is a contract and enforcement risk, not a crime in itself, and accepting terms through an account makes them easier to enforce (hiQ's 2022 contract loss).
- Data protection: public business data can still be personal data. Sole traders, personal emails and reviewer names fall under GDPR, KVKK and CCPA. The CNIL's €240,000 KASPR fine shows what regulators look at.
- Outreach: CAN-SPAM, PECR, CASL and similar laws decide whether and how you can email the businesses you found.
If you decide a Maps-based lead list fits your use, MapScraper's free pre-count shows the size of an area before you spend anything, and the launch offer of 1,000 leads for $5 (emails included, one-time, the leads never expire).