Is scraping Google Maps legal? The honest answer

Start with the unambiguous part: scraping Google Maps violates Google's Terms of Service. The terms prohibit accessing the service with automated tools and extracting data in bulk. That is not a gray area - every Maps scraper, browser extension, and "free extractor" operates against the contract Google puts in front of its users.

But a ToS violation is a contract matter, not a crime. The consequences come from Google, not from a prosecutor: CAPTCHAs, IP blocks, terminated accounts, and - for commercial operations at scale - the possibility of civil action. For a business that depends on a steady flow of leads, the practical risk is that your data pipeline disappears overnight, not that anyone goes to jail.

US litigation has settled into a pattern worth understanding, because it explains why "scraping public data is legal" and "the scraper lost" keep showing up in the same news cycle. Both are true. The anti-hacking statute has been read narrowly; contract has not.

The hacking statute keeps narrowing

In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court read the Computer Fraud and Abuse Act's "exceeds authorized access" as a gates-up-or-down question: someone entitled to reach information does not commit a federal crime by reaching it for a disapproved reason. Improper purpose stopped being a CFAA hook.

hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), applied that reasoning to scraping directly. Sent back down after Van Buren, the Ninth Circuit held that scraping profiles the public can see without logging in is unlikely to be access "without authorization" at all - there is no gate to pass.

Contract is where scrapers lose

The same case supplies the cautionary half. Months after that appellate win, the district court held that hiQ had breached LinkedIn's User Agreement, and the dispute ended in a settlement and a permanent injunction in December 2022. hiQ won the argument about hacking and lost the company.

Contract only reaches as far as it applies, though, and platforms have found that limit. In Meta Platforms, Inc. v. Bright Data Ltd.(N.D. Cal. 2024), Meta's breach-of-contract claim failed because Bright Data collected only logged-out, public pages - and Meta's terms bound logged-in users. Cross the login gate and the analysis flips: a Delaware jury found for Ryanair on a CFAA claim in Ryanair DAC v. Booking Holdings Inc. (D. Del. 2024), a case about access through user accounts rather than open pages. That case has continued through post-trial motions, which is itself the point - none of this is finished.

Europe adds a layer the US does not have

EU law protects databases in their own right. The sui generis right in Database Directive 96/9/EC lets the maker of a database prevent extraction of a substantial part of it, with no hacking and no copyright infringement required. And in Ryanair Ltd v PR Aviation BV, Case C-30/14 (CJEU, 15 January 2015), the Court held that where a database is protected by neithercopyright nor the sui generis right, the owner is still free to restrict its use by contract - the Directive's user protections simply do not apply. In other words: winning the intellectual-property argument in Europe can still leave you bound by the terms you clicked through.

What this means for a lead list

Courts have been reluctant to treat scraping public data as criminal hacking. Platforms keep winning on contract anyway, and Google Maps is used through a contract you accepted. If your pipeline depends on that data, "probably not criminal" is a thin foundation to build a business on - especially when a licensed route to the same data exists and costs less than the engineering time spent evading blocks.

Suppose you obtained a business list - scraped or not. Privacy and anti-spam law applies to how you use it, regardless of how it was collected:

• GDPR (EU/UK): B2B outreach to a business's published contact address can rely on legitimate interest - if your pitch is relevant to the business, you identify yourself, and you honor opt-outs immediately. Run the balancing test and write down the result; the obligation is to be able to show your reasoning, not merely to have had some.
• CAN-SPAM (US): the most permissive of the three. No prior consent needed, but every commercial email needs truthful headers and subject line, a valid physical postal address, and an unsubscribe mechanism that still works for 30 days after sending. Opt-outs must be honored within 10 business days.
• CASL (Canada): the strictest. Consent is required, but implied consent covers a business address the recipient conspicuously published without a "no unsolicited email" notice, where your message relates to their role. That carve-out is what makes Maps-sourced B2B outreach workable in Canada - and it is narrow, so read it before relying on it.
• ePrivacy and national rules: member states diverge sharply. Several treat B2B email far more permissively than B2C; others do not. Germany is notably stricter than the GDPR baseline alone suggests. Check the markets you actually target rather than assuming "EU" is one rule.

None of these ban emailing a business at the address it publishes for that purpose. All of them ban being deceptive or ignoring a no. The practical compliance work is unglamorous and small: send from a real identity, say why you are writing, make the unsubscribe obvious, and process it the day it arrives.

One distinction does real work here. info@ and contact@ addresses for a company are usually not personal data; the named partner at a two-person firm, or a sole trader's address, plainly is. The second group carries the full set of data-subject rights - access, erasure, objection - and a lead list drawn from local businesses will always contain both. Treating the whole list as if it were the stricter case is the cheap way to avoid sorting them.

Google sells official, licensed access to the same underlying data: the Places API. That is what Maps to Lead uses for every search - no automated browsers, no parsed HTML, no ToS violation.

The email-enrichment step deserves its own note: Maps to Lead's crawler reads each business's own public website- the homepage and contact page the business published precisely so people can contact it. That is a different activity from scraping Google's platform, both technically and legally: no platform terms are being violated, and the data collected is what the business chose to publish about itself.