Is It Legal to Scrape Google Maps? US & EU Rules for 2026

Short answer: scraping public business data from Google Maps is legal in the United States, and collecting public B2B data in the EU is generally lawful under GDPR’s legitimate-interest basis — with conditions. The longer answer involves three separate things people tend to blur together: US computer-access law, EU data-protection law, and Google’s own Terms of Service. They aren’t the same, and only some of them are actual law.

This is a practitioner’s explainer, not legal advice. We sell a Google Maps tool, so read it with that in mind — but the cases and rules below are public record, and we’ve linked the sources so you can check them. If your situation is high-stakes, talk to a lawyer who knows your jurisdiction.

The three things people confuse

When someone asks “is it legal to scrape Google Maps,” they’re usually mixing up:

1. Criminal/civil computer-access law (in the US, the Computer Fraud and Abuse Act)
2. Data-protection law (in the EU, GDPR; in California, CCPA)
3. Contract (Google’s Terms of Service)

A scrape can be lawful under #1 and #2 while still breaking #3. Breaking a contract is not a crime — it’s a private matter between you and the other party. Keeping these straight is the whole game.

US law: public data is fair game

The anchor case is hiQ Labs v. LinkedIn. hiQ, an analytics company, scraped public LinkedIn profiles. LinkedIn tried to block it, arguing the scraping violated the CFAA. The Ninth Circuit ruled in 2022 that scraping data which is publicly accessible without a login does not constitute “unauthorized access” under the CFAA. (Ninth Circuit, hiQ v. LinkedIn, 2022)

That was reinforced by the Supreme Court’s Van Buren v. United States (2021), which narrowed what “exceeds authorized access” means under the CFAA — you can’t turn a terms-of-service violation into a federal crime. (Van Buren v. United States, 2021)

One nuance worth knowing: hiQ and LinkedIn settled privately in 2023, with hiQ paying and agreeing to destroy the data. People sometimes cite that settlement as if it reversed the ruling. It didn’t — a private settlement doesn’t undo a circuit-court precedent. The hiQ standard still stands. (2026 web scraping legal guide)

So in the US, scraping the public business listings on Google Maps — names, addresses, phones, public websites — sits on solid legal ground. The data is public, you’re not logging in, and you’re not circumventing a technical lock.

EU law: GDPR applies to people, not businesses (mostly)

GDPR governs personal data of EU residents, no matter where your company or servers sit. The key question is whether what you’re collecting is personal data.

• Pure business data — a company name, a storefront address, a general info@ line, a main phone number — is generally collectable under the legitimate-interest basis, GDPR Article 6(1)(f), provided you can justify the interest and you honor opt-out requests. (web scraping legal guide 2026)
• Personal data — a named individual’s direct email (jane.smith@firm.com), a personal mobile — pulls you fully into GDPR: you need a lawful basis, you must be able to respond to access and deletion requests, and you should be ready to explain your legitimate-interest assessment.

In practice, B2B prospecting against business contact points is the comfortable zone. The moment you’re building a list of named individuals’ personal contact details, treat it as regulated and put a process behind it.

California’s CCPA/CPRA follows a similar logic for California residents — public information gets lighter treatment, but personal information carries obligations.

Google’s Terms of Service: a contract, not a law

Here’s where it gets blunt. Google’s Maps Platform Terms of Service prohibit scraping and bulk extraction. That’s real — but it’s a contract term, not a statute. (Google Maps Platform ToS explained)

Courts have repeatedly held that violating a website’s ToS is not, by itself, a CFAA violation. The practical consequence of breaking Google’s ToS isn’t prosecution — it’s that Google can rate-limit you, block your IP, or terminate accounts tied to its paid APIs. That’s an operational risk, not a legal one, and it’s a big reason the safer tools pull from the public front-end at human-scale speeds rather than hammering Google’s infrastructure. We get into the mechanics in scraping Google Maps without getting blocked.

The practical line: what’s safe vs risky

From the rules above, a simple risk gradient falls out.

Lower risk:

• Public business listings (name, address, phone, website, category, hours)
• Business-level contact points (info@, main line) for B2B outreach
• Reasonable volumes that don’t degrade Google’s service
• Honoring unsubscribe and deletion requests promptly

Higher risk:

• Building lists of named individuals’ personal emails/mobiles, especially EU residents, without a documented basis
• Circumventing logins, CAPTCHAs, or technical blocks
• Reselling raw personal data
• Industrial-scale extraction that ignores rate limits

Most B2B lead generation lives entirely in the lower-risk band. The trouble starts when “leads” quietly becomes “personal data” and nobody set up a process for it. If you’re collecting emails, our email extraction guide covers doing it at the business level.

What to keep on record

If you operate in or sell to the EU, the legitimate-interest basis isn’t a free pass — it expects you to be able to show your work. You don’t need a law firm on retainer, but a small paper trail makes the difference if anyone asks:

• A one-page legitimate-interest assessment. Plainly state why you’re collecting (B2B outreach to relevant businesses), what you collect (business contact fields), and why it’s proportionate. Writing it down once covers most campaigns.
• Source and date per record. Note that the data came from public Google Maps listings and when. This is also good data hygiene — stale records are the first thing to re-check.
• A working opt-out. Every outreach message needs a real way to say “stop,” and you need to actually honor and log it. A suppression list you append to forever is enough.
• Deletion on request. Be able to find and remove a person’s record if they ask.

None of this is heavy. It’s an afternoon of setup that turns “we scrape stuff” into a defensible process.

Outreach legality is a separate question

One more thing people miss: collecting data and contacting people are governed by different rules. Even if your list is lawfully built, your outreach has to follow CAN-SPAM (US email), the ePrivacy/PECR rules (EU/UK marketing), and similar regimes — accurate headers, a real unsubscribe, honest subject lines, and respecting opt-outs. A clean list emailed badly is still a problem. The targeting and sequencing side is covered in our lead generation guide.

Conclusion

Is it legal to scrape Google Maps? For public business data in the US, yes — hiQ and Van Buren put that on firm footing. In the EU, public B2B data is generally fine under legitimate interest, while named-individual personal data pulls you into full GDPR obligations. Google’s ToS says no, but that’s a private contract whose real teeth are blocks and bans, not prosecution.

Stay in the public-business-data lane, honor opt-outs, don’t circumvent technical protections, and keep collection at a reasonable pace, and you’re in the same position as the analytics companies that won these cases. If you want to start small and lawful, our free tier pulls public business listings, 50 a month, no card.

Frequently asked questions

Is it legal to scrape Google Maps in the US? Yes, for public business data. The Ninth Circuit’s hiQ v. LinkedIn ruling (2022) and the Supreme Court’s Van Buren decision (2021) established that scraping data which is publicly accessible without a login does not violate the Computer Fraud and Abuse Act.

Does GDPR ban scraping Google Maps in Europe? No. Public business data can generally be collected under GDPR’s legitimate-interest basis (Article 6(1)(f)), as long as you can justify the interest and honor opt-out and deletion requests. Named individuals’ personal data carries fuller GDPR obligations.

Does scraping Google Maps violate Google’s Terms of Service? Google’s Maps Platform Terms of Service prohibit scraping, but a Terms of Service is a private contract, not a law. Breaking it isn’t a crime; the practical consequence is that Google may rate-limit, block, or ban accounts rather than pursue prosecution.

What’s the safest way to scrape Google Maps legally? Stick to public business data, collect at reasonable volumes that don’t strain Google’s service, avoid circumventing logins or CAPTCHAs, target business-level contacts rather than individuals’ personal data, and honor unsubscribe and deletion requests.