Yes, in most cases. Scraping public business data from Google Maps, such as names, phone numbers, addresses, and ratings, sits on solid legal ground in the US after recent court rulings. The risk lives in two places: what you collect, and how you use it for outreach.
What have US courts decided about scraping public data?
The short answer rests on two court decisions and one recent lawsuit. Scrap.io's 2026 guide, "Google Maps Scraping: Complete 2026 Guide (No-Code & API)," points to hiQ Labs v. LinkedIn as the ruling that set the terms of the debate. In 2022, the Ninth Circuit held that scraping data open to the public does not violate the Computer Fraud and Abuse Act, the main US federal law on computer access.
The Supreme Court had already narrowed the same statute a year earlier, in Van Buren v. United States (2021). Lobstr's 2026 review of scraping law, "Is Scraping Google Maps Legal? What Google's Own Lawsuit Shows," describes the combined effect: the federal hacking law now reaches a smaller set of conduct, and reading pages that anyone can open sits outside it.
Both rulings deal with data a visitor can see without an account. Pages behind a login, data pulled after a platform has cut off access, and private user data sit in a different posture, and the courts have said far less about them. A scraper that stays on public listing pages works inside the ground the rulings cover.
Google did test the boundary in court. Lobstr reports that Google sued SerpApi, a scraping company, in December 2025. Per Lobstr's account, the court dismissed Google's DMCA theory in July 2026, and the Maps claims dropped out of Google's amended complaint. Day to day, Google's enforcement stays technical: CAPTCHAs, rate limits, IP throttling, and account suspension.
Google's Terms of Service and the law are two different things
Google's terms prohibit automated access to Maps. Scraping breaks the contract a person accepts when using the service. That sounds final. It is not. A contract breach and a crime are different things, and US courts have kept the two apart in case after case on public data.
That split is the heart of every google maps scraper legality question. A terms breach still carries real costs: Google can block the traffic, slow it down, or close the account doing the scraping. So the honest answer to "is it legal to scrape Google Maps" has two parts. The law allows far more than Google's terms allow, and a sound process plans for both.
GDPR, CCPA, CAN-SPAM: three rulebooks that govern the outreach, not the scrape
Three rulebooks matter most to B2B teams, and each one regulates the messages sent after collection far more than the collection itself.
GDPR and legitimate interest in the EU
Scrap.io's guide notes that B2B outreach to EU businesses can rest on legitimate interest under GDPR Article 6. That basis carries conditions. The contact has to be relevant to the person's job, and every message needs a clear opt-out that works. Teams asking about scraping Google Maps GDPR duties usually worry about the scrape itself. The duties attach at the outreach stage, and they attach harder when the record names a person. A reviewer's name is personal data even when the review sits in public, so a team that stores reviewer names takes on duties that a star rating alone never triggers.
CCPA and California contacts
California's CCPA gives residents rights over their personal data, and contact records that name a person can fall inside it even in a B2B setting. The older B2B exemption no longer softens that point: it expired on January 1, 2023, when the CPRA amendments took effect, and the Act now has no general B2B exception. One boundary still matters. The Act's definition of personal information leaves out publicly available information, which reaches data a business publishes about itself for customers to find, such as a listing phone number or street address. A named person's own email address sits closer to the line, so the careful course is to treat named contacts as covered and to build opt-out and deletion handling into the workflow.
CAN-SPAM and US cold email
CAN-SPAM is the clearest of the three rulebooks. Per the summary in Scrap.io's guide, every cold email needs truthful header information, a real physical postal address, and a working unsubscribe link, and the sender must honor opt-outs. The Act does not ban cold B2B email. It sets the conditions each message has to meet, and a list built from Maps data meets them the same way any other list does.
Which data is low-risk, and which data creates risk?
Risk follows the data type. Facts a business publishes to win customers carry low risk. Data tied to a named person carries more, because privacy law protects people rather than businesses. Lobstr warns against republishing review text at scale on the same logic: the words belong to the reviewer who wrote them. For the tooling side of extraction, the Google My Business scraper guide walks through how a scrape pulls each field.
| Data point | Risk level | Reason |
|---|---|---|
| Business name and category | Low | The business publishes both to be found by customers. |
| Business phone number | Low | A public contact channel, printed for inbound calls. |
| Street address | Low | Core listing data, shown on every public profile. |
| Star rating and review count | Low | Aggregate numbers about the business, not a person. |
| Opening hours | Low | Public listing data with no personal element. |
| Generic business email, such as info@ or contact@ | Low to medium | It belongs to the business; outreach rules still apply in full. |
| Named personal email | Higher | Personal data; GDPR and CCPA duties can attach to it. |
| Individual reviewer names | Higher | Personal data with no B2B need in most campaigns. |
| Review text republished on other sites | Higher | The text is the reviewer's own content. |
A compliance checklist before the first scrape
Lobstr's practical guidance for staying inside the rulings is plain: scrape logged out, and respect rate limits. The checklist below folds that guidance together with the duties from the three rulebooks. The free GMB lead extractor guide shows a finished export that follows this shape.
- Collect public business fields only: business name, category, phone, address, website, rating, and hours.
- Leave reviewer names out of the export unless a named person is the prospect.
- Scrape logged out and at a moderate pace, inside the posture the court rulings protect.
- Record the source of each list, so a reply to "where did you get my number" takes a minute, not a day.
- Put a working unsubscribe link and a real physical address in every cold email before the first send.
- Honor each opt-out fast, and keep a suppression list that later campaigns cannot override.
- For EU contacts, give a work-related reason for writing and a simple way to object.
- Review the list against the rules of each market you plan to mail, since duties differ by country and state.
One limit deserves a plain statement. A Maps scraper suits public B2B prospecting. It is the wrong tool for consumer marketing lists or private contact details. Any campaign built on data a business chose not to publish needs consented sources instead.
This page is legal information, not legal advice. Rules change by country and by use case, and a business that scrapes at scale or sells into the EU should have its own counsel review the process before launch.
Frequently asked questions
Is it legal to scrape Google Maps?
For public business data, yes in most cases. US courts, led by hiQ Labs v. LinkedIn in the Ninth Circuit in 2022, have held that collecting data anyone can view does not violate the federal hacking law. The answer changes when you collect personal data, scrape behind a login, or break the outreach rules that apply in your market.
Can Google sue me for scraping Maps data?
Google can sue anyone, and Lobstr reports that it sued SerpApi in December 2025. Per that reporting, the court dismissed the DMCA theory in July 2026 and the Maps claims left the case. Google's day-to-day enforcement is mostly technical: CAPTCHAs, rate limits, and account suspensions. A lawsuit is possible but rare for a small B2B scraper.
Does scraping Google Maps break Google's terms?
Yes. Google's terms prohibit automated access to Maps, so scraping sits outside the contract a user accepts. A terms breach is a contract matter, not a crime, and courts have kept that line in place. The practical cost is account action: Google can throttle traffic, serve CAPTCHAs, or suspend an account it catches scraping.
Is it legal to cold email addresses collected from Google Maps?
In the US, yes for B2B, if each email follows CAN-SPAM: truthful headers, a physical address, and a working unsubscribe. In the EU, outreach can rest on legitimate interest under GDPR Article 6, and the recipient must get a clear opt-out. Named personal addresses carry more risk than generic ones such as contact@ addresses.
Is scraping Google reviews legal?
Mostly yes for the numbers. Star ratings, review counts, and averages are public business data, and collecting them sits on the same ground as other listing data. Review text is user content, so republishing it at scale creates a separate problem. Reviewer names are personal data under GDPR, so drop them unless you have a clear need.
If your process follows the checklist, the habits around the tool matter more than the tool itself. GoLeads Pro states on its site that it collects publicly listed business data and verifies the emails it exports. Read the FAQ page for the compliance questions buyers ask most, then decide whether that workflow fits the rules your market sets.
