Somewhere right now, a sales rep is staring at Google Maps, thinking: "This is all public. I can just... grab it, right?" Thousands of business names, phone numbers, addresses — sitting there in the browser, practically begging to be exported into a spreadsheet.
But "visible" and "free to scrape" are not the same thing. I dug through Google's actual terms, court rulings, privacy regulations, and enforcement patterns to put together an answer that goes beyond the usual "it depends" hand-wave. This article is legal information, not legal advice, and reflects the sources checked on July 14, 2026 — covering what Google's own documents say, what courts have ruled, where privacy law draws lines, and what your practical options look like if you need local business data.
Is Scraping Google Maps Legal? The Short Answer
Scraping publicly visible Google Maps data is not automatically a crime under current U.S. public-data scraping precedent. But it is clearly prohibited by Google's own terms in most of the ways people actually want to use it.
That single sentence contains a lot of tension. When people ask "is it legal?" they're really asking about several overlapping layers:
- Computer access law (CFAA in the U.S.): Can you be prosecuted for accessing public data?
- Contract / Terms of Service: Does Google's license forbid it, and what happens if you violate that license?
- Privacy law (GDPR, CCPA): Does the data contain personal information, and do you have a lawful basis to process it?
- Intellectual property and user-generated content: Are reviews, photos, and map tiles protected?
- Platform enforcement: Will Google block you, suspend your account, or send a cease-and-desist?
No single "yes" or "no" covers all five. Google Maps is more restrictive than most public websites — it's a licensed map-and-database product with unusually explicit terms. The real answer depends on what you scrape, how you scrape it, where you are, and what you do with the data.
What Google Maps Scraping Usually Means
Google Maps scraping means using software to automatically pull data from Google Maps listings, search results, place pages, reviews, photos, map tiles, routes, geocodes, or Places API responses. A bot visits the pages and extracts structured information instead of a human copying it by hand.
The data people typically want falls into a few categories:
- Business facts: name, address, phone number, website URL, hours of operation, category
- Ratings and reviews: star ratings, review text, reviewer names, owner responses
- Photos: business photos, user-uploaded images, Street View imagery
- Map/geo content: map tiles, geocodes, routes, distance calculations, elevation data
- Account-gated data: Business Profile owner/manager information (requires login)
One distinction matters more than people realize: logged-out public visibility (what anyone sees without signing in) versus logged-in or API access (account credentials, API keys, additional contractual terms). Most scraping discussions focus on the logged-out case. The terms differ significantly depending on which side of that line you're on.
Common use cases: local lead generation, competitor mapping, store-location audits, review monitoring, market sizing, real estate prospecting. The motivation is understandable — Google Maps is arguably the world's largest business directory.
But that doesn't mean the data is yours to take.
Legal vs. Against Google's Rules: Why the Distinction Matters
Most articles on this topic get this wrong. A Terms of Service violation and a criminal computer-access violation are different things with different consequences.
| Rulebook | Who Enforces It | Common Consequences | What Matters Most | Google Maps-Specific Note |
|---|---|---|---|---|
| Computer access law (CFAA) | Federal/state prosecutors, private plaintiffs | Criminal charges, civil damages | Whether you accessed data without authorization or exceeded authorized access | Public, logged-out data is less likely to trigger CFAA after Van Buren and hiQ |
| Google Terms of Service / Maps Additional Terms | Google (contract enforcement) | Account suspension, API key revocation, IP blocks, cease-and-desist, civil lawsuit for breach | Whether you violated the specific license terms | Google Maps terms explicitly prohibit bulk extraction, lead-list building, and creating substitute directories |
| Privacy law (GDPR, CCPA) | Data protection authorities, individuals | Fines, enforcement orders, private claims | Whether personal data is processed with a lawful basis, notice, and minimization | Reviews, reviewer names, sole-proprietor details, and photos can be personal data |
| Intellectual property / copyright | Rights holders, courts | Takedown, injunction, damages | Whether you copied protected expression (reviews, photos, map tiles) | User-generated reviews and photos have copyright protection |
| Platform technical enforcement | Google's automated systems | IP bans, CAPTCHAs, rate limiting, account suspension | Whether your access pattern triggers bot detection | Google invests heavily in anti-bot measures on Maps |
Even if a court wouldn't convict you of a computer crime for scraping public Google Maps data, Google can still sue you for breach of contract, block your access, revoke your API keys, and send a cease-and-desist. Don't treat ToS violations as harmless.
The type of risk is different. It's still real risk.
What Google's Current Terms Actually Say
I've read through every relevant Google policy document current as of July 14, 2026. Here's what they actually say — in plain language, with links so you can verify.
Google Maps End User Additional Terms
Last modified January 27, 2026. These apply to anyone using Google Maps as an end user.
Prohibited conduct includes:
- Redistributing or selling any part of Google Maps
- Copying content except where explicitly permitted
- Mass downloading or creating bulk feeds of content
- Using Google Maps to create or augment another mapping-related dataset, business listings database, mailing list, or telemarketing list that substitutes for or is substantially similar to Google Maps
That last bullet is the one that matters most for lead generation.
If your goal is to build a prospect list from Google Maps data, Google's own terms say you can't.
Google General Terms of Service
Effective May 22, 2024, with an update scheduled for July 30, 2026. These are broader:
- Users may not abuse, harm, interfere with, or disrupt Google's services or systems
- Prohibited examples include bypassing systems or protective measures and using automated means to access content in violation of machine-readable instructions (like robots.txt)
- Users must not use services or content to violate others' legal rights, including privacy or intellectual property
Google Maps Platform Terms for API Users
The Maps Platform Terms of Service contain the strongest language. Section 3.2.3(a) is titled "No Scraping" and states:
Customers must not export, extract, or otherwise scrape Google Maps Content for use outside the services.
The examples they give include:
- Pre-fetching, indexing, storing, resharing, or rehosting Google Maps Content
- Bulk downloading tiles, Street View images, geocodes, directions, distance matrix results, roads information, places information, elevation values, and time-zone details
- Copying and saving business names, addresses, or user reviews
- Using Google Maps Content with text-to-speech services
Section 3.2.3(b) adds that customers must not cache Google Maps Content except as expressly permitted by the service-specific terms, which allow narrow, temporary caching for some fields (e.g., Places API latitude/longitude can be cached for up to 30 consecutive days, then must be deleted).
Hard to get more explicit than that. If you're using the API and storing the results in your own database, you're almost certainly violating these terms — unless your use case fits within the narrow caching permissions.
What Courts Have Said About Public Data Scraping
No Supreme Court case says "Google Maps scraping is legal." But several rulings have shaped how courts treat public-data scraping.
| Year | Case | What It Means | What It Does NOT Mean |
|---|---|---|---|
| 2021 | Van Buren v. United States | CFAA's "exceeds authorized access" requires a gate-based analysis — misusing data you're allowed to access isn't automatically a federal crime | Does not address contract claims, privacy law, or platform-specific terms |
| 2022 | hiQ Labs v. LinkedIn (Ninth Circuit, final) | Scraping public, logged-out LinkedIn profiles was unlikely to violate CFAA | Did not eliminate breach-of-contract risk; LinkedIn's later contract claims continued |
| 2024 | Meta v. Bright Data (N.D. Cal.) | Logged-out public data scraping arguments limited some platform contract claims | Facts and exact terms matter — not a blanket license for all scraping |
| 2025–2026 | Platform and AI-data disputes | Platforms continue testing ToS, copyright, and data-sourcing theories in scraping-related disputes | No universal rule emerged; data type, access method, and downstream use still drive the analysis |
The practical inference: public, logged-out, non-disruptive scraping carries lower CFAA risk in the U.S. than login-gated or bypass-heavy scraping.
But lower CFAA risk does not override Google Maps' specific contractual terms, privacy law, IP/UGC concerns, or non-U.S. regulations.
The Current Legal Landscape
A few current developments are worth tracking:
Post–Meta v. Bright Data ripple effects: The 2024 ruling that scraping logged-out public data doesn't violate the CFAA has emboldened some scraping operations, but it's also prompted platforms (including Google) to invest more heavily in technical countermeasures and to tighten contractual language. Google's Maps Additional Terms update in January 2026 added more specific examples of prohibited conduct.
Platform and AI-data disputes: Recent disputes involving platforms, automated collection, and AI data sourcing reinforce the same basic point: courts and regulators increasingly distinguish between the type of data, the method of collection, and the downstream use. Scraping public business facts for internal analysis is not the same risk profile as copying reviews, photos, logged-in data, or platform content into an AI training pipeline.
Business Data vs. Personal Data: The Distinction That Actually Matters
GDPR enforcement and privacy compliance hinge on a question most scraping guides skip: are you collecting business factual data, or personal data? Google Maps listings often contain both.
| Data Type | Examples on Google Maps | Classification | GDPR/CCPA Risk Level |
|---|---|---|---|
| Business factual data | Business name, address, phone, hours, website | Generally not personal data | ⚠️ Low (unless sole trader) |
| Business owner info | Owner name on listing, personal email | Personal data | 🔴 High |
| User-generated content | Review text, reviewer name, profile photo | Personal data | 🔴 High |
| Aggregated/derived data | Average rating, review count | Not personal data | ✅ Low |
| Photos uploaded by users | Interior photos, food photos with faces | Potentially personal data | ⚠️ Medium–High |
Here's the catch: a "business phone number" for a sole proprietor is personal data under GDPR. A restaurant's general phone line probably isn't. A dentist's direct mobile number listed on their Google Maps profile almost certainly is.
Classification depends on context, not the field name.
GDPR Compliance for Scraped Data
GDPR Article 6 requires a lawful basis for processing personal data — scraped or otherwise. "It was publicly visible" is not a lawful basis by itself. The most commonly claimed basis for B2B scraping is legitimate interest, but that requires a documented assessment showing your interest outweighs the data subject's rights. It's not a rubber stamp.
Other obligations include:
- Article 14 notice: If you collect personal data from a source other than the person themselves, you generally need to inform them within a reasonable period
- Data minimization: Only collect fields you actually need for your stated purpose
- Right to erasure / opt-out: If someone whose data you scraped requests deletion, you need a process to handle that
- Retention policy: You can't keep scraped personal data indefinitely — define and enforce a retention period
- CCPA/CPRA: California consumers have rights around personal information collected, used, shared, or sold by covered businesses, including the right to know, delete, and opt out of sale
Practical advice for B2B lead generation: stick to business factual data, avoid reviewer profiles and photos unless you have a clear lawful basis, document everything, and maintain a suppression/deletion process. Operating at scale or targeting EU/UK data subjects? Consult counsel.
Google Maps Risk by Data Type
Risk varies dramatically by data type.
| Data Type | Example | Computer-Access Risk (CFAA) | Google Terms Risk | Privacy/IP Risk | Practical Guidance |
|---|---|---|---|---|---|
| Factual business data | Business name, public address, website, general hours | Low (public, logged-out) | ⚠️ Medium — still violates Maps terms if bulk-extracted | ⚠️ Low unless sole trader | Lowest risk category, but still against Google's terms at scale |
| Contact fields | Phone numbers, emails, owner names | Low | ⚠️ Medium–High | 🔴 High if personal data | Minimize collection; verify lawful basis for personal data |
| Reviews and reviewer names | "Great pizza!" — John D., 4 stars | Low | 🔴 High — explicitly prohibited | 🔴 High (personal data + copyright) | Avoid unless you have a compelling, documented lawful basis |
| Photos and Street View | User-uploaded food photos, Street View imagery | Low | 🔴 High — explicitly prohibited | 🔴 High (copyright, potentially personal) | Do not scrape |
| Map tiles, routes, geocodes | Map imagery, driving directions, lat/lng | Low | 🔴 High — explicitly prohibited | ⚠️ Medium (database rights, copyright) | Use official APIs within their terms |
| Business Profile owner data | Owner dashboard info, private messages | 🔴 High (login-gated) | 🔴 High | 🔴 High | Never scrape — requires authentication |
Reviews, photos, map content, and bulk lead databases are materially riskier than small-scale internal checks of public factual business info.
But even the lowest-risk category — factual business data — is still against Google's Maps terms when done at scale via automated means.
Official APIs and Lower-Risk Alternatives
Several alternatives carry lower legal and operational risk than scraping Google Maps directly.
| Option | Best For | Main Limitation | Risk Profile |
|---|---|---|---|
| Google Places API | Authorized access to place data (name, address, phone, rating, reviews) | Pricing ($0.017+/call for Place Details), strict quotas, caching limits, attribution requirements | ✅ Low if used within terms |
| Business Profile APIs | Managing listings you own or are authorized to manage | Not a general lead-gen API — limited to your own listings | ✅ Low for authorized use |
| Licensed POI/data providers | Bulk business datasets for analytics, market research | Cost; may not include all fields; license terms vary | ✅ Low if license covers your use case |
| Public business websites/directories | Contact info, local lead context, industry-specific data | Slower; data may be less comprehensive | ⚠️ Low–Medium (depends on site terms) |
| Thunderbit | Extracting structured data from public webpages, directories, PDFs, event pages | Does not make prohibited Google Maps scraping compliant | ⚠️ Low when used on appropriate public sources |
Google Places API: An Honest Cost Breakdown
The Places API is Google's authorized route for place data — but it's not free, and the terms are narrower than most people expect.
| Factor | Google Places API | Web Scraping | Manual Collection |
|---|---|---|---|
| Legality | ✅ Fully compliant | ⚠️ Legal gray area (public data generally lower CFAA risk, but against Google terms) | ⚠️ ToS gray area at scale |
| Cost per 1,000 leads | ~$7–$32 (Place Details at ~$0.017/call, depending on fields) | Varies by tool | Free (but time cost is enormous) |
| Data fields available | Limited to API schema | Flexible — any visible field | Any visible field |
| Rate limits | Yes (strict quotas) | Depends on tool/method | Human speed |
| Setup complexity | Developer required (API keys, code) | Low for no-code tools | None |
| Data freshness | Real-time | Near-real-time | Snapshot |
| Caching | Temporary (30 days for some fields) | Your responsibility | N/A |
Realistic scenario: If you need 5,000 business leads in the U.S. plumbing industry with name, phone, address, and website, the Places API would cost roughly $85–$160 depending on field masks, plus developer time to build the integration. Manual collection at 2 minutes per listing would take ~167 hours. A no-code scraping tool on a public directory (not Google Maps) might take an afternoon.
For many B2B teams, the most practical path combines the Places API for a limited, high-value subset of data with public business websites and directories for broader lead lists.
A Practical Decision Framework
Here's a step-by-step framework for evaluating whether a specific Google Maps scraping workflow is advisable. It's designed to surface risks at each stage — not to end with "you're fine."
Step 1: Is the data visible without login, account access, CAPTCHA bypass, or API key?
- If no → 🔴 High risk. Stop here unless you have explicit authorization.
- If yes → Continue.
Step 2: Is the data Google Maps Content (map tiles, geocodes, routes, places data), user-generated content (reviews, photos), or personal data?
- If Google Maps Content → ⚠️ Google's terms prohibit extraction regardless of public visibility.
- If UGC → 🔴 High risk (copyright + privacy).
- If personal data → 🔴 Requires lawful basis under GDPR/CCPA.
- If purely factual business data → ⚠️ Still against Google terms at scale, but lower privacy/IP risk.
Step 3: Are you creating a bulk business listings database, mailing list, telemarketing list, substitute map/directory, or AI training dataset?
- If yes to any → 🔴 Directly prohibited by Google Maps Additional Terms. High enforcement risk.
- If no → Continue.
Step 4: Are you respecting robots.txt, rate limits, and avoiding bypass of protective measures (CAPTCHAs, bot detection)?
- If bypassing → 🔴 Violates Google's general Terms and increases CFAA risk.
- If respecting → ⚠️ Still against Maps-specific terms for automated extraction.
Step 5: Is an official API or licensed data source available for the same job?
- If yes → Strongly prefer it. The cost is your insurance policy.
- If no → Document why no authorized alternative exists.
Step 6: Do you have a privacy basis, retention policy, and opt-out/deletion workflow?
- If no → 🔴 You're exposed on the privacy front regardless of other factors.
- If yes → You've reduced (not eliminated) privacy risk.
Risk Matrix by Scenario
| Scenario | Legal Risk (CFAA) | ToS Risk | Privacy Risk | Practical Risk (IP ban, etc.) |
|---|---|---|---|---|
| Scraping public business listings, small volume, US-based | ✅ Low | ⚠️ Medium | ⚠️ Low (unless personal data) | ✅ Low |
| Scraping public business data at scale, respecting rate limits | ✅ Low | ⚠️ Medium–High | ⚠️ Medium | ⚠️ Medium |
| Scraping user reviews with personal info, EU target | ✅ Low (CFAA) | 🔴 High | 🔴 High (GDPR) | ⚠️ Medium |
| Bypassing CAPTCHAs or login walls | ⚠️ Medium–High | 🔴 High | Varies | 🔴 High |
| Building a mailing/telemarketing list from Maps data | ✅ Low (CFAA) | 🔴 High | 🔴 High | ⚠️ Medium |
| Using Google Maps API within terms | ✅ None | ✅ None | ✅ Low (if data minimized) | ✅ None |
| Scraping a public business directory (non-Google) | ✅ Low | Depends on site | ⚠️ Low–Medium | ✅ Low–Medium |
What to Actually Do If Google Sends a Cease-and-Desist
This question comes up constantly in forums, and almost nobody addresses it directly.
A cease-and-desist is not a lawsuit. It's a demand letter — typically from Google's legal team or an outside law firm — asking you to stop specific conduct. It may reference Terms of Service violations, copyright infringement, or other claims. It is serious, but it is not a court order.
Immediate steps if you receive one:
- Stop the scraping activity described in the letter. Continuing after notice dramatically increases your legal exposure.
- Preserve all records — do NOT delete evidence. This includes logs, scraped data, communications, and code. Deleting evidence after receiving a legal notice can create separate legal problems (spoliation).
- Read the letter carefully. Is it a ToS violation notice from Google's platform team, or a legal threat from Google's lawyers? These are very different in severity and implications.
- Consult a lawyer. I know that's the boring answer, but a cease-and-desist is the point where generic internet advice stops being useful and professional legal counsel starts being necessary.
Response options:
- Comply: Stop the activity, confirm compliance in writing. This is the most common and usually the lower-risk response for small/medium operations.
- Negotiate: If you believe your use is defensible or you need a transition period, a lawyer can help you respond constructively.
- Contest: Rarely advisable unless you have strong legal grounds and the resources to back them up.
Practical reality check: Google overwhelmingly uses technical measures — IP bans, CAPTCHAs, rate limiting, account suspension — before legal action. Cease-and-desist letters are rare for small or medium scrapers collecting business data for internal use. Google has historically focused legal action on competitors building substitute services, large-scale commercial resellers, and operations that cause measurable harm to Google's products.
That doesn't mean you're immune. It means the probability is low, not zero.
Safer Boundaries for Teams That Need Local Business Data
Most sales, marketing, and real estate teams need local business data. These boundaries reduce risk without eliminating your ability to operate.
- Prefer official APIs or licensed datasets when you need Google-derived data at scale. The cost is real, but so is the risk reduction.
- If collecting public business data, keep it small, necessary, and tied to a legitimate business purpose. "We need plumber contact info in three zip codes for a direct mail campaign" is more defensible than "we want every business listing in the state."
- Avoid copying Google reviews, photos, map tiles, route/geocode datasets, or owner/account data. These are the highest-risk categories under both Google's terms and IP/privacy law.
- Do not scrape while logged into a Google account unless the workflow is explicitly authorized by Google's terms for that account type.
- Do not build a Google Maps substitute or bulk telemarketing database from Google Maps Content. This is the use case Google's terms most explicitly prohibit.
- Record source, purpose, retention period, and privacy basis for all collected data. If you can't explain why you have a piece of data, you probably shouldn't have it.
- Use tools like Thunderbit on lower-risk public sources — business websites, event pages, association directories, ecommerce listings, public PDFs — when those sources fit the task. Thunderbit's AI Suggest Fields feature recommends only the columns that match the page structure, which naturally encourages data minimization. Its Chrome extension can extract structured data from these sources in a couple of clicks, and you can export directly to Excel, Google Sheets, Airtable, or Notion.
To be clear: Thunderbit does not make an otherwise prohibited Google Maps scraping workflow compliant. No tool does.
But if your real goal is local business leads, the data often exists on the businesses' own websites, industry directories, chamber of commerce pages, or public filings — sources with fewer restrictions than Google Maps. Thunderbit is built for exactly that kind of web scraping without coding.
For teams that want a deeper dive into lead generation workflows, our posts on AI lead generation and what is web scraping cover the broader landscape.
Key Takeaways
- Google Maps scraping is not a clean "yes" or "no." The answer depends on what you scrape, how, where you are, and what you do with the data.
- U.S. public-data scraping precedent (Van Buren, hiQ, Meta v. Bright Data) lowers CFAA risk for public logged-out data, but Google Maps' contractual terms remain very restrictive — more so than most websites.
- The riskiest workflows involve bulk export, Google Maps Content reuse outside the services, reviews/photos, personal data, login/API misuse, substitute directories, telemarketing lists, or AI training datasets.
- Business data vs. personal data is the distinction that matters most for privacy compliance. Sole-proprietor details, reviewer names, and user photos are personal data even if publicly visible.
- Lower-risk workflows use official APIs (Places API within its terms), licensed POI data, or non-Google public sources with privacy minimization and retention controls.
- If you need local business leads, tools like Thunderbit can help you extract structured data from public business websites and directories — sources with fewer restrictions than Google Maps itself.
- The legal landscape is still evolving. Courts continue to refine the boundaries of ToS enforcement, public-data access, privacy obligations, and automated collection for AI-related use cases.
FAQs
1. Is scraping Google Maps business names and addresses illegal?
Under current U.S. law, scraping publicly visible data is unlikely to be a federal crime (CFAA) based on Van Buren and hiQ precedent. However, it violates Google Maps' Terms of Service, which explicitly prohibit bulk extraction of business names and addresses. A ToS violation isn't a criminal offense, but it can lead to account suspension, IP bans, and potentially a civil lawsuit from Google for breach of contract.
2. Can I scrape Google Maps reviews?
This is one of the highest-risk categories. Google's Maps Platform Terms explicitly prohibit copying and saving user reviews. Reviews also involve personal data (reviewer names, profile information) subject to GDPR/CCPA, and the review text itself is copyrighted by the reviewer. Unless you have a very specific, documented lawful basis and are prepared to handle privacy obligations, avoid scraping reviews.
3. Is using Google Places API safer than scraping?
Yes, significantly. The Places API is Google's authorized route for accessing place data, and using it within its terms eliminates ToS violation risk. The trade-offs are cost (~$0.017+ per Place Details call), strict quotas, limited caching (30 days for some fields), and attribution requirements. For most business use cases, the API cost is much cheaper than the legal risk of unauthorized scraping.
4. Can I use Google Maps data for lead generation or telemarketing?
Google Maps Additional Terms specifically prohibit using Google Maps to create or augment mailing lists or telemarketing lists. Even if you obtain the data through the Places API, the terms restrict downstream use. For lead generation, lower-risk alternatives include scraping businesses' own public websites, using industry directories, or purchasing data from licensed providers. Tools like Thunderbit can help extract structured data from these non-Google sources.
5. Does using Thunderbit make Google Maps scraping compliant?
No. No tool makes prohibited Google Maps scraping compliant — compliance depends on the data source, the data type, and your use case, not the tool you use. Thunderbit is designed for extracting structured data from public webpages, business websites, directories, PDFs, and other appropriate sources. If you use it on a source where automated collection is permitted (or at least not explicitly prohibited), it reduces your operational burden. But it doesn't override Google's terms or privacy law.
Learn More
