Is scraping Google Maps legal? An honest answer

Scraping Google Maps breaks Google's terms of service, which prohibit scraping Maps content and using it to build business listings databases or mailing lists. In the US, breaking a website's terms is usually a contract issue, not a crime: courts have held that scraping public pages generally doesn't violate the federal anti-hacking law (the CFAA), but scrapers have lost on breach of contract. The newest test went the scraper's way: on July 20, 2026, a federal judge dismissed Google's DMCA claims against SerpApi over scraping Google Search, and Google is now pursuing a narrower amended complaint. On top of the contract question, privacy laws apply when the data identifies people, and anti-spam laws apply when you send email.

Last reviewed November 3, 2026. This article explains each layer with sources. It is not legal advice, and if your business depends on it, talk to a lawyer.

Where does the law stand in November 2026?#

Five points summarize it, each covered below with sources:

1. Google's terms still prohibit it. Both the Maps end-user terms and the Maps Platform (API) terms bar scraping and building lead lists from Maps content.
2. Access to public pages is generally not a federal crime. Van Buren (2021) and hiQ v. LinkedIn (2022) narrowed the CFAA.
3. Contracts are enforceable. hiQ won on the CFAA and still lost on breach of LinkedIn's terms, ending with a $500,000 judgment.
4. Google's DMCA theory against scrapers has so far failed. In Google v. SerpApi, the court dismissed both DMCA claims on July 20, 2026. Google refiled a narrower version on August 10, 2026, and SerpApi moved to dismiss again. We found no ruling on that motion as of November 3, 2026.
5. What you do with the data is regulated separately: GDPR and UK GDPR for personal data, CCPA for California residents, and CAN-SPAM, CASL and PECR for the emails you send.

What do Google's terms actually say?#

There are two sets of terms, depending on how you touch Google Maps, and both restrict scraping.

If you use Google Maps itself (the website or app), the Google Maps End User Additional Terms of Service apply, last modified January 27, 2026. Under "Prohibited Conduct", you may not:

"redistribute or sell any part of Google Maps or create a new product or service based on Google Maps; copy the content (unless you are otherwise permitted to do so by the Using Google Maps, Google Earth, and Street View permissions page or applicable intellectual property law, including "fair use"); mass download or create bulk feeds of the content (or let anyone else do so); use Google Maps to create or augment any other mapping-related dataset (including a mapping or navigation dataset, business listings database, mailing list, or telemarketing list) for use in a service that is a substitute for, or a substantially similar service to, Google Maps"

If you use the Google Maps Platform APIs (such as the Places API), the Google Maps Platform Terms of Service apply. Section 3.2.3(a), "No Scraping", says:

"Customer will not export, extract, or otherwise scrape Google Maps Content for use outside the Services. For example, Customer will not: (i) pre-fetch, index, store, reshare, or rehost Google Maps Content outside the services; (ii) bulk download ... places information ...; (iii) copy and save business names, addresses, or user reviews"

Section 3.2.3(b) adds "No Caching", except as the service-specific terms allow: place IDs may be cached, and Places API latitude and longitude for up to 30 consecutive days.

So the plain answer to "does Google allow it?" is no. The API terms also mean the official Places API isn't a way around the problem for lead lists. Any tool or article that suggests Google permits scraping Maps for lead lists is wrong.

Is breaking Google's terms the same as breaking the law?#

No. Terms of service are a contract between you and Google. Breaking a contract can get you blocked, get accounts terminated, and get you sued for damages or an injunction. It is not, by itself, a crime. Whether you're bound at all depends on whether you agreed to the terms (for example by using a logged-in account or signing up for the API) and how a court reads them.

The law that matters splits into three questions:

1. Access: did you break into anything? (In the US, the CFAA.)
2. The data: is it protected by copyright, or is it personal data? (Copyright law; GDPR, UK GDPR, CCPA.)
3. The use: how do you contact people? (CAN-SPAM, CASL, PECR and national rules.)

What have US courts said about scraping public data?#

Courts have mostly held that scraping public pages isn't "hacking", while confirming that website terms can be enforced as contracts. Four cases set the picture.

hiQ Labs v. LinkedIn: a CFAA win, then a contract loss#

hiQ scraped public LinkedIn profiles. LinkedIn sent a cease-and-desist letter in 2017 and hiQ sued to keep scraping.

• 2019: the Ninth Circuit upheld a preliminary injunction for hiQ, finding hiQ had raised serious questions about whether the CFAA applies to public profiles.
• June 2021: the Supreme Court vacated that decision and sent it back for reconsideration in light of Van Buren (below).
• April 18, 2022: the Ninth Circuit reaffirmed its view, holding that Van Buren reinforced that the CFAA's "without authorization" concept likely doesn't apply to data a website makes publicly available (Proskauer).
• November 2022: the district court granted LinkedIn summary judgment on breach of contract, holding that hiQ violated LinkedIn's User Agreement through automated scraping and by using fake profiles (ZwillGen).
• December 2022: the case ended with a consent judgment: $500,000 against hiQ, a permanent injunction to stop scraping LinkedIn, and deletion of the scraped data and the code and algorithms built from it (Proskauer).

So hiQ is often cited as "scraping public data is legal". That's half the story. The CFAA argument went hiQ's way, and the contract argument ended the company's scraping.

Van Buren v. United States (2021)#

The Supreme Court read the CFAA's "exceeds authorized access" narrowly: it covers getting into parts of a system you aren't allowed into, not misusing information you were entitled to access (Supreme Court opinion). That's why courts since have been reluctant to treat scraping of public pages as a federal crime.

Meta v. Bright Data (2024)#

In January 2024, a federal judge in California granted Bright Data summary judgment against Meta, holding that Facebook's and Instagram's terms covered logged-in use, so Bright Data's logged-off scraping of public data didn't breach them (Farella Braun + Martel). Meta later dropped its remaining claims (MediaPost). The lesson cuts both ways: being logged in, and agreeing to terms, is what makes them bite.

Google v. SerpApi (2025 to now)#

This is the case to watch, because it's Google itself suing a scraper.

• December 19, 2025: Google sued SerpApi in the Northern District of California (No. 25-cv-10826-YGR). Instead of breach of contract, it used the DMCA's anti-circumvention provisions (17 U.S.C. § 1201), arguing that SerpApi got around SearchGuard, Google's anti-bot system.
• July 20, 2026: Chief Judge Yvonne Gonzalez Rogers granted SerpApi's motion to dismiss. For search results that contain no copyrighted content, both claims were dismissed without leave to amend: an anti-bot system can't "effectively control access" to a copyrighted work when no copyrighted work is involved. For licensed content shown in Knowledge Panels (such as images), the claims were dismissed with leave to amend, because Google hadn't pleaded that the copyright owners authorized SearchGuard. The court did reject some of SerpApi's arguments, including that Google lacked standing (PPC Land; Search Engine Land).
• August 10, 2026: Google filed an amended complaint limited to licensed content. According to PPC Land, it dropped the theories based on Google Shopping and Google Maps content (PPC Land).
• August 24, 2026: SerpApi moved to dismiss the amended complaint with prejudice (SerpApi, a party's own account). We found no ruling on that motion as of November 3, 2026.

What it means for Maps: the case is about Search, it isn't over, and a DMCA loss doesn't touch Google's contract terms. But it's the clearest sign so far that Google is willing to sue scrapers, and that a copyright-style theory is hard to apply to plain facts like business names and addresses.

What about copyright?#

Facts aren't protected by copyright in the US. In Feist v. Rural (1991), the Supreme Court held that the names, towns and phone numbers in a phone directory were facts, free to copy (Justia). A business's name, address and phone number are facts. Review text and photos are different: they're creative content owned by their authors, so stay away from copying them.

What's the risk for each kind of data?#

It depends far more on the data and what you do with it than on the fact of scraping. Here's our general read of the main layers for each type, as a starting point for a conversation with your lawyer, not a verdict:

Two patterns stand out. First, the more a field identifies a person, the more law applies to it. Second, the use matters as much as the source: a list of plumbers' business phone numbers is low-risk data, and texting those numbers without consent can still break the law.

What about personal data?#

Business facts aren't personal data, but a lot of what lead lists contain is. A sole trader's name, a personal mobile number and jane.smith@smithdental.com all identify a person. Privacy laws apply to those.

EU GDPR and UK GDPR#

If you process personal data of people in the EU or UK, GDPR (and its UK version) applies, wherever you're based.

• Lawful basis. For B2B prospecting it's usually legitimate interests, under Article 6(1)(f). Recital 47 says processing "for direct marketing purposes may be regarded as carried out for a legitimate interest", but you have to do and document a balancing test.
• Tell people. When you didn't get the data from the person, Article 14 requires telling them who you are, what you hold and where it came from, at the latest when you first contact them.
• Honor objections. Under Article 21, people can object to direct marketing at any time, and then you must stop.

Generic company addresses (info@ at a limited company) are generally not personal data. But the email marketing rules below still apply to them.

US privacy law (CCPA)#

The California Consumer Privacy Act applies to businesses that meet its thresholds (an inflation-adjusted revenue threshold, or large volumes of California residents' data). Its exemption for business-to-business contact data expired on January 1, 2023, so B2B contact details of California residents are now covered (Katten). If the CCPA applies to you, that means privacy notices and honoring requests to delete or opt out. Other US states have similar laws with their own thresholds.

What rules apply when I email the businesses?#

Anti-spam law applies whatever the source of the list. Our cold email laws guide goes country by country; here's the summary.

Note the CASL detail: the Canadian regulator has said that an address being findable online isn't enough. It has to be conspicuously published by the person, and a list built by a third party doesn't create consent on its own (Bennett Jones).

What happens if Google sends a cease-and-desist or blocks you?#

Usually the first thing you'll see is a block, not a letter: CAPTCHAs, throttling, or an IP address that stops getting results. If you use the API, the Platform terms let Google suspend your use of the services. A cease-and-desist letter is a formal demand to stop, and it matters legally: in hiQ v. LinkedIn, the dispute started with one.

If you get a letter:

1. Don't ignore it, and don't reply in a hurry. Send it to a lawyer before you answer.
2. Stop the activity it names while you get advice. Continuing after a clear demand makes your position worse in most disputes.
3. Preserve your records. Don't delete data or logs once a dispute is likely; deletion can be treated as destroying evidence. Your lawyer will tell you what to keep and what you may later be asked to delete.
4. Check your vendors' terms. If a tool collected the data for you, see what its terms say about who is responsible.

So what should I actually do?#

Separate the three questions, and reduce risk on each. A practical list:

Do:

• Read the terms of every tool you use, and Google's terms, and decide with your lawyer what risk you accept.
• Contact businesses about things relevant to their business. Relevance is part of CASL's test and of any GDPR balancing test.
• Prefer generic business addresses and the business's own published contact details.
• Put a working opt-out and your postal address in every email, and honor opt-outs fast.
• Keep a suppression list and apply it to every list you build, from every source.
• Delete data you don't need, and refresh lists instead of keeping old ones forever.
• In the EU and UK, document your legitimate-interest assessment and tell people where you got their data.

Don't:

• Copy review text or photos.
• Buy or build lists of consumers' personal emails.
• Email EU sole traders, or Canadian contacts, as if CAN-SPAM rules applied.
• Hide who you are, use deceptive subject lines, or keep emailing people who said no.
• Assume "public" means "free to use however you like". It doesn't, under GDPR or CASL.

How does Leadraft approach this?#

We don't claim any of this makes outreach risk-free, and we don't claim compliance on your behalf. What we do:

• An opt-out page where any business can ask to be removed from our data.
• A suppression (do-not-contact) list in every account, applied automatically to every export, so a business that opted out of your emails doesn't come back in the next list.
• An acceptable use policy that bars spam, ignoring opt-outs and breaking laws such as CAN-SPAM, GDPR, PECR and CASL.
• Emails from each business's own website, with the page they came from, so you can see the source and tell recipients where you got their address.

You're still responsible for how you contact people. If you're running campaigns across countries, our cold email checklist for agencies covers the sending side, and a lawyer should cover the rest.

FAQ#

What happened in Google v. SerpApi?#

Google sued SerpApi in December 2025 under the DMCA's anti-circumvention rules over scraping Google Search results. On July 20, 2026, Chief Judge Yvonne Gonzalez Rogers of the Northern District of California dismissed both DMCA claims: for good where the results contain no copyrighted content, and with leave to amend for licensed content such as Knowledge Panel images. Google filed a narrower amended complaint on August 10, 2026, and SerpApi moved to dismiss it again. The case concerns Search, not Maps.

Is it illegal to scrape Google Maps?#

Scraping Google Maps breaks Google's terms of service, which prohibit scraping and using Maps to build business listings databases or mailing lists. In the US, breaking a website's terms is usually a contract matter, not a crime, and courts have held that scraping public pages generally doesn't violate the CFAA. But Google can block you, terminate accounts and sue, and privacy and anti-spam laws apply to what you do with the data. This is not legal advice.

Is it legal to use Google Maps data for lead generation?#

Google's end-user terms bar using Google Maps to create or augment a business listings database, mailing list or telemarketing list for a service that substitutes for Google Maps, and the Maps Platform terms bar saving business names and addresses from the API. Separately, when you contact businesses you must follow laws like CAN-SPAM in the US, CASL in Canada and PECR and UK GDPR in the UK.

Did hiQ win against LinkedIn?#

Partly. The Ninth Circuit twice held that scraping public LinkedIn profiles likely did not violate the CFAA. But in November 2022 the district court ruled that hiQ breached LinkedIn's User Agreement, and the case ended in December 2022 with a $500,000 judgment against hiQ and a permanent injunction requiring it to stop scraping and delete the data.

Is using the Google Places API legal for lead lists?#

Using the API is permitted, but its terms bar exporting or scraping Google Maps content, copying and saving business names and addresses, and caching most data. Place IDs may be stored, and coordinates for up to 30 days. So the API is not a terms-compliant way to build a lead list you keep.

Does GDPR apply to business emails scraped from websites?#

Yes, when the address identifies a person, like jane.smith@ or a sole trader's email. You need a lawful basis such as legitimate interests, must tell people where you got their data, and must honor objections to direct marketing. Generic addresses like info@ for a company are generally not personal data, but national email marketing rules still apply.

Is cold email to businesses legal in the US?#

Yes, if it follows CAN-SPAM. The law covers business-to-business email with no exception: accurate headers and subject lines, a valid physical postal address, a clear way to opt out, and opt-outs honored within 10 business days. Each violating email can cost up to $53,088.

Sources#

1. Google, Google Maps End User Additional Terms of Service, last modified January 27, 2026.
2. Google, Google Maps Platform Terms of Service §3.2.3, seen October 31, 2026.
3. Google, Google Maps Platform Service Specific Terms (Google ID caching; Places API §14.3), seen October 31, 2026.
4. Proskauer, Ninth Circuit's new hiQ opinion after Van Buren, April 2022.
5. ZwillGen, hiQ v. LinkedIn wrapped up: web scraping lessons learned.
6. Proskauer, hiQ and LinkedIn reach proposed settlement, December 8, 2022.
7. Supreme Court of the United States, Van Buren v. United States, 593 U.S. 374 (2021).
8. Farella Braun + Martel, Meta Platforms v. Bright Data, 2024.
9. MediaPost, Meta abandons lawsuit against Bright Data over scraping, 2024.
10. PPC Land, Google loses DMCA bid against SerpApi, July 2026 (order of July 20, 2026, No. 25-cv-10826-YGR, N.D. Cal.).
11. Justia, Feist Publications v. Rural Telephone Service, 499 U.S. 340 (1991).
12. GDPR text: Article 6, Recital 47, Article 14, Article 21.
13. Katten, CCPA employee and B2B exemptions to expire January 1, 2023.
14. Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business.
15. Justice Laws Website, Canada's Anti-Spam Legislation, S.C. 2010, c. 23 (s. 10(9) implied consent; s. 11 unsubscribe; s. 20(4) penalties).
16. Bennett Jones, CRTC on conspicuous publication and implied consent, 2016.
17. Information Commissioner's Office, Business-to-business marketing.
18. Germany, Gesetz gegen den unlauteren Wettbewerb (UWG) §7.
19. Search Engine Land, Google loses key DMCA claims against SerpApi in scraping lawsuit, July 2026.
20. PPC Land, SerpApi asks judge to end Google's scraping case, August 25, 2026 (amended complaint of August 10, 2026; motion to dismiss of August 24, 2026).
21. SerpApi, Google tried again. We're moving to dismiss a second time (a party's own account).