"Is scraping Google Maps legal?" is four questions in a trench coat: computer-misuse law, contract, data protection, and copyright. They have different answers, different jurisdictions and different worst cases. Collapsing them into one yes or no is why so much of the advice online is confidently wrong.
Four questions wearing one coat
Before any of the detail, separate them, because a "yes" on one is not a defence on another:
- Did accessing the pages break a computer-misuse statute? In the US that is the Computer Fraud and Abuse Act. This is the question about criminal and quasi-criminal exposure.
- Did it breach a contract you are bound by? Terms of service. This is a private claim, not a crime, and it is the one that actually landed.
- Does the data contain information about identifiable people, and did you meet your duties to them? GDPR, UK GDPR, and their equivalents. Wholly independent of the first two.
- Did you copy something someone owns? Copyright, and in the EU the separate database right.
Nothing below is legal advice, and none of it is a substitute for counsel who knows your jurisdiction and your facts. What it is: an accurate reading of the primary sources, with links so you can check every claim yourself.
Computer-misuse law: what hiQ and Van Buren actually held
Two US decisions are cited constantly and summarised badly.
Van Buren v. United States (Supreme Court, 2021) rejected the broad reading of the CFAA under which violating a use policy turned authorised access into a federal crime. The Court adopted a "gates-up-or-down" approach: liability attaches to accessing areas of a system you are not entitled to enter at all, not to misusing information you were entitled to reach.
hiQ Labs v. LinkedIn (Ninth Circuit, 2022) applied that logic to scraping: data on a public profile, viewable without logging in, is not accessed "without authorization" under the CFAA. For a public Google Maps listing — no account, no paywall, no login — that reasoning is directly on point.
Here is the part almost every summary omits. hiQ won the CFAA argument and then lost the case. In November 2022 the district court granted LinkedIn summary judgment on breach of contract, and the six-year fight ended in a consent judgment and permanent injunction. The precedent people cite as "scraping is legal" is, read to the end, a precedent that scraping public data is not a computer crime and can still cost you the litigation on contract grounds. That distinction is the whole ballgame.
Contract: Google's terms point at a file, so we read the file
The second question is whether you are bound by terms, and whether they forbid this. Here the usual claim — "Google's terms flatly ban all automated access" — is not what the terms say.
The Google Terms of Service, under "Don't abuse our services", prohibit using automated means to access content from any of our services in violation of the machine-readable instructions on our web pages, and give the example of robots.txt files that disallow crawling. The prohibition is defined by reference to a file. So the interesting question is what that file says about the paths where business listings live.
We fetched https://www.google.com/robots.txt and read the Maps section. It disallows the directory broadly and then carves out specific paths:
Disallow: /maps/
Allow: /maps/$
Allow: /maps/@
Allow: /maps/search/
Allow: /maps/place/
Allow: /maps/dir/
...
Disallow: /maps?
Allow: /maps?q=
Allow: /maps?hl=/maps/search/ and /maps/place/ are the two paths that carry, respectively, a result list and an individual business listing — and both are explicitly Allowed. Under the standard order-of-precedence rules for robots.txt, a more specific Allow beats a broader Disallow.
Be careful about what that does and does not establish. It does not grant permission for anything; robots.txt is not a licence, and Google's separate service-specific terms for the paid Maps Platform impose their own caching limits and restrictions independently. What it does is narrow the contract argument considerably: the ToS clause everyone quotes is expressly keyed to machine-readable instructions, and on those two paths the machine-readable instruction is Allow. Anyone telling you the terms categorically forbid reading a public place page is not quoting the terms.
Two practical consequences. Do not accept terms you do not need to accept — signing in creates a contractual relationship that logged-off access does not. And treat robots.txt as an input to your crawler, not an afterthought; if you want to see how any site's directives resolve for a given URL and user agent, the robots.txt tester shows the deciding rule.
Data protection: the question that ignores whether the data was public
This is the exposure that grows while everyone argues about the CFAA, and the one that does not care at all that the data was freely visible.
A business listing is often not personal data — the address and switchboard number of a limited company are the company's. But a listing for a sole practitioner, a name in an owner field, a named mailbox found on the linked website: those are personal data, and then EU and UK rules attach in full.
You acquire a notification duty on collection. GDPR Article 14 governs personal data not obtained from the data subject. You must tell the person your identity, the purposes and legal basis, the categories of data, the retention period, their rights — and, specifically, the source the data came from, including whether it was a publicly accessible source. Timing: a reasonable period and at the latest one month; or, if you intend to contact them, at the latest at the first communication. Whichever is sooner. There is a carve-out where notification would involve disproportionate effort, but it is not a free pass for "we built a marketing list".
Public does not mean fair game. The UK regulator states plainly that if you want to use publicly available personal data to market to an individual, even in a business context, you must comply with UK GDPR — and that you must consider whether the marketing would be unexpected to the person. Its guidance also warns against tracing someone's new contact details when the old ones stop working, because doing so takes away their control.
The outreach rules are a separate layer again. Under UK PECR, the consent requirement for marketing email does not apply to corporate subscribers — limited companies, LLPs, Scottish partnerships — but sole traders and ordinary partnerships are individual subscribers and need consent or the soft opt-in. Marketing calls are covered for both, and must be screened against the TPS and CTPS. A Maps list of local trades mixes all of these in one CSV, which is why the ICO's advice when you cannot tell is to treat the contact as an individual.
Copyright and database rights: facts, compilations, and a transatlantic split
Can Google own the fact that a dental practice sits at a given address? In the US, essentially no. Feist Publications v. Rural Telephone Service (Supreme Court, 1991) held that a white-pages directory lacked the originality copyright requires — facts are not copyrightable, and alphabetising them is not creative selection. That case was literally about business listings.
The EU answer differs. Alongside copyright, the Database Directive created a sui generis database right protecting substantial investment in obtaining, verifying or presenting a database's contents, infringed by extracting or re-utilising a substantial part. It protects the compilation rather than the individual facts, and it has no US equivalent. The practical reading: taking the specific facts you need about specific businesses sits differently from replicating a substantial portion of the database as a database. Photographs, review text and other creative content on a listing are separately protected in both regimes, and should not be copied at all.
The risk ladder
Roughly, from lower to higher exposure:
| What you do | Where the risk sits |
|---|---|
| Read public listings logged off, at a polite rate, honouring robots.txt | Lowest. CFAA argument weak after hiQ; contract argument weakened by the Allow rules |
| Take company-level facts: name, address, phone, category, domain | Low. Facts, not creative expression; often not personal data |
| Sign in, or continue after a cease-and-desist | Rises sharply. This is the hiQ contract loss, and revocation changes the CFAA analysis too |
| Copy review text, photographs, or a substantial share of the database | Copyright, and the EU database right |
| Build a marketing list of identifiable people with no Article 14 notice | Highest ongoing exposure, and the one regulators actually act on |
What this means for a lead list
Assemble the whole picture and a workable posture falls out. Stay logged off. Honour robots.txt and keep a log that proves you did. Take facts, not creative content. Keep the source URL and timestamp for every field, because Article 14 requires you to disclose the source and you cannot disclose what you did not record. Put the privacy notice in the first message rather than burying it. Prefer the phone for sole traders and partnerships. And when the answer genuinely turns on your facts, ask a lawyer instead of a blog.
For the mechanics of building the list itself, see how to scrape leads from Google Maps; for the wider US position on public-web collection, is web scraping legal in the US; and for the outreach-side rules, is lead generation legal. If you would rather not maintain the fetching layer at all, the Google Maps collector returns places with provenance on every row.
Sources & further reading
- Van Buren v. United States, 593 U.S. ___ (2021) — Supreme Court opinion
- hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783 (9th Cir. 2022)
- Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991)
- Google Terms of Service — "Don’t abuse our services"
- Google robots.txt — the machine-readable instructions the terms refer to
- Google Maps Platform Service Specific Terms
- GDPR Article 14 — personal data not obtained from the data subject
- ICO — Business-to-business marketing under PECR
- Directive 96/9/EC on the legal protection of databases (sui generis right)