Is Scraping Google Maps Legal? What Google's Own Lawsuit Shows (2026)

Everyone scraping Google Maps hits the same question — usually right after reading Google's terms. Am I allowed to do this? Will I get sued? In this post, I'll walk you through:

• what Google's 2026 terms actually prohibit (quoted, dated, linked);
• what US courts keep ruling — including in Google's own lawsuit against a scraper;
• what you really risk, and how to collect Maps data cleanly.

This article is context, not legal advice. Laws vary by country and change over time. If compliance, contracts, or platform risk matter to your business, talk to a legal professional.

The short answer: yes, it's legal

Scraping publicly available data from Google Maps is legal in the United States.

Business names, addresses, phone numbers, websites, ratings: no US court has ever held that collecting this public data is a crime.

Three conditions keep you on solid ground:

1. You scrape public data — pages anyone can open in a browser, no login.
2. You scrape logged out — no Google account involved, so no contract binds you (more on this below).
3. You handle personal data properly — mostly an EU question, covered in the GDPR section.

That's the position we defend publicly. It is also, quietly, the position Google's own lawyers seem to have accepted in court this summer.

But before the courtroom, let's read what Google says on paper — because Google really does not like scraping:

What Google's terms actually say (2026 versions)

People quote "Google's ToS" as if it were one document. It's three layers, and all three were refreshed in 2026:

Billing in the European Economic Area? A separate EEA Maps Platform ToS applies since July 8, 2025 — its section 3.3.2 carries the same No Scraping clause, word for word on business names, addresses, and user reviews.

The wording is not ambiguous. Here is the Platform Terms clause in full, straight from the source:

Users have asked Google the question directly, on its own support forum:

The answer, from a Diamond Product Expert, is Google's position in plain English. No, bulk downloading is not allowed.

Read all that and you'd conclude the matter is closed. Some readers get so spooked they refuse to even discuss the official API:

Except "against Google's terms" and "against the law" are two very different things. That distinction is the whole game:

Breaking Google's rules is not breaking the law

Google's terms are a contract. A contract binds the people who accepted it — and only them. It is not legislation.

If you run a bar, you can ban purple shirts in your bar. Wearing purple remains perfectly legal everywhere else.

US courts have drawn exactly this line, twice.

First, the criminal side. In hiQ Labs v. LinkedIn (9th Cir. 2022), the court held that scraping publicly accessible pages is not "hacking" under the CFAA.

The Supreme Court's Van Buren ruling had already narrowed that law the year before. If no gate is down, you can't break in.

Second, the contract side — the nuance most blogs skip. hiQ still lost the war. It had LinkedIn accounts, so LinkedIn's terms bound it: breach of contract.

No account, no contract. In Meta v. Bright Data (2024), scraping Facebook and Instagram logged out did not breach Meta's terms at all. Meta dropped the case entirely.

This is why serious Google Maps scrapers work logged out, on public listing pages. The consumer ToS and the API terms bind account holders and API customers. A logged-out visitor is neither. Same logic as LinkedIn scraping.

So the case law protects public-data scraping, and contracts only catch the logged-in. You might still expect Google to test that in court.

It did — and it's not going well for them:

Google sued a scraper — and dropped the Maps claims

On December 19, 2025, Google sued SerpApi, a company that sells scraped Google results as an API.

The scraping community immediately noted the irony:

Now look at what Google's lawyers did NOT plead. No CFAA claim. No breach-of-contract claim.

After hiQ and Bright Data, they knew better. The complaint rested on one theory only: DMCA circumvention of SearchGuard, Google's anti-bot system.

It collapsed fast. On July 20, 2026, the judge dismissed the DMCA claims — with prejudice wherever the scraped results contained no copyrighted content. You cannot use copyright law to fence off data you don't own.

Then the detail that matters here. Google's original complaint had cited Maps imagery among the scraped content.

Its amended complaint of August 10, 2026 rebuilt the case around licensed Knowledge Panel content — and dropped the Google Maps theory entirely.

Five years of platform-versus-scraper lawsuits now point the same way:

The case isn't over — a hearing on SerpApi's second motion to dismiss is set for September 29, 2026. But the scoreboard so far: Google's strongest legal theory against a Google scraper died in court, and Maps didn't even survive to the amended complaint. We'll keep this article updated.

If even Google can't build a case against scraping its public pages, what can it actually do to you?

Two things — both survivable:

What you actually risk (and how to avoid it)

Risk one: your Google account. The consumer ToS lets Google suspend accounts caught scraping. That threat only works if there's an account to suspend.

Scrape Maps listings logged out and the equation changes: public pages, no session, nothing to terminate.

That's not a loophole. It's precisely the fact pattern that won in hiQ and Bright Data.

Risk two: technical blocking. Google throttles suspicious IPs, serves CAPTCHAs, and since January 2025 requires JavaScript to render results.

Notice what this means: Google's real enforcement is bot detection, not lawsuits. And IP blocks lift on their own — Google wants your traffic back.

The fix is boring: reasonable request rates, rotating proxies, or a managed scraper that handles all of it for you.

Scrape Google Maps leads — no account, no code

US law, handled. But if your targets are in Europe, one more layer applies — and it's about the data, not the scraping:

Scraping EU businesses? The GDPR reality check

GDPR doesn't care how you collected data. It cares that you process personal data — and Maps listings contain more of it than you'd think.

A restaurant's address is business data. But a sole trader's mobile number, a name-based email like marc@plombier-paris.fr, a reviewer's name and photo: personal data, all of it.

The good news: EU regulators accept that scraping public data can run on legitimate interest. France's CNIL published a dedicated web scraping focus sheet.

The EDPB followed with Guidelines 03/2026, the first EU-level scraping framework. The Dutch DPA is the strict outlier — worth knowing if you target the Netherlands.

In practice, four habits keep you compliant:

1. Collect only what you'll use — skip reviewer data if you're building a leads list.
2. Tell people where their data came from when you first contact them.
3. Offer a working opt-out, and honor it.
4. Delete data when the campaign ends — GDPR storage limitation means "no longer than necessary".

Cold outreach on scraped emails follows the same logic. The CNIL explicitly allows B2B prospecting if the person is informed and can opt out (details in the FAQ).

Legal on both sides of the Atlantic, then. All that's left is the part Google's terms can't reach — actually getting the data:

How to scrape Google Maps at scale, legally

To prove the point, I ran our Google Maps Leads Scraper on a classic local lead-gen search: dentists in Austin, Texas. Logged out, no Google account, no API key.

Four minutes and three seconds later: 30 dental practices, each with a phone number and a website.

15 of them came back with at least one email pulled from their site (29 addresses total), and 23 with social profiles. Each row carries up to 81 attributes.

Want emails specifically? That's a workflow of its own, and the scraper reads them off each business's website automatically.

Prefer the terminal? The same CLI we used for LinkedIn X-ray drives every lobstr.io scraper. Paste any Maps search URL (build one with our URL generator):

pip install lobstrio
lobstr go google-maps-leads-scraper \
  'https://www.google.com/maps/search/plumber/@29.7604,-95.3698,13z' \
  -p max_unique_results_per_run=50 \
  -p language="English (United States)" -o leads.csv

Six minutes later, 50 Houston plumbers with phones and websites sit in a CSV. No browser, no Google account.

And if you live in Claude or ChatGPT, plug your agent straight into the scrapers via MCP — it configures the run and fetches results on its own:

claude mcp add --transport http lobstr https://mcp.lobstr.io/mcp

Reviews work the same way — a dedicated reviews scraper pulls them at scale, the approach Geolid uses in production to monitor thousands of listings.

Scrape Google Maps reviews at scale

Still have edge cases in mind? So did our readers:

FAQ

Does scraping Google Maps violate Google's Terms of Service?

Yes — all three layers of Google's 2026 terms prohibit scraping. But terms are a contract, not a law.

They bind account holders and API customers. Scraping public pages logged out, no contract binds you — and violating a ToS is not a criminal offense either way.

Can you scrape Google Maps?

Yes. Google Maps listings are public pages — no login wall.

Technically you'll face bot detection and the JavaScript requirement. That's why most people use a managed scraper for lead generation rather than raw HTTP requests.

Can Google sue me for scraping Maps data?

Unlikely. When Google finally sued a scraper (SerpApi, December 2025), it didn't even plead CFAA or breach of contract.

Its DMCA theory was dismissed in July 2026, and the Maps claims vanished from the amended complaint. Google's real enforcement is technical: CAPTCHAs, IP throttling, account suspension.

Is it legal to scrape Google Maps reviews?

Mostly, yes. Reviews are public data, and collecting them is legal on the hiQ logic.

Two caveats. Review text is user-generated content — don't republish it wholesale. And reviewer names are personal data under GDPR: drop them if you don't need them. Here's how to do it at scale.

Is it legal to cold email addresses scraped from Google Maps?

Yes, for B2B — with conditions. Under CNIL guidance, the professional you contact must know where their address came from and get a free, simple opt-out.

Generic addresses like contact@company.com belong to the company, not a person — no conditions attached. In the US, CAN-SPAM asks for an opt-out and truthful headers.

How long can I store scraped Google Maps data?

As short as the job requires. Personal data cannot be kept indefinitely under GDPR.

A common pattern: purge non-responders one month after the last email of a sequence.

Can I get banned for scraping Google Maps?

Only what you expose. A logged-in account can be suspended; an IP can be temporarily blocked, usually for minutes.

A logged-out scraper on managed infrastructure exposes neither — your personal account and IP never touch the target.

Do I need the official Google Places API instead?

No. The Places API is the ToS-compliant route, but it caps results per search, bills per request, and returns no email addresses.

Ironically, its own terms prohibit caching and bulk export — the scraping restrictions follow you inside. Compare the options in our 2026 scraper benchmark.

Final thoughts

Scraping public Google Maps data is legal, and 2026 made the case stronger, not weaker.

Fresh terms that still only bind the logged-in. An EU framework that names conditions instead of banning the practice. And Google's own lawsuit walking away from Maps.

The honest risk model is operational, not legal — CAPTCHAs, IP blocks, JavaScript walls. Solved problem: use a scraper that eats the blocking for you, mind GDPR for European leads, and you sit in the safest corner of the whole scraping legality map.

I'll update this page after the September 29 hearing — Google's lawyers and I now check the same docket. Ping me on LinkedIn if they surprise us both.