Is scraping Google Maps legal?

The first rulebook is Google’s terms of service. A contract between you and Google about how you may use their site.

The second is data protection law. In Europe, the GDPR. It asks whether you may hold and use the rows you pull.

The third is marketing law. It asks whether you may send anything to the addresses in those rows.

Passing one rulebook says nothing about the other two. Most bad advice online mixes all three into one soup.

This page walks the first two. The sending half has its own guide: GDPR and B2B cold email.

A scope note before we start. We sell Nordic business data — Norway, Sweden, Denmark and Finland — so the law talk here leans EU and EEA. Other regions run other rules. And for global scraping needs, Outscraper is the tool page to read, not this one.

Google’s terms of service set rules on automated access to its services. Read them yourself: Google’s terms, plus the separate Maps Platform terms for the API.

A law binds everyone in a country. A contract binds the parties to it. Terms of service sit in the second bucket.

Break a law and the state can act. Break a term and the counterparty can act. Different rooms, different doors.

What can Google do about scraping? They run the servers. They can block traffic, throttle it, and close accounts. That is the concrete risk, and it lands on whoever runs the crawl.

Whether a terms breach also breaks a law differs by country and by case. We will not hand you a blanket answer, because there is not one.

Where an index vendor changes the picture

Buy from an index instead of crawling, and you never touch Google’s servers. The crawl and its risk sit with the vendor. That is our seat, and we sit in it with open eyes.

What does not transfer is the data side. The moment rows land in your hands, the second rulebook applies to you.

Anyone can read a Maps listing. Reading rights and processing rights are different rights, and the GDPR governs the second.

Much of a local business file counts as personal data. A one-person firm’s row points straight at its owner. So does an address like kari@firma.no.

To hold personal data you need a lawful basis. For B2B prospecting, the workhorse basis is legitimate interest, under Article 6(1)(f).

The regulation’s own recitals name direct marketing as an interest that can qualify. Can, not does. You weigh your interest against the person’s rights, and you write that weighing down.

The balance tilts your way when the row is a published business contact and the offer fits the trade. It tilts against you with private details, scale for its own sake, or an offer from nowhere.

Duties ride along with the basis. Name your source when you write. Stop when someone objects, with no second try. Keep a suppression list so the stop sticks.

The full walk-through — the three-part test, the first-message duties, the opt-out — lives in the GDPR guide. This page only asks you to accept one point: scraped or bought, public or not, the rows carry duties.

You scrape the map yourself

Both halves are yours. The terms risk, because your machines do the crawling. And the GDPR duties, because you hold the result.

You run a browser extension

The same picture at a smaller scale. The crawl runs in your browser, on your IP address. The file it writes is yours to answer for.

You buy from an index

The crawl risk moves to the vendor. The data duties move nowhere. In GDPR terms you control the rows you export, whoever collected them first.

So question your vendor. Ask where each row came from, and when. A vendor with no per-row answer leaves you defending a file with no papers. Our export names the source page and the date beside every email.

You resell scraped data

The heaviest seat at the table. A reseller is a data vendor, with a vendor’s duties: source records, a lawful basis, and answers when a person objects. Do not drift into this seat by accident.