Is scraping Google Maps legal? Law, ToS & GDPR (2026)
By Doug Nielsen, Product Manager · Updated · first published
Collecting business details that are publicly listed is generally lawful in the US and EU, but Google's Terms of Service restrict automated collection from Google Maps. What you then do with the data is regulated in its own right: in the UK and EU, GDPR covers keeping any record that identifies a person, and outreach falls under CAN-SPAM in the US, PECR in the UK, § 7 UWG in Germany, CASL in Canada and the Spam Act in Australia.
This is an overview for B2B list builders, not legal advice or a compliance guarantee: data-protection rules are read differently across EU member states and the UK, guidance changes, and your answer depends on facts a guide can't see. Where the stakes are real, ask a data-protection lawyer in your market.
Know what you'd hold first: our Google Maps data extractor page lists every exported column and where it comes from.
Key takeaways
- Don't rely on “it's B2B”: named-person emails are usually treated as personal data, and sole traders' details can be.
- The basis usually discussed for B2B marketing is legitimate interest, with a balancing test you can show.
- Email-marketing rules vary by country, and the one you email into matters most.
- You're the controller, and disputes usually start with an ignored opt-out, not the collection.
On this page7
Where GDPR bites, and where it may not
GDPR governs personal data: information relating to an identified or identifiable living person. A limited company's switchboard number and info@ address are generally further from that definition than a firstname.lastname address at its domain, which is usually treated as personal data even in a business context.
Watch out
Sole traders and partnerships
Lawful basis, in outline
For B2B marketing, the basis usually discussed is legitimate interest: you must actually balance your interest in marketing against the recipient's rights and expectations, and be able to show you did. Regulators have published guidance on documenting that assessment; done properly, it's a written exercise, not a checkbox.
Email marketing is regulated separately, by each country's implementation of the ePrivacy rules (PECR in the UK, equivalents elsewhere), and those rules vary meaningfully, so check the country you email into, not the one you're in.
Get the whole list in one job
- 100 free credits
- No card required
Practices that generally help
- Target narrowly: it's better marketing and an easier balancing test to argue.
- Identify yourself clearly, and say where the details came from: a public business listing, or a professional profile.
- Make opting out one reply or one click, and honor it immediately: disputes usually start with an ignored opt-out, not the collection.
- Keep a suppression list that survives every re-scrape: re-adding someone is the classic failure.
- Record where and when each row was collected, so you can answer specific questions.
- Keep only what serves a defined purpose; delete the rest.
- Route access, objection and erasure requests so handling doesn't depend on one person remembering.
What a scraping tool can and can't do for you
Hubertino collects publicly listed business information from Google Maps and, where a business publishes them on its own website, a contact email and social links. With the paid decision-maker add-on it also returns owners' and executives' names, job titles, LinkedIn profiles and work emails (often inferred from the company's email pattern) from public professional profiles. That is personal data: verify the emails, and say where you got the details when you first write. What you do with that afterwards (who you contact, on what basis, with what content, in which country) is your processing, and the compliance obligations sit with you as the controller.
Our privacy policy sets out how business-listing data is handled here, including how a business can ask for its details to be removed.
Rules of thumb: least vs most contentious
| Least contentious | Most contentious |
|---|---|
| Public company contact details | Named-individual addresses |
| Narrowly targeted | Broad, untargeted sending |
| Honestly identified sender | Obscured sender identity |
| An instant opt-out | Ignored objections |
Common questions
Is scraping public business data illegal in the EU?
Do I need consent to send B2B email in Europe?
Can a tool guarantee my campaign is compliant?
Written by
Doug Nielsen, Product Manager
Doug works on Hubertino; the guides on this site are published under his name. Last updated .