- Collecting public facts is often allowed, but it depends on the site's terms, the type of data and where you work.
- Personal data is the biggest risk. Privacy laws such as GDPR still apply to information that is public.
- Stay out of logins, respect site rules, collect only what you need, and never copy Google Maps content.
An agency owner wants a list of every dental clinic in three cities, with websites and opening hours. Copying it by hand would take a week. A small program could do it in an hour.
So the question comes up fast: is that allowed?
The honest answer is “often, if you do it carefully”. There is no single law called “web scraping”. Several rules overlap, and they depend on what you collect and how you use it. This is the approach we take in our web scraping and data automation service.
This guide explains general principles in plain English. It is not legal advice. Laws differ by country, and they change. For a specific project, speak to a qualified lawyer.
What is web scraping?
Web scraping means using software to collect information from web pages automatically, instead of copying it by hand.
For example, a program might visit 200 business websites and record each one’s name, category and public contact page into a spreadsheet.
The technique itself is neutral. Search engines do something similar every day. What matters is what you collect, from where, and what you do with it.
Which rules apply?
Four kinds of rules usually matter.
1. Computer access laws
In the US, a well-known court case, hiQ Labs v. LinkedIn, looked at whether scraping public profiles was “unauthorised access”. The appeals court said accessing public pages was unlikely to count. But the same dispute later went against hiQ on other grounds, including LinkedIn’s user agreement.
The lesson: public pages are lower risk, but that is not the end of the question.
2. Website terms of use
Many sites forbid automated collection in their terms. If you agreed to those terms, for example by creating an account, breaking them can be a contract problem.
That is one reason we stay out of anything behind a login.
3. Privacy laws
This is the biggest risk for most businesses. In the UK and EU, GDPR covers personal data even when it is public. A named person’s email, phone number or profile is personal data.
Privacy regulators from several countries published a joint statement on data scraping in 2023. They made clear that public personal data is still protected.
Business facts, such as a company name, category or public opening hours, are much lower risk than data about people.
4. Copyright and database rights
Copying large amounts of someone’s content, such as articles, reviews or photos, can break copyright. In the EU, databases can also have their own protection.
Collecting facts is different from copying creative work.
What is clearly off-limits?
| Usually lower risk | Usually high risk or not allowed |
|---|---|
| Public business names, categories and websites | Anything behind a login or paywall |
| Public opening hours and service areas | Google Maps content outside Google’s official tools |
| Prices a shop publishes for everyone | Personal data collected without a lawful reason |
| Collecting slowly, following robots.txt | Copying reviews, articles or photos in bulk |
Google’s Maps Platform terms deserve a special mention. They don’t allow scraping or storing Maps content outside what the official tools permit. We don’t advertise or offer it.
Step by step: collect data the careful way
- Write down the purpose. “A list of clinics to offer our service to” is a purpose. It decides what you need.
- Collect only what you need. Business name, website and category often do the job.
- Check the source’s terms and robots.txt. robots.txt is a file that tells automated tools what a site allows.
- Go slowly. Don’t overload anyone’s website.
- Avoid personal data unless you have a clear legal basis and can explain it to the person.
- Record the source and date for every row, so you can answer questions later.
- Delete what you no longer need.
Automation recipe: a compliant public-data collector
- When this happensEvery week, or when you ask for a fresh list.
- The system doesThe system checks each source against your approved list and its robots.txt rules.
- ThenIt collects only the agreed public fields, such as business name, category, website and public contact page.
- ThenClaude cleans the data, removes duplicates and flags anything that looks like personal data.
- ThenThe clean list lands in your sheet with the source and date for every row.
- You onlyApprove the list of sources and fields, and check that your use of the data is allowed where you work.
- n8n
- Apify
- Claude
- Google Sheets
Common mistakes
“It’s public, so it’s free to use.” Public doesn’t mean free of rules, especially for personal data.
Collecting everything just in case. More data means more risk, and rarely more sales.
Ignoring the source’s terms. Especially for sites where you have an account.
Using scraped emails for bulk mail. Cold email has its own rules by country. We explain the difference between a raw list and real prospects in lead list vs qualified pipeline.
A simple next step
Before your next data project, answer three questions on paper: what exactly will you collect, from which sites, and what will you do with it? If any answer feels uncomfortable to say out loud, change the plan.
Clean data is one of many jobs automation can take over, as 10 tasks a small business can automate this month shows.
Want to talk through a data project? Book a free video call.
Sources
- US Court of Appeals, Ninth Circuit: hiQ Labs v. LinkedIn (2022)
- ICO and other regulators: joint statement on data scraping and data protection (2023)
- Google Maps Platform terms of service
This guide was drafted with AI assistance, then reviewed, fact-checked and edited by MD Al Amin.
Quick questions
Is it legal to scrape Google Maps?
Google's Maps Platform terms do not allow you to scrape or store Maps content outside what the official tools permit. We don't offer it.
Can I collect email addresses from websites for cold email?
Be careful. A named person's email is personal data in the UK and EU, and cold email rules differ by country. Get advice for your market before you send.
Is this legal advice?
No. This is a general guide. For a specific project, especially one involving personal data, speak to a qualified lawyer where you work.