Is Scraping Google Maps Legal? What the Rules Actually Say in 2026

September 10, 2026 26 min read 0 Views

Is scraping Google Maps legal? Here’s the honest short answer: it violates Google’s Terms of Service, but breaking those terms is not a crime in the United States. Courts have treated scraping public data as a contract and privacy question, not hacking. The real risks are account bans, IP blocks, civil claims, and the privacy-law duties that kick in once records identify people.

Now the disclaimer, early and plainly, because you deserve it before anything else: I’m a marketer, not a lawyer, and this article is not legal advice. What I can do is something most pages on this topic won’t. I can quote the actual documents, link the actual court opinions, and tell you what they say without trying to sell you a scraper at the end.

Because that’s the strange thing about this question. Almost every article answering it is published by a company that sells Google Maps scraping. I don’t. So let’s go through it straight.

The question	The short answer
Is scraping Google Maps against Google’s ToS?	Yes, explicitly, by name
Is it a crime in the US?	No case says so for public listings
Can Google punish you?	Yes: bans, IP blocks, civil claims
Do privacy laws apply?	Yes, once records identify people (GDPR, CCPA)
Can you use scraped data commercially?	The terms forbid it, and compliance duties stack up
Are there legal paths to the same data?	Yes: the Places API within its terms, registries, licensed databases

Let’s start where every honest answer has to start: with what Google actually wrote.

What Google’s Terms of Service Actually Say

Google’s terms prohibit scraping Google Maps directly, specifically, and by name. This isn’t folklore passed around forums, and it isn’t a vague “don’t misuse our services” clause that lawyers argue about. Here is the text, from the Google Maps Platform Terms of Service:

“No Scraping. Customer will not export, extract, or otherwise scrape Google Maps Content for use outside the Services. For example, Customer will not: … (iii) copy and save business names, addresses, or user reviews…”
Google Maps Platform Terms of Service, Section 3.2.3(a)

Read that middle part again. Copy and save business names, addresses, or user reviews. That is a word-for-word description of what every Google Maps scraper on the market does. Their product pages could double as confessions.

And it’s not just the developer platform terms. Google’s general Terms of Service also restrict automated access to its services without permission. So whether someone scrapes through the consumer Maps site or abuses the developer tooling, they land on the wrong side of an agreement Google wrote very deliberately.

So the ToS question is settled, and anyone who tells you it’s ambiguous is selling something. But before we get to the law, it’s worth pinning down what “scraping” even covers, because half the worried questions I get aren’t about scraping at all.

What Counts as Scraping Google Maps (and What Doesn’t)

Scraping means automated bulk extraction: software that visits listings and copies data out at scale. That definition matters, because people lump very different activities under one scary word. Let’s separate them:

Looking businesses up manually: not scraping. Searching Maps, reading a listing, and writing down a phone number is just using the product as intended
Copying a few listings into a spreadsheet by hand: tedious, human-speed research; nobody’s enforcement systems care
Browser extensions and “exporters”: scraping with a friendlier interface; the automation is the point, and the terms don’t carve out tools that look polite
Cloud scrapers and scripts: the classic case, and exactly what Section 3.2.3(a) describes
The Places API: not scraping at all; it’s Google selling you structured access under its own rules, with its own restrictions on caching and bulk export

One more actor in this picture deserves a mention: the businesses themselves. Every listing you see started life as a Google Business Profile, created or claimed by an owner who wanted to be found. That’s why “the data is public” feels intuitively true; owners DO publish it to be seen. The legal wrinkle is that publishing information on Google’s platform doesn’t hand third parties a license to bulk-extract it from Google’s servers. The owner shared it; the platform’s terms govern the copying.

So when someone asks me whether their workflow “counts”, my test is simple. Is software doing the visiting and copying? Then it’s web scraping, and the terms apply. Is a human reading pages? Then it’s research. The law cares about gates and contracts; Google’s enforcement systems care about request patterns. Both notice automation, neither notices diligence.

With the definition settled, here’s where the conversation usually goes wrong. People hear “against the terms” and translate it to “illegal”. Those are two different rulebooks, and the difference between them is the entire answer.

Terms of Service vs the Law: The Distinction That Answers Everything

A Terms of Service is a contract between you and a company; a law is a rule the state enforces on everyone. Mixing those up causes most of the confusion around whether scraping Google Maps is legal, so let’s take it slowly.

Think of it like a gym. The gym’s rules can say “no street shoes on the court”. If you wear street shoes anyway, the gym can warn you, ban you, even sue you if you signed something and caused damage. But the police won’t come, because street shoes aren’t against the law. The gym makes rules for its property; the city makes laws for everyone.

Google’s terms work the same way. When Google says “no scraping”, that’s Google setting rules for using Google’s services. Violating them exposes you to what contract violations expose you to: termination of your accounts, blocking, and potentially a civil lawsuit for breach of contract. What it does not do, by itself, is make you a criminal.

📌 Plain English: A ToS is a contract with one company. A law applies to everyone. "Against Google's terms" and "illegal" are different claims, and most of the confusion about Maps scraping comes from treating them as the same thing.

Everything else in this article hangs off that distinction. The terms answer what Google can do to you. The law answers what courts and regulators can do to you. And on the law side, the last decade produced two cases you actually need to know.

That’s the contract side. The courts are next.

The Case Law: hiQ v. LinkedIn, Van Buren, and How Both Ended

Two cases define where US law stands on scraping public data: hiQ Labs v. LinkedIn and Van Buren v. United States. Neither is about Google Maps specifically, but together they draw the map everyone scrapes by, so to speak.

Start with hiQ. hiQ Labs was a small analytics company that scraped public LinkedIn profiles. LinkedIn sent a cease-and-desist letter and argued the scraping violated the Computer Fraud and Abuse Act, the federal anti-hacking statute from 1986. The fight ran for six years, and in 2022 the Ninth Circuit Court of Appeals held that scraping publicly available pages does not violate that statute. The court went further and said something remarkable about why:

“We agree with the district court that giving companies like LinkedIn free rein to decide, on any basis, who can collect and use data … risks the possible creation of information monopolies that would disserve the public interest.”
hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022)

Scraper vendors quote that ruling constantly, and fair enough: it’s real, and it matters. Public scraping is not hacking under the CFAA in the Ninth Circuit’s view.

The timeline alone tells you how unsettled this ground was. LinkedIn’s cease-and-desist went out in 2017. The Ninth Circuit first sided with hiQ in 2019. Then the Supreme Court vacated that decision and sent the case back for another look in light of Van Buren, the 2021 ruling we’ll get to in a moment. And in April 2022, the Ninth Circuit reaffirmed its position anyway. Five years of litigation to establish one sentence: public web scraping is not a CFAA violation. That’s how slowly and expensively legal clarity gets made.

But almost nobody quotes the ending, because the ending ruins the sales pitch. After winning the famous CFAA question, hiQ still lost on breach of contract. LinkedIn’s User Agreement banned scraping, hiQ had agreed to it, and the district court found hiQ breached it. The case settled in late 2022 with a $500,000 judgment against hiQ and an agreement to delete the scraped data and the algorithms built on it. hiQ, the company, shut down.

🔍 Did You Know? hiQ won the landmark ruling that public scraping isn't hacking, and still paid $500,000, deleted its data, and went out of business. Both halves of that sentence matter. The famous victory and the forgotten ending came from the same case.

The second case is Van Buren v. United States, decided by the Supreme Court in 2021. A police officer had looked up a license plate in a law-enforcement database for personal reasons, and prosecutors called that “exceeding authorized access” under the CFAA. The Supreme Court disagreed and narrowed the statute: the question is whether you accessed parts of a system that were off limits to you, a gates-up-or-down question, not whether you misused information you were allowed to see. You can read the opinion yourself; the practical effect is that the federal anti-hacking law targets bypassing gates, like logins and access controls, not breaking behavioral rules on pages you could lawfully view.

Put the two cases together and you get the current US picture on the CFAA and public scraping: reading public pages isn’t criminal hacking, and violating a website’s rules about how you read them is a contract matter. Not permission. A lane assignment. The consequences moved from criminal court to civil court, and civil court is where hiQ lost everything.

So if it’s not a crime, what about the question people actually type into Google at midnight?

Can You Go to Jail for Scraping Google Maps?

No. No US case has jailed anyone for scraping public business listings, and after Van Buren, criminal exposure under the CFAA targets bypassing logins and hacking, not reading public pages.

Why does the jail myth survive, then? Partly because “web scraping” headlines blur together cases about hacking, credential theft, and insider misuse with cases about reading public pages. And partly, frankly, because fear is useful to two groups: platforms that want scrapers deterred, and vendors selling “compliant” tools who benefit when the alternative sounds like prison. Read the actual cases and the temperature drops fast.

I want to be precise here, because both extremes get this wrong. The scared version, “you can be prosecuted for scraping a coffee shop’s address”, has no case behind it. Business names, addresses, and hours sitting on a public map are about as public as data gets, and the courts that have looked at public scraping treated it as a civil dispute between companies.

What does the escalation path really look like when a platform objects? It’s paperwork, not handcuffs. First come the technical blocks. If you matter enough to notice, a cease-and-desist letter follows: a lawyer’s demand to stop, which is not a court order but starts a record. Only after that, and almost only against companies building products on the data, do actual lawsuits appear, arguing breach of contract and related claims. That’s the ladder hiQ climbed all the way to the top of. A one-person side project never meets the second rung. A funded startup selling scraped Maps data should assume it will.

But the relaxed version, “it’s all fine, nobody can touch you”, is wrong too. hiQ wasn’t touched by prosecutors. It was dismantled by a contract claim, a deletion agreement, and legal fees. The realistic consequences of scraping Google Maps are civil and operational: bans, blocks, claims, and costs. Which deserve their own honest list.

What You Actually Risk (The Honest Consequences List)

The realistic risks of scraping Google Maps are operational and civil, not criminal. Here’s the full list, in the order you’d likely meet them:

IP blocks and rate limiting: Google detects automated traffic quickly and blocks it quietly
Account and API key termination: anything tied to your Google identity can be suspended for ToS violations
Civil breach-of-contract exposure: the hiQ lane; rare for small actors, real for anyone building a business on scraped data
Wasted spend: scraped lists arrive without emails, decay fast, and need enrichment anyway
Deliverability damage: outreach to unverified scraped contacts burns sender reputation you can’t easily rebuild
Procurement embarrassment: the risk nobody prices in, and the one I’ve personally watched cost real money

Worth knowing how that first one actually works, because Google’s enforcement is a machine, not a mailbox. Automated traffic gets fingerprinted by request patterns, headless-browser tells, and IP reputation. The response escalates quietly: CAPTCHAs first, then throttling, then blocks that can sweep up your whole office network or cloud provider range. For most people who try to scrape Google Maps, the entire legal question stays theoretical, because the technical wall arrives in minutes.

Let me tell you about that from experience. In 2022, back when I lived in Hamburg, I wrote a little Python script to pull cafe listings for a marketing meetup talk. Nothing commercial, maybe two hundred requests. Google blocked my IP before I finished my coffee. That morning taught me how Google actually enforces its scraping rules: with engineers, not lawyers. You will meet the rate limiter long before you ever meet a legal document.

The last one cost more. In 2024 I watched an agency lose a retainer over a single procurement question. The client’s ops lead asked, “where is this data from?” about a lead list, and the honest answer was a Maps scraper someone ran eighteen months earlier. No lawsuit. No regulator. Just a client who quietly concluded that a partner who couldn’t answer a sourcing question in one clean sentence wasn’t a partner for the long term. The deal died in an email thread, politely.

Two rulebooks, one spreadsheet. And we haven’t even reached the third rulebook yet: privacy law, which applies no matter how the data was collected.

GDPR: When a Business Listing Becomes Personal Data

In the EU, a business listing becomes personal data the moment it identifies a person, and scraping doesn’t change that. “Bella Napoli Pizza” with a phone number is data about a company. “Dr. Anna Schmidt, dentist, Hamburg” is data about Anna Schmidt, a human being with rights under the GDPR. And local business data is full of sole traders, named practices, and owner names, so this line gets crossed constantly. To put a number on “constantly”: in Germany alone, 768,593 business listings in our database carry a phone classified as a pure mobile line (queried September 2026), and a sole trader’s mobile number is personal data the moment it points at the person behind the shop.

Here’s the part that surprises people: the General Data Protection Regulation applies to processing personal data regardless of how public the source was. “It was on Google Maps” is not a GDPR exemption. If you process EU records that identify people, you need a lawful basis. For B2B prospecting that’s usually legitimate interest under Article 6(1)(f), which is a real, usable basis, but it’s an assessment you’re supposed to make and document, not a magic phrase. Transparency duties and the right to object still apply either way.

Let me define the jargon quickly, since this is where articles usually get foggy. “Processing” means almost anything you do with data, including just storing it. “Lawful basis” means one of six legal justifications the GDPR accepts. “Legitimate interest” is the one that lets businesses process data for reasonable commercial purposes, if the person’s rights don’t outweigh those purposes.

And to be fair in the other direction: GDPR does not ban B2B outreach, scraped or otherwise. It regulates it. European companies prospect under GDPR every day, lawfully. The difference between them and a scraper bucket list is documentation, suppression handling, and the ability to answer “where is this from?” without flinching. Keep that phrase in mind. It keeps returning.

What does the defensible version look like in practice? Teams I’ve seen pass European scrutiny share four habits: they know which records identify people and treat those differently from pure company data; they’ve written down their legitimate-interest reasoning once, properly, instead of improvising it per campaign; every message offers a working way to object; and objections actually stick, permanently, in a suppression list. None of that requires a legal department. It requires deciding, before the first send, that you’ll be able to show your work.

CCPA and US State Privacy Laws

California’s CCPA is the other privacy law that matters here, and it works differently from GDPR. The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that meet certain thresholds, like annual gross revenues above $25 million or handling data on large numbers of California residents. It grants Californians rights to know, delete, and opt out of the sale or sharing of their personal information.

Two honest nuances for our topic. First, the law contains a carve-out for “publicly available” information, and scraper sellers lean on it hard. But the carve-out is narrower than the marketing suggests, and how it applies to map listings that get combined with other data and resold is exactly the kind of question you’d want a lawyer, not a vendor FAQ, to answer for your specific case. Second, thresholds matter: a five-person agency probably isn’t a covered business, but the data vendors selling records at scale generally are, with notice and opt-out obligations to match.

Which produces a practical rule I give every team: even if YOU fall under the thresholds, your data vendor probably doesn’t. So ask the vendor how they handle CCPA and GDPR obligations. Their answer, or their silence, tells you what you’re really buying. And California isn’t alone anymore. Virginia, Colorado, Connecticut, Texas, and a lengthening list of other states run comprehensive privacy laws of their own now, each with slightly different thresholds and rights. Nobody sane tracks them all by hand anymore. The practical takeaway stays the same in every state: know your source, honor opt-outs, and buy from vendors who can show their homework. The compliance floor keeps rising every year, and it never goes back down.

Does the Answer Change Outside the US?

The contract layer travels; the law layer changes at every border. Google’s terms are a worldwide agreement, so “against the ToS” is true whether you scrape from Texas, Toronto, or Tallinn. But when people ask “is it legal to scrape Google Maps” from outside the US, the honest answer has extra moving parts.

Three differences matter most. First, the hiQ and Van Buren rulings are US decisions; other countries’ courts owe them nothing, and computer-misuse laws are worded differently everywhere. Second, in the EU and UK, the GDPR framework we covered above does the heavy lifting the CFAA doesn’t, and European regulators have shown real appetite for enforcement against data harvesting that touches people. Third, some jurisdictions add their own layers, like database rights in Europe that protect substantial investments in compiled data.

I won’t play world tour guide beyond that, because pretending to summarize forty legal systems in a blog post is exactly the overconfidence this article exists to avoid. The portable lesson: the further your data or your targets sit from your own jurisdiction, the earlier a real lawyer should enter the conversation.

Is AI Scraping Illegal? (The 2026 Wrinkle)

AI scraping sits under the same laws as regular scraping, plus copyright questions that courts are still actively deciding. Nothing about pointing an AI agent at Google Maps changes the analysis above: the ToS still forbids the extraction, the CFAA still doesn’t criminalize reading public pages, and privacy law still attaches to records that identify people.

What’s genuinely new is the copyright fight. AI companies scraping content to train models are being sued by publishers and platforms in cases that hadn’t produced a unified rule as I wrote this, and I’m not going to predict how they land. For local business data specifically, one part is worth flagging: reviews. Google Maps reviews are user-generated content, they’re named in Google’s no-scraping clause explicitly, and they routinely contain personal information about identifiable reviewers. If any slice of Maps scraping is the riskiest, it’s harvesting reviews at scale, with or without AI.

So where does that leave a team that just wants local business data without joining a test case? With four legal paths, honestly ranked.

The Legal Ways to Get Google Maps Data (Ranked by Effort)

There are four ways to get Maps-style local business data without scraping Google Maps: the official API, public registries, licensed databases, and collecting it yourself. Each has a real trade-off, so here they are without the spin.

And a quick honesty note before the list, since I work for one of the options. I’ll tell you where each path is weak, including ours. A legality article that funnels every reader to its own product is just a scraper ad wearing a suit, and you’ve read enough of those today.

1. The Google Places API, within its terms. Google sells access to its places data through the Places API. It’s official, it’s reliable, and it’s built for powering applications. For prospecting it has honest limits: you pay per request, the terms restrict caching and bulk-exporting the data, and the records stop at what the map knows, which means no email addresses. It’s the right tool for building a product experience, and an awkward, expensive one for building a lead list. One subtlety worth naming: using the API doesn’t repeal the no-scraping clause. The same terms that sell you per-request access also forbid stockpiling the results into your own permanent Maps mirror. Plenty of teams have discovered that the “legal” path still has walls; they’re just clearly marked ones.

2. Official registries and open data. Secretary of State filings, city license lists, and Census counts are public, free, and completely uncontroversial to use. They’re also slow to work with and thin on contact channels. They shine for verification and for specific jobs, like the methods I walk through in my guide to find newly opened businesses, and the free local business database sources that cover the rest of the no-budget stack.

3. Licensed business databases. Data providers aggregate business records from many sources under their own compliance obligations, and license the result. This is the category CUFinder operates in, so read this paragraph knowing exactly who wrote it. The honest case: an enriched local business database carries the fields the map never shows, is built to be GDPR and CCPA aligned on the vendor side, and hands you a sourcing answer you can repeat to a client with a straight face. The equally honest limitation: no database purchase makes YOUR outreach lawful by itself. Compliance is shared. The vendor answers for the data; your send practices answer for themselves. Our own landing page literally lists “user’s duty” in its compliance table, and I consider that phrasing a feature.

4. First-party collection. Forms, partnerships, events, your own market presence. Slowest, cleanest, and outside this article’s scope, but it belongs on the list because it’s where your best data will always come from long-term.

And since I just made a claim about “fields the map never shows”, here are the actual numbers. I queried our US records, all 18,400,261 of them from the 200M+ record database, in September 2026:

Field	Scraped Maps row	Enriched database record (share of 18.4M US records)
Name, address, rating	Yes	Yes (100%)
Verified email	No	31.0%
LinkedIn URL	No	29.6%
Facebook URL	No	33.2%
Instagram URL	No	24.6%
SIC code	No	~100%
NAICS code	No	100%

Read that honestly, in both directions. Scraping Google Maps genuinely captures names, addresses, and ratings; nobody should pretend it finds nothing. But the fields an outreach campaign actually runs on, emails, socials, industry codes, are precisely the ones a map pin never carried in the first place. That’s the practical argument that ends up mattering more than the legal one for most teams: even a perfectly executed scrape produces a list you can’t contact.

If you’re weighing specific tools against these paths, I compared all of them, scrapers included, in my honest roundup of Google Maps scraper alternatives. And if buying rather than building is on your table, start with where to buy local business leads so you can compare the whole market, not one vendor’s pitch.

A Compliance Checklist Before Any Local Outreach

Whatever data path you choose, the outreach itself has its own rules, and they apply equally to scraped, bought, and hand-built lists. Here’s the checklist I actually use with teams:

Know your source in one sentence: if you can’t say where a list came from without hedging, don’t send to it
US email basics: the CAN-SPAM Act requires honest headers and subject lines, a working unsubscribe you honor promptly, and a physical address in every message
EU records: confirm a lawful basis is assessed and documented before any send, and offer a clean way to object
Suppression hygiene: keep one list of everyone who opted out, and check it every single campaign
Keep proof: save the vendor’s sourcing and compliance answers in writing, where procurement can find them later

💡 Pro Tip: Before buying any list, ask the vendor to explain its data sources in one sentence, in writing. Keep the answer. That email has ended more vendor evaluations for me than any feature comparison, in both directions.

That habit came straight out of the 2024 retainer story. The agency didn’t lose the client because scraping is illegal. It isn’t, mostly, as we’ve covered. They lost the client because they couldn’t produce the one-sentence answer. Since then I keep sourcing answers filed like receipts. And that folder has won deals. In security reviews, a plain sourcing answer beats a fancy deck every single time.

🧠 Remember: No database, API, or tool makes your outreach lawful by itself. Your send practices carry their own rules under CAN-SPAM, GDPR, and their growing cousins. The data source and the outreach are separate compliance questions. Answer both.

And if you want the whole article as one decision path, here it is:

→ Building an app or product feature: use the Places API within its terms → Verifying specific businesses: registries and open data → Running outreach that needs emails and industry codes: a licensed database whose sourcing you’ve seen in writing → Researching a handful of prospects: a human and a browser are still perfectly legal

Still with me? Good. Let’s close the loop on the questions people actually ask.

FAQ: Scraping Google Maps and the Law

Is scraping Google Maps legal?

Scraping Google Maps violates Google’s Terms of Service, but it is not a crime in the US; courts treat public-data scraping as a contract and privacy matter. The realistic consequences are account bans, IP blocks, and civil claims, plus privacy-law duties when records identify people. This is general information, not legal advice.

Is Google scraping legal?

The same distinction applies across Google surfaces: Google’s terms prohibit automated access without permission, and violating them is a contract issue rather than a criminal one. Google enforces mostly with technical blocks. Search results, Maps listings, and reviews each raise their own additional questions, with reviews being the most sensitive.

Is web scraping illegal in the US?

No federal law bans web scraping as such. After Van Buren and hiQ, the CFAA covers bypassing access controls, not reading public pages, so scraping disputes run through contract law, copyright, and privacy statutes instead. Scraping data behind logins or ignoring contracts you agreed to is where legal risk concentrates.

Can you go to jail for scraping?

No US case has jailed anyone for scraping public business listings. The hiQ v. LinkedIn saga ended in civil court, with a settlement and a money judgment. Criminal exposure under the CFAA targets hacking and bypassing logins; contract claims, account bans, and IP blocks are the realistic consequences.

Is scraping Google Maps allowed under Google’s terms?

No. Section 3.2.3(a) of the Google Maps Platform Terms of Service is titled “No Scraping” and specifically forbids copying and saving business names, addresses, or user reviews. Google’s general Terms of Service also restrict automated access to its services without permission.

Is AI scraping illegal?

AI scraping falls under the same laws as any scraping: ToS contracts, the narrowed CFAA, and privacy statutes. The added wrinkle is copyright, where lawsuits over AI training data were still being decided as of 2026. Courts haven’t settled a unified rule, so honest answers stop at “unsettled”.

Is it legal to scrape Google Maps reviews?

Reviews are the riskiest slice of Maps data. Google’s no-scraping clause names user reviews explicitly, reviews are user-generated content with potential copyright interests, and they often identify the people who wrote them, which pulls in privacy law. If any Maps scraping deserves extra caution, it’s reviews.

What is the legal alternative to scraping Google Maps?

Four options: the Google Places API used within its terms, official registries and open data, licensed business databases that carry their own compliance obligations, and first-party collection. Which one fits depends on whether you’re building an app, verifying businesses, or running outreach that needs emails and industry codes.

It’s Time to Pick Data You Can Defend

Let’s land this. Is scraping Google Maps legal? Against Google’s contract: clearly. Against US criminal law: no case says so for public listings. Free of consequences: absolutely not, and hiQ’s $500,000 ending is the receipt.

The whole article in one line of arrows:

→ Terms: scraping Maps breaks them, explicitly → Law: no crime in reading public listings → Courts: contract claims are real, ask hiQ → Privacy: applies the moment records identify people → Your move: pick a source you can explain

So here’s the one-question test I’ll leave you with, the same one that ended that agency retainer in 2024: can you explain where your local business data comes from in one sentence, out loud, to a client? If yes, you’ve already made a defensible choice, whether that’s the API, a registry, or a licensed database. If no, fix the answer before someone asks the question. Someone always asks. If you’re starting from zero, our local business database guide walks the whole landscape.

And the disclaimer one last time, because it’s the honest close: I’m a marketer who reads court opinions for fun, not a lawyer. For your specific situation, especially anything touching EU data or resale, talk to actual counsel. This article gives you the map; counsel gives you the route.

Now tell me in the comments: what’s your data sourcing answer, the one-sentence version? I read every reply, and I genuinely collect these.