# Is Web Scraping Legal? A Practical Check Before You Build a Lead List

> A plain-English walkthrough of the rules that matter when you collect public business data for outreach, plus a checklist you can run today. Not legal advice.

You want a list of local businesses to pitch, and a scraper can build it in minutes. The worry is simple: will this get you in trouble? The honest answer is that scraping itself is rarely the problem. What you collect, how you collect it, and what you do with it afterwards is where the risk sits.

This article is written for one situation: a small business, freelancer or agency collecting public business contact details to send cold outreach. It is general information, not legal advice. Laws differ by country, so check the rules that apply to you and to the people you contact.

## What the law usually looks at

There is no single "scraping law". Instead, a few separate areas of law can apply to the same activity:

- **Access rules.** Getting past a login, a paywall or a technical block is treated very differently from reading pages anyone can see.
- **Website terms.** Many sites forbid automated collection in their terms of service. Breaking terms is usually a contract issue, not a crime, but it can still get you blocked or sued.
- **Copyright and database rights.** Facts like a phone number are generally not protected. Copying large chunks of creative content, reviews or photos can be.
- **Personal data rules.** In places like the EU and UK (GDPR), a named person's work email is still personal data, so you need a lawful basis and must be able to explain where you got it.
- **Email marketing rules.** Laws like CAN-SPAM in the US, and PECR in the UK, set rules for how you send, not how you collected.

Keep these separate in your head. A list can be fine to collect and still be risky to email the wrong way.

## Lower-risk vs higher-risk scraping

| Lower risk | Higher risk |
|---|---|
| Public business listings (name, category, address, main phone, website) | Data behind a login or paywall |
| Generic business emails like info@ or hello@ | Personal emails or home addresses of private individuals |
| Small, targeted lists for a clear business purpose | Mass harvesting with no plan for the data |
| Respecting rate limits and blocks | Bypassing CAPTCHAs, bans or IP blocks |
| Using facts only | Republishing reviews, photos or written content |

Business-to-business outreach using public listing data, like a Google Business Profile (see [what a Google Business Profile contains](https://getclient.pro/learn/google-business-profile)), sits at the lower-risk end. That does not make it risk-free.

## Steps you can take today

### 1. Write down your purpose in one sentence

For example: "I collect public contact details of dental clinics in Leeds to offer website redesigns." If you cannot state the purpose, you are collecting more than you need. Under GDPR-style rules, this sentence is the start of your legitimate interest reasoning.

### 2. Collect only what that purpose needs

For a cold pitch you need the business name, website, a contact email and maybe the owner's first name. You rarely need anything else. Skip fields you will never use.

### 3. Stay on public pages

Do not log in to scrape, do not use someone else's account, and do not work around blocks. If a site stops you, stop.

### 4. Record the source

Keep a column saying where each lead came from and when. If someone asks how you got their details, you can answer in one line. When you bring in lists from elsewhere, keep that source field too; our guide on [importing leads from CSV](https://getclient.pro/blog/import-leads-from-csv) shows how custom fields help with this.

### 5. Check where your recipients are

Rules for the recipient's country usually matter, not just yours. Some countries are stricter about emailing named individuals than generic business addresses. If you are pitching overseas, read [selling to small businesses abroad](https://getclient.pro/blog/sell-to-small-businesses-abroad) and check the local rules.

### 6. Make your emails compliant

At minimum, in most places:

- Use your real name and a truthful subject line.
- Include a physical or business address where the law asks for one.
- Give a clear way to opt out, and honour it quickly.
- Explain briefly why you are contacting them.

The [cold email launch checklist](https://getclient.pro/resources/cold-email-launch-checklist) covers these alongside technical setup.

### 7. Delete what you no longer need

Set a rule of thumb, such as removing leads who never replied after your sequence ends plus a few months. Less stored data means less to protect and explain.

## Where a tool helps and where it does not

A scraper does not make your outreach legal; your choices do. A good tool can make the careful path easier. In GetClient, the Google Maps scraper pulls public business listing data such as name, category, address, phone, website and emails found, and the owner's name with a confidence score where it is public. Campaigns include a one-click unsubscribe link for each recipient, and unsubscribed addresses are skipped automatically, so an opt-out is not lost between tools. Because the list and the sending live together, you are not copying spreadsheets between a scraper and a mailer and losing track of sources. More on that in [finding leads and emailing them in one tool](https://getclient.pro/blog/find-leads-and-email-them-in-one-tool).

You still decide who to email, what to say and how often.

## Red flags that mean stop and get advice

- You want to scrape private individuals rather than businesses.
- The data includes health, children's or financial details.
- You plan to sell or share the list.
- A site owner or person has sent you a complaint or legal letter.
- You are emailing at large volume into a strict jurisdiction.

Any of these is a good moment to speak to a lawyer who knows your country.

## The short version

Collecting public business contact details for a clear B2B purpose, staying off logged-in pages, keeping a source record and sending honest emails with a working opt-out puts you on much firmer ground than most worries suggest. Do those five things before your first send.

## Frequently asked questions

### Is it legal to scrape Google Maps?

Google's terms restrict automated collection, so scraping can breach those terms even when the data is public. Courts and regulators generally treat that differently from hacking. Collect only public business facts, use them responsibly, and check the rules where you operate.

### Do I need consent to email a business I found by scraping?

It depends on the country. In the US, CAN-SPAM allows cold commercial email if you follow its rules, including an opt-out. In the UK and EU, emailing corporate addresses is often allowed under legitimate interest, but rules for sole traders and named individuals can be stricter. Check the recipient's local law.

### Is an owner's name scraped from a website personal data?

Yes, under GDPR-style laws a named person's details count as personal data even in a business context. You can often still use it for relevant B2B outreach, but you should have a clear purpose, keep it minimal and say where you got it if asked.

### Can I get banned or sued for scraping?

Sites can block your IP or account, and in some cases bring civil claims, especially if you bypass technical blocks or copy protected content. Staying on public pages, respecting blocks and collecting only facts reduces that risk.

### Is buying a scraped list safer than scraping it myself?

Not necessarily. You become responsible for how you use the data, and you may not know how it was collected or how old it is. If you buy, ask the seller about sources and verify emails before sending.

Source: https://getclient.pro/blog/is-web-scraping-legal