Is selling scraped databases legal? A balanced look at the rules and the limits

It depends on what you sell, and to whom

There is no single yes or no. "Selling scraped databases" covers everything from a tidy spreadsheet of restaurant phone numbers to a bulk export of personal contacts sold to strangers. Those sit in very different places legally, so the honest answer starts with a question: what exactly is in the file, and where do the people on both sides of the sale live?

Two ideas do most of the work here. First, gathering public information is treated more leniently than gathering private information. Second, how you use and transfer that information matters as much as how you got it. A list that is fine to build for your own outreach can create obligations the moment you package it and sell it on.

This post is a balanced walk through the moving parts: personal versus business data, GDPR, cold email rules, platform bans, CAPTCHAs, and the famous 120-result limit. For the collection side specifically, our guide on whether it is legal to scrape Google Maps is a good companion read.

The line that decides most of this

Data protection law protects personal data: information about an identifiable human being. A company name, a shopfront address, and a generic info@ or reception number are usually about the business, not a person. A named owner, a personal mobile, or an individual's direct email start to look personal, even in a business context.

Most Google Maps listings are a mix. That is the practical trap. The same export can hold plainly public business fields next to fragments that identify a specific person. When you sell that file, the personal fragments travel with it, and the obligations travel too.

What GDPR actually asks of a seller

Under the General Data Protection Regulation, if your database contains personal data about people in the EU or UK, you need a lawful basis to process it, you generally have to be transparent about where it came from, and you have to honor rights like access and deletion. Selling the data is itself a form of processing, so it does not sidestep these duties. It can add to them.

Legitimate interest can support B2B outreach in some cases, but it is a balancing test, not a blank check. The person's reasonable expectations count. Someone who published an office number to attract customers is in a different position from someone whose private mobile ended up in a scraped field by accident.

There is a compounding risk when you sell rather than use data yourself: you often cannot control what the buyer does next. If they misuse it, questions can travel back up the chain to how the list was assembled and described. That is a strong argument for keeping personal and business fields clearly separated and for being conservative about what you package.

Selling a raw copy vs selling insight

It helps to separate two things people call "selling scraped databases." One is handing over a bulk copy of records. The other is selling a research product you built: cleaned, verified, segmented, and enriched with context a buyer could not easily assemble themselves.

The second column is not just safer, it is usually a better business. A market report, a scored shortlist, or a "businesses that lack X in this city" study is your work product. It is far harder to challenge than a bare copy of public records, and buyers pay more for the thinking than for the rows. Our note on a value-added database versus a raw CSV goes deeper on this.

Cold email and outreach rules

Even a clean list runs into a second layer of law the moment anyone emails it. In the United States the CAN-SPAM Act requires honest headers, a real physical address, and a working way to opt out. In the EU and UK, consent and legitimate-interest rules shape what you can send and to whom.

If you sell a database, your buyer inherits these duties, and their compliance is partly downstream of the list quality you gave them. Stale addresses and mislabeled personal contacts push a buyer toward exactly the behavior these laws punish. Selling a cleaner, better-described list is not just polite, it lowers the legal temperature for everyone.

Bans, CAPTCHAs, and the 120-result cap

Separate from data protection, there are the platform's own rules and defenses. Google's mapping product is offered under the Google Maps Platform Terms of Service, which restrict bulk automated collection and mass copying. Breaking those terms is a contract issue, not a criminal one, but it still matters, especially if your whole product is a bulk copy.

Technically, aggressive scraping triggers friction by design: CAPTCHAs, rate limits, and the well-known cap of roughly 120 results per search. That limit is not a bug you defeat, it is the platform paginating and then stopping. Trying to smash through it with brute force is what gets requests throttled or blocked. You can read more on why Google limits results to 120.

The calmer approach works with these limits, not against them. Browser-based capture that mirrors normal use, split into specific searches by city and category, stays well inside what the service expects. That is the model the Vonsel extension follows: it reads what your own browser already loaded, so there is no server farm hammering the endpoint. On losing access, our piece on whether you can get banned scraping Google Maps covers the practical risk.

Lowering your risk before you sell

The tool is the means, the workspace is the end

A capture tool is neutral. It gathers public details from a page you were already looking at. The interesting, defensible, and valuable part is what happens next: cleaning, verifying, adding context, scoring, and turning rows into a decision. That is why we frame the Vonsel extension as the means and the Vonsel dashboard as the end.

Inside the dashboard, captured businesses live in a mapped CRM. You can reopen a capture and add more, attach reviews to businesses you already saved, keep a history, and let the platform draft an AI email tailored to each business. Reviews and email intelligence turn a flat list into a contextual database organized around real pain points. That is the enrichment layer that makes "selling insight" possible instead of selling a raw copy. For a wider view of data quality, see Google Maps data versus bought lists, and browse more explainers in the Legal category.