Everyone wants the list. Almost nobody wants the work that makes it useful.

There is a promise doing the rounds in every sales community: export Google Maps, walk away with two thousand contacts, fire off a campaign, wait.

It is also why so many sales teams have enormous databases and empty calendars.

Google Maps genuinely is the largest directory of physical businesses on the planet. Name, category, phone, website, opening hours, reviews. All of it in plain sight. The problem is the gap between "this is visible" and "I can use this", and that is precisely where most articles on the subject go quiet.

Three filters, not one

Before you write a line of code or buy a tool, the process has to clear three independent tests. Failing any one of them is enough to sink it.

Filter The question Who decides
Technical Can I collect this? The tool
Contractual Am I allowed to collect it? Google Maps Platform terms
Legal Can I contact the people I collected? GDPR and national marketing law

Most prospecting projects only ever test the first one, then act surprised by the outcome.

The shortcut that looks like it works

There is no shortage of tools that walk Maps results and hand you a CSV in minutes. Technically, they deliver. Contractually, they do not: the Google Maps Platform terms contain an explicit clause prohibiting the export, extraction or scraping of Maps content for use outside Google's own services.

Plenty of articles rush to point out that breaching terms of service is not a crime. It is a real distinction, grounded in US case law, and it is beside the point for your day to day. Because the immediate risk is not a courtroom. It is this:

Building your pipeline on that is not clever. It is a dependency you do not control.

The supported route, and the limits nobody mentions

The official alternative is the Places API. It returns structured results carrying the same kind of information you see on the map. It also carries limits worth knowing before you design anything:

And it carries a budget trap. Places API (New) bills by SKU, with the price driven by the fields you request through the field mask, charged at the highest tier among the fields in the request. Identifiers alone sit in the cheap tier. Adding name, address and location moves you up. Adding contact details or ratings moves you up again.

Translated: two developers can build the same list and receive invoices an order of magnitude apart. Requesting only what you actually use stops being a best practice and becomes cost control.

What you are actually allowed to keep

This is the point that catches nearly everyone out, and the one that most changes how the system should be built.

Data Can you store it?
Place identifier (place_id) Yes, with no time limit
Latitude and longitude Cached, up to 30 consecutive days
Name, phone, ratings, photos No

In other words, the CRM stuffed with fields copied from Google that you are picturing is not supposed to exist.

The correct design is different, and happens to be better: you store the reference key and build everything else from what each company publishes on its own website. General email, contact form, service area, technology stack. And for anyone selling digital services, that is exactly where the useful signal lives. Who has an outdated site. Who has no online store. Who has no site at all.

Collecting is the easy part. Contacting is where it changes character.

In Portugal, electronic direct marketing sits under Law 41/2004, the GDPR and Law 58/2019. The national supervisory authority issued dedicated guidance, Directive 2022/1, following a rise in complaints about unsolicited messages. The underlying principles apply across the EU.

Three practical points:

And one note that saves arguments: buying a list from a vendor does not transfer responsibility. The sender answers for it.

Qualifying beats accumulating. Every time.

The most expensive mistake is not the legal one, it is the commercial one.

A list of thousands of businesses across a whole region forces you into a generic message, because nothing specific applies to all of them. Generic message, generic response.

A short list, in a single sector, where you can name each company's problem, changes the conversation entirely. And qualification is exactly where automation earns its keep, because the signals are observable without touching Maps at all:

None of that requires extracting anything from Maps. It requires opening each candidate's public page and measuring it properly.

The process that survives scrutiny

  1. Discovery through the supported route, with the field mask trimmed to the minimum
  2. Enrichment from each company's own public sources
  3. Qualification against observable, measurable criteria
  4. Outreach on a clear legal basis, with a visible way to opt out

It is more work in the first week. It saves a great deal from the second onwards.

And unlike the shortcut, it still works next month.

Sources