Anti-Bot Countermeasures & Legal Landscape
BotGuard/SearchGuard, proxy strategies, Google v. SerpAPI, GDPR

Google's Anti-Bot Countermeasures (2025-2026)
Anti-Bot Countermeasures
Google Maps difficulty score: 90/100 — one of the toughest platforms to scrape.
BotGuard / SearchGuard Architecture
Built on BotGuard (internally "Web Application Attestation"), deployed across YouTube, reCAPTCHA v3, and Maps. SearchGuard (January 2025) is the Search-specific evolution — "tens of thousands of person hours and millions of dollars."
Detection: Behavioral Analysis (4 Signal Categories)
Signal
Bot Threshold
Human Range
Mouse movement (trajectory, velocity, acceleration, micro-tremors)
Velocity variance <10
50-500
Keyboard rhythm (inter-key intervals, duration, errors)
Variance <5ms
20-50ms
Scroll behavior (amplitude, direction, timing)
Delta variance <5px
20-100px
Timing jitter (Welford's algorithm)
>200 events/sec
10-50
Detection: Browser Fingerprinting (100+ Signals)
Navigator, screen, performance metrics, WebRTC leaks, TLS fingerprinting. Explicit checks for 
navigator.webdriver, ChromeDriver, Puppeteer, Selenium, PhantomJS.
reCAPTCHA v3 (Invisible)
No visible challenge — assigns 0.0-1.0 score based on session behavior. On Maps, appears inconsistently. Only bypass: never trigger it.
Cryptographic Protection
ARX cipher (similar to NSA's Speck). Magic constants rotate per script update. Scripts served with integrity hashes. Bypasses become obsolete within minutes.
Blocking Behavior
Trigger
Risk
Datacenter IPs
Blocked immediately — non-viable
Uniform request timing
High — humans pause, bots don't
Direct navigation to data pages
Medium — humans wander first
Default/missing headers
Medium
Stealth detection: Google returns poisoned/incomplete data to detected scrapers rather than blocking outright. Soft bans aren't clean HTTP codes — "some weird JSON response or just incomplete page loads." DOM class names change every few months.
Proxy Effectiveness
Type
Effectiveness
Cost
Notes
Datacenter
Very Low
$
Non-viable for Maps
Residential
Good
$$
~30-50 searches/hour/IP before CAPTCHAs
Mobile (4G/5G)
Best
$$$
Most reliable for large-scale
ISP
OK (low volume)
$$
Burns fast. Once flagged, stays flagged for days
Hybrid
Cost-optimized
$$
Datacenter for non-Maps, mobile for Maps. Saves 40-60%
Practical rate limit: max 1 req/min/IP = ~144K results/day per IP.
Anti-Detection Toolkit
playwright-stealth / 
puppeteer-extra-plugin-stealth (17 evasion modules) — near-essential
undetected-chromedriver for Selenium
CapMonster Cloud for automated CAPTCHA solving
FlareProx — Cloudflare Workers proxy for IP masking (100K free daily requests)
Cookie banner handling: 
document.querySelector('#sp-cc-accept')?.click()
CAPTCHA detection: 
document.querySelector('form[action*="validateCaptcha"]')
Image/font blocking via 
Network.setBlockedURLs
Search-based navigation to bypass Feb 2026 "limited view" lockdown

Legal & TOS Landscape
Legal & TOS Landscape
Google Maps TOS
"Customer will not export, extract, or otherwise scrape Google Maps Content for use outside the Services."
This is a contractual prohibition, not criminal statute. Breach of contract, not a crime.
Google v. SerpAPI (Dec 2025 — Ruling Pending)
Filed: December 19, 2025, N.D. California (Case No. 4:25-cv-10826)
Google's DMCA Claims
Access circumvention (17 U.S.C. 1201(a)(1)(A)): SerpAPI circumvented SearchGuard "on billions of separate occasions." $200-$2,500 per violation.
Trafficking in circumvention tools (17 U.S.C. 1201(a)(2)): Marketing services to bypass SearchGuard.
SerpAPI's requests increased "25,000%" over two years — hundreds of millions daily.
SerpAPI's Defense (Motion to Dismiss, Feb 2026)
Google doesn't own copyright to third-party search content
SearchGuard protects business model, not copyrighted works
"Google's entire business began with a web crawler that copied the content"
Hearing: May 19, 2026 before Judge Yvonne Gonzalez Rogers — ruling not yet published.
Industry impact: If Google prevails, rank tracking, competitive intelligence, and SEO analytics could become legally untenable.
Key Legal Precedents
Case
Year
Impact
Van Buren v. US
2021
CFAA limited to insiders. ToS violations are not computer crime
hiQ v. LinkedIn
2022
Public data scraping doesn't violate CFAA (Ninth Circuit, reaffirmed)
X Corp v. Bright Data
2023
Platforms can't claim copyright on user-generated content
Meta v. Bright Data
2024
Logged-out users haven't accepted ToS — no contract breach
Key shift: Google abandoned CFAA arguments (neutered for public data) for DMCA anti-circumvention claims — targeting SearchGuard bypass specifically.
US vs. EU
United States
Public data scraping generally legal (CFAA precedent)
ToS violations = contract, not criminal
CAN-SPAM for outreach from scraped data
European Union
GDPR: public availability does NOT equal lawful basis (Article 6)
Names, phones, reviewer profiles = personal data
Need legitimate interest (Art. 6(1)(f)) for B2B
Must provide opt-out, honor right to be forgotten
Penalties: up to 20M EUR or 4% global turnover
EU AI Act enforcement: August 2026
Risk by Method
Method
Legal Risk
TOS Violation
DMCA Exposure
Official Places API
None
No
No
Data marketplace purchase
Low
No (you didn't scrape)
No
Commercial platforms
Medium
Yes
Indirect
Open-source scrapers
Medium
Yes
Low
SERP API proxies
High
Yes
Active lawsuit
Reverse-engineered APIs
Highest
Yes
Circumvention
Enforcement Reality
Survey of 40-50 agencies scraping Maps at scale: zero cease-and-desist letters. Google relies on technical countermeasures for most scrapers, reserving legal action for large commercial operations (SerpAPI).
Sources
IPWatchdog — Google Sues SerpAPI
SerpAPI Motion to Dismiss
Is Scraping Google Maps Legal?