Is OSINT Legal? Ethics and GDPR for Online Investigations

The short answer, starting with a familiar request

It usually starts casually. A hiring manager says, "Could you just have a quick look at this candidate online before Friday?" Or a colleague wants to know who is behind an angry review. Nobody means harm, and that is exactly how a well-meant search turns into a file nobody can justify.

So, is it legal? OSINT as a discipline is. Reading public websites, checking whether an email address is registered somewhere, consulting company registers and looking up breach metadata are lawful in most countries. An investigation becomes unlawful through one of three doors:

Public does not mean free to use

The most common misconception is that public personal data sits outside data protection law. Under the GDPR, which applies in the EU and in similar form in the UK, personal data is any information relating to an identifiable person. A public username, a profile photo and a breach record tied to an email address all qualify. Collecting them, storing them in a case file or combining them into a profile is processing, and processing is regulated.

Combining is the key point. Each piece may be harmless alone, but an aggregated profile of where someone works, which apps they use and what they look like can enable harms no single source did. Regulators and courts tend to look at the result, not just the inputs.

Lawful basis under the GDPR

Article 6 of the GDPR lists six lawful bases for processing. For most OSINT work, one of these four applies:

Legitimate interests is the most used and the most demanding. You need a documented balancing test: what is your interest, is the processing necessary for it, and does it override the rights and reasonable expectations of the person concerned? A marketplace checking whether a seller's email is disposable passes easily. Building a full profile of an ex-employee out of curiosity does not.

Two further points matter. Special category data, such as health, religion, political opinions or sexual orientation, has stricter rules under Article 9, and data about criminal offences is restricted under Article 10. Journalism has specific exemptions, which member states set out in national law under Article 85, so journalists should check their local rules.

Necessity against intrusiveness

The balancing test sounds abstract until you plot some real requests on it. The picture below is an illustration, not a legal standard, but it matches how reviewers tend to think: the more intrusive the check, the more necessary it has to be.

The principles that shape daily work

• Purpose limitation. Define the purpose before you search, and do not reuse the results for something unrelated.
• Data minimisation. Collect what answers the question. To know whether an applicant's email is disposable, you do not need their gaming accounts.
• Accuracy. Mark unconfirmed links as unconfirmed. Wrongly attributing an account to someone can cause real harm.
• Storage limitation. Set a retention period for case files and delete them when it expires.
• Transparency. Article 14 generally requires informing people when you collect their data from other sources, with exceptions, for example where it would seriously impair the purpose. Know which applies to you and record why.

Passive versus active methods

Passive methods observe without interacting: reading public pages, checking registrations, querying breach metadata, looking up DNS or WHOIS/RDAP records. Active methods involve contact or deception: messaging the subject, sending friend requests from a fake persona, or pretexting a company into revealing information.

Passive work is the default for good reasons. It does not alert the subject, it creates no new interactions you have to justify, and it avoids deception. Active methods may be acceptable for some professionals, such as law enforcement acting under legal authority, but for most commercial and journalistic work they raise questions that need explicit approval. TraceFind lookups are passive: they never notify the person being looked up. Our introduction to OSINT has the short version.

A decision flow before you run anything

Put the questions in order and most bad searches never start. Run this before each case, not once a year.

Lines you should never cross

Laws such as the US Computer Fraud and Abuse Act and the UK Computer Misuse Act prohibit unauthorised access. And do not use OSINT findings for employment, tenancy, credit or insurance decisions without following the rules for that context. In the US, the Fair Credit Reporting Act governs background reports used for such decisions.

Document as you go

Documentation turns an investigation into defensible work. It shows a reviewer, a court or a regulator that you had a purpose, stayed within it and handled the data properly. A simple case log is enough:

Case:        2026-117  Seller verification
Purpose:     Fraud prevention (legitimate interest, LIA ref. LIA-04)
Requested:   Trust & Safety lead
Subject:     jane.doe@example.com / +49 151 00000000
Searches:    2026-10-27 09:12 UTC  email search
             2026-10-27 09:15 UTC  phone search
Findings:    Address in use since at least 2019 (breach date); not disposable
             Number is mobile, not listed on receive-SMS sites
Confidence:  High that identity is long-standing
Outcome:     Listing approved
Retention:   Delete case file 2027-04-27

Record the time and exact query of each search, where each finding came from, how confident you are and what was decided. Keep evidence such as screenshots or archived copies only as long as you need it. The TraceFind canvas helps with the graph side: every search result becomes linked entities, and the case can be exported as an image or canvas file. The investigation workflow guide shows a full case from question to report.

An ethics checklist before each case

• Can I state the purpose in one sentence, and would I be comfortable explaining it to the person concerned?
• Is there a less intrusive way to get the answer?
• Am I collecting only what the purpose needs?
• Could the result harm someone if it is wrong, leaked or misused?
• Who will see the output, and how long will it be kept?

If any answer makes you uneasy, narrow the scope or stop. The strongest investigators are often the ones who decide not to collect something. To see how exposed you are yourself, read how to protect your digital footprint.

If you would not be comfortable explaining the search to the person it is about, treat that as your answer.

Frequently asked questions