Legal and Ethical Boundaries in OSINT Research

One of the most persistent ideas in open-source research is that if information is public, you may do anything you like with it. That idea is wrong, and it gets researchers, their clients, and sometimes the people they research into real trouble. Whether information is visible to anyone with a browser is only the first question. The next questions are whether you are allowed to collect it in the way you plan, whether you may store and combine it, and whether doing so is proportionate to the purpose.

This guide sets out the main legal and ethical boundaries an OSINT practitioner should understand. It covers terms of service, data protection under the GDPR, several US laws that commonly apply, the risks of pretexting, and how to judge proportionality. It is written for working researchers, not lawyers.

This article is general information, not legal advice. Laws differ by country, state, and sector, and they change. If your work raises a question that matters, speak to a qualified lawyer in the relevant jurisdiction before you act.

Public is not the same as permitted

"Publicly available" describes access. It says nothing about use. A person's home address may appear in a property record, their face in a news photo, and their employer on a professional networking profile. Each item is public. Combining them into a profile that lets a stranger find that person at home is a different act, with different consequences, and in many places different legal rules.

Three ideas help keep this straight:

Access: Could you lawfully see the information without deceiving anyone or bypassing a technical barrier?
Collection and use: Does any law, contract, or platform rule limit how you gather, store, or use it?
Aggregation: Does putting scattered public facts together create a new capability, such as locating or tracking a person, that the separate facts did not?

Most ethical problems in OSINT come from the second and third questions, not the first.

Terms of service

Every major platform has terms of service, and most restrict automated collection, the creation of fake accounts, and the reuse of data. Breaking terms of service is usually a contractual matter rather than a crime, but that does not make it harmless. Consequences can include account suspension, loss of access to a platform you depend on, civil claims, and damage to the credibility of your findings if the method is later challenged.

Practical points:

Read the terms for the platforms you use most, especially sections on scraping, automated access, and account authenticity.
Many platforms prohibit accounts that misrepresent who you are. Research accounts that use a pseudonym are common in the field, but you should understand the platform's rules and your organisation's policy before creating one.
If you need data at scale, check whether the platform offers an official API or a research access programme, and use it under its conditions.
Record which method you used to collect each item. If a finding is ever challenged, you want to show that you gathered it lawfully and within the platform's rules, or at least that you made an informed decision.

Data protection and the GDPR

If you are in the European Union, or you research people in the EU in certain circumstances, the General Data Protection Regulation (GDPR) applies. The UK has its own equivalent, the UK GDPR, alongside the Data Protection Act 2018. The GDPR does not exempt personal data just because it is publicly available. Names, photos, user names, and online identifiers that relate to an identifiable person are all personal data, regardless of where you found them.

Lawful basis

Article 6 of the GDPR requires a lawful basis for processing personal data. The six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests. For most private-sector OSINT work, such as due diligence or fraud investigation, the relevant basis is usually legitimate interests. Relying on it requires a balancing exercise: you identify the interest, show that the processing is necessary for it, and weigh it against the rights and reasonable expectations of the person concerned. Document that assessment before you start. Regulators expect to see it.

Special category data

Article 9 sets stricter rules for special category data, including information about health, religious or philosophical beliefs, political opinions, trade union membership, sexual life or orientation, racial or ethnic origin, and biometric or genetic data used for identification. Criminal offence data has its own separate restrictions under Article 10. Public social media posts often reveal this kind of information incidentally. If your task does not need it, do not record it.

Data minimisation and storage limitation

Article 5 sets out core principles, including data minimisation (collect only what is adequate, relevant, and limited to what is necessary) and storage limitation (keep it no longer than needed). In practice this means you scope your collection to the question, avoid capturing whole profiles when one post is relevant, and set a retention period for case files.

Transparency

Article 14 covers information obligations when you obtain personal data from somewhere other than the person themselves. There are exceptions, for example where notifying the person would seriously impair the purpose of the processing, but you need to know whether one applies rather than assume it does.

US considerations

The United States has no single general data protection law equivalent to the GDPR. Several states have passed their own privacy laws, most prominently California with the CCPA as amended by the CPRA, and a number of federal laws apply to specific activities. Three come up often in OSINT work.

The Fair Credit Reporting Act

The Fair Credit Reporting Act (FCRA) regulates consumer reports, which broadly means information about a person's credit, character, general reputation, personal characteristics, or mode of living that is used to decide eligibility for credit, insurance, employment, housing, and certain other purposes. If you assemble and sell reports that are used for those decisions, you may be acting as a consumer reporting agency, with obligations around permissible purpose, accuracy, and the person's right to dispute.

The practical warning: if a client asks you for background information on a job applicant, prospective tenant, or similar person, stop and check whether the FCRA applies before you take the work. Many people-search sites state in their terms that their data may not be used for FCRA purposes, precisely because they do not meet its requirements. The Federal Trade Commission enforces the FCRA and publishes guidance on its website at ftc.gov.

The Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is the main US federal law against unauthorised access to computers. In general terms, it prohibits accessing a computer without authorisation or exceeding authorised access. The Supreme Court narrowed the "exceeds authorized access" provision in Van Buren v. United States (2021), and litigation over scraping public web pages, notably hiQ Labs v. LinkedIn, has explored how the law applies to data anyone can view. Even so, the boundaries are not settled in every situation, and state computer crime laws can be broader.

The safe working rule for OSINT is simple. Do not guess or reuse passwords, do not exploit misconfigurations to reach data that is not meant to be public, do not bypass logins, paywalls, or technical blocks, and do not continue after a site has clearly told you to stop. If you find exposed data that looks like it was not meant to be public, such as an open storage bucket, do not download it. Note the finding and seek advice on responsible disclosure.

Other sector laws

The Driver's Privacy Protection Act restricts access to and use of state motor vehicle records. The Gramm-Leach-Bliley Act includes provisions against obtaining customer financial information through false pretences. The Telephone Records and Privacy Protection Act of 2006 makes it a federal crime to obtain phone records by pretexting. Licensed investigators in many states also work under state licensing rules that set additional conduct standards.

Pretexting and deception

Pretexting means obtaining information by pretending to be someone you are not or by giving a false reason for asking. Examples include calling a bank posing as the account holder, messaging a subject's relative under a false identity, or sending a connection request to a target while posing as a recruiter.

Some forms of pretexting are explicitly illegal, as noted above for financial and phone records. Others may be lawful in a given jurisdiction but still breach professional ethics codes, platform rules, or the rules of evidence. Lawyers in the US, for example, are bound by professional conduct rules on deception that also cover investigators acting on their behalf, and courts have criticised evidence gathered through misrepresentation.

For passive OSINT, the cleanest line is this: observe, do not engage. Interacting with a subject or their contacts under a false identity turns research into an operation, with a different set of legal and ethical questions. Do not do it without explicit authorisation, legal review, and a clear justification.

Proportionality

Proportionality asks whether the intrusion into someone's privacy is justified by the purpose. It is a legal test in some contexts, notably European human rights law and data protection, and a sound ethical test everywhere.

Ask four questions before you start and again when the scope changes:

Legitimate aim: What is the purpose, and is it lawful and defensible?
Necessity: Does answering the question require this information about this person?
Least intrusive means: Is there a less intrusive way to get the answer?
Balance: Does the benefit outweigh the harm to the person, including the risk if your report is misused or leaked?

A worked example

Suppose a mid-sized company asks you to look into a potential supplier before signing a contract. The client also asks you to "find out everything" about the supplier's managing director, including family members and home address.

A proportionate approach would look like this:

Research the company: registration, filings, litigation, sanctions screening, adverse media, and beneficial ownership. These relate directly to the decision.
Research the director in their business capacity: other directorships, disqualifications, relevant litigation, and sanctions or politically exposed person status.
Decline to compile family members' details and the home address unless a specific, documented reason ties them to the contracting risk. "Everything" is not a purpose.
Avoid recording incidental special category data, such as the director's health or religion from personal social media.
Confirm that the purpose is supplier due diligence, not employment screening, so FCRA considerations do not arise in the US. If the client later wants to use the report for a hiring decision, that changes the legal picture.
Write a short scope note at the start of the file recording the purpose, lawful basis where relevant, and what you excluded and why.

The client gets what they need for the decision. The file is defensible. The director's private life stays private.

Common mistakes

Assuming public means fair game. It does not, as this whole article explains.
Collecting first and deciding relevance later. Over-collection creates storage, security, and legal exposure. Scope first.
Ignoring the client's real purpose. The same research can be lawful for fraud investigation and unlawful for tenant screening. Ask what the findings will be used for.
Treating terms of service as irrelevant. They may not be criminal law, but breaches can undermine your evidence and your access.
Keeping files forever. Set retention periods and delete on schedule.
Taking work that looks like stalking. Requests to locate an ex-partner or to find where a private person lives without a lawful reason should be refused.

When to stop and get legal advice

Pause the work and talk to a lawyer when:

The findings will be used for decisions about employment, credit, insurance, or housing.
The task involves locating a private individual's home or current whereabouts.
You are asked to interact with the subject or their contacts under a false identity.
You encounter data that appears to have been exposed by mistake or obtained by someone else through a breach.
The subject is a minor, or the research touches special category data in a central way.
The research spans jurisdictions with different rules, and you are unsure which apply.
The client expects the findings to be used in litigation, where evidence handling and collection methods will be scrutinised.

Checklist

Write down the purpose of the research and who will use the findings.
Confirm the purpose is lawful and that the research is proportionate to it.
Identify which laws may apply: GDPR or UK GDPR, FCRA, state privacy laws, licensing rules.
Document a lawful basis and, for legitimate interests, the balancing assessment.
Check platform terms for the collection methods you plan to use.
Do not bypass logins, paywalls, or technical controls, and do not use pretexts.
Collect only what the question requires, and avoid special category data unless essential.
Record the source and method for every item collected.
Set a retention period for the case file.
Get legal advice whenever the work meets one of the stop conditions above.