⚖️ Is OSINT Legal?

In general, yes. Collecting information that is genuinely public — published web pages, public social posts, court records, corporate filings, WHOIS data — is lawful in the US, UK and EU. OSINT becomes illegal at the point you bypass an access control, obtain data you are not authorised to hold, or use lawful data for an unlawful purpose such as stalking or harassment. The activity is rarely the crime; the access method and the purpose usually are. This page is not legal advice.

Constructing a search query is not illegal — a dork is just an advanced search using operators that Google itself documents. What matters is what you do with the results. Google returned the URL, but acting on exposed credentials, entering a system you have no authorisation for, or downloading data you know was not meant to be public can engage the Computer Fraud and Abuse Act in the US or the Computer Misuse Act 1990 in the UK. The search is lawful; the intrusion is not.

In the US, not under the CFAA. In hiQ Labs v. LinkedIn the Ninth Circuit held that scraping pages open to anyone without credentials is not "unauthorised access", applying the Supreme Court's reasoning in Van Buren v. United States (2021). But hiQ still lost — in late 2022 the court found it had breached LinkedIn's User Agreement, which it had accepted by creating accounts, and the case ended in a consent judgment and permanent injunction. The lesson is precise: the CFAA protects you from hacking claims on public pages; it does not protect you from a contract you agreed to.

Clickwrap is where you actively agreed — you ticked a box or created an account. Browsewrap is a terms link sitting in a footer you never clicked. Courts treat them very differently: clickwrap is a strong contractual basis, browsewrap is much harder to enforce. In Meta v. Bright Data (January 2024) the court declined to block scraping of public, logged-out Facebook and Instagram pages, and let the contract claim proceed only for the period when Bright Data had an actual contractual relationship with Meta. Logging in is often the single act that converts a defensible collection into a contract breach.

Yes, and it is usually the bigger constraint. GDPR governs personal data regardless of whether that data was public — "it was on the internet" is not a lawful basis. If you process personal data about people in the EU or UK you need a lawful basis, most often legitimate interests, and you must be able to document the balancing test. The Clearview AI enforcement actions are the clearest warning: regulators across several EU states issued fines into the tens of millions over scraping public photographs. Public does not mean unregulated.

Creating a pseudonymous research account is generally lawful in itself, but it almost always breaches the platform's terms of service, and terms breach is a contract issue rather than a crime. The risk escalates sharply if the persona is used to deceive someone into disclosing information, to gain access to a private group, or in anything resembling entrapment. Note also that logging into an account is exactly what converted hiQ's defensible public scraping into an enforceable contract breach.

This is where people most often get it wrong. In the US, using information to make decisions about employment, tenancy, credit or insurance brings you under the Fair Credit Reporting Act, regardless of whether you found the data for free. FCRA imposes notice, consent, accuracy and adverse-action duties, and most OSINT tools — including this site — explicitly prohibit FCRA use in their terms. Doing an informal Google search on a candidate and acting on it can put you inside a regulated activity you have not complied with.

No. Checking your own exposure is the safest possible use of these tools and is what most privacy guidance actively recommends. Running your own name, email and phone through people-search sites, breach checkers and username tools shows you what a stranger can already see, which is the necessary first step before filing removal requests.

It varies by jurisdiction and it is one of the sharpest lines in OSINT. Deploying a trackable link to capture someone's IP address is treated as lawful in some US contexts but is far more restricted in the EU, where it engages both GDPR and ePrivacy rules. Unlike passive collection, this is an active technique that touches the target's device — treat it as needing legal review before use, not after.

Robots.txt is not legally binding in most jurisdictions; it is a request, not an access control. But respecting it demonstrates good faith and materially reduces the chance of a dispute escalating. Ignoring it will not by itself make you liable, yet it is the kind of fact that colours everything else in a courtroom. The related tort, trespass to chattels, requires you to actually impair the server — courts set that bar high, and a few thousand requests a day rarely meets it.

It can be, but only if collected defensibly. Courts want provenance: when it was captured, by whom, from where, and proof it has not been altered since. A screenshot with no hash, no timestamp and no capture log is weak. This is why professional investigators use forensic capture tools rather than the browser's screenshot key, and why chain-of-custody discipline matters more than the cleverness of the technique.

In the US: the Computer Fraud and Abuse Act (unauthorised access), the Fair Credit Reporting Act (eligibility decisions), the Stored Communications Act, state anti-stalking statutes, and state privacy laws such as CCPA/CPRA. In the UK: the Computer Misuse Act 1990, UK GDPR and the Data Protection Act 2018, the Protection from Harassment Act 1997. In the EU: GDPR and ePrivacy. Sector rules may also bind you — the FCRA point catches out more people than every hacking statute combined.