Legal and ethical basics
Public does not mean free to use for anything. The rules depend on where you are, where the person is, and why you are looking, so treat this page as a checklist of questions, not answers.
Purpose and lawful basis
Have a reason you could explain to the person's face. Journalism, an employer's fraud investigation, due diligence, a security assessment you were hired for and research each have their own rules and exemptions. If you are not sure yours applies, ask before you collect.
Personal data
Information about an identifiable person is personal data in most jurisdictions (the GDPR in the EU and the UK, and privacy laws in many other places). In practice:
- Collect only what answers your question. A full profile "just in case" is the thing to avoid.
- Keep it secure and for as long as the case needs, then delete it.
- Take extra care with health, religion, politics, sexuality, children and anyone who may be at risk if found.
The services you use
- Use the access any member of the public has. No fake accounts to see more, no logins you are not entitled to, no getting round paywalls or access controls.
- Read a service's terms before you automate requests against it, and respect rate limits.
Where to stop
- Never use what you find to contact, harass, stalk, threaten or expose anyone.
- Stop when the next step would need more than public information, or when the person's safety could suffer from what you publish.
- The registry's acceptable use policy applies to every tool and guide in it.