Lena OrtizSearching public information about a phone number is legal in the United States, the United Kingdom and most of the EU. How you use the result is a separate legal question. That part often gets too little attention.
This is a general explainer, not legal advice. Rules differ by country and change; if a decision matters, take proper advice.
Why the search itself is generally fine
A reverse phone lookup searches sources that are already public: business directories, websites, public social profiles, published records, news. Reading publicly available information is not, in itself, a regulated activity. For example, a plumber may list a mobile number on their website. Searching that number finds the same public information as searching for "plumber".
What separates a legitimate service from an illegitimate one is the source. An ordinary public-information lookup does not provide call logs, text messages or private carrier subscriber records. Live location and leaked credential contents also fall outside its scope. Licensed numbering data can identify a carrier, line type, and assignment region without revealing the subscriber or device location.
Obtaining private records typically requires legal process, and buying them can put you on the wrong side of computer-misuse and data-protection law.
The line that actually matters: FCRA
In the United States, the Fair Credit Reporting Act (FCRA) governs certain reports from a consumer reporting agency. These are reports for decisions about employment, credit, housing, insurance, or other eligibility purposes. An employer may obtain such a report from a company that compiles background information. The FTC's guidance for employers explains the steps the employer must follow.
The important distinction is not simply whether someone searched the web while making a decision. It is whether a third-party service assembled or supplied a consumer report for an FCRA purpose. That framework carries obligations a general public-web search product is not designed to satisfy:
- the subject must consent to an employment screening
- the subject has the right to see what was reported about them
- the subject has the right to dispute inaccuracies and have them investigated
- the user must follow adverse-action procedures before rejecting someone
A public-web search meets none of these. There is no consent step, no dispute mechanism, no accuracy guarantee. Services like ours are not consumer reporting agencies. They must not be used for those decisions. This restriction is a real constraint.
So: looking up a number that called you is an ordinary personal use. If you need a third-party background report for an employment, housing, credit, insurance, or similar eligibility decision, choose a suitable provider. It must be designed to comply with the relevant screening law. Follow the required consent and notice processes.
DeepSearch is not such a provider and prohibits those uses. The longer decision note is A people-search result is not a consumer report.
Europe and the UK: public doesn't mean unrestricted
Under the GDPR and the UK GDPR, personal data is protected whether or not it is publicly accessible. "I found it on a public website" is not a lawful basis on its own. The ICO's current guidance sets out a test for organisations relying on legitimate interests.
Identify the interest and show that the processing is necessary. Balance it against the person's rights and freedoms.
The regulation has a household exemption. It excludes processing for purely personal or household purposes. Checking whether someone you plan to meet through a dating app is real is a personal purpose.
That exemption disappears the moment the activity becomes professional or organisational. Business research needs a lawful basis, usually legitimate interests. This includes screening, due diligence, finding sales leads and journalism. You must also consider proportionality: whether the research goes further than its purpose requires. You may need to tell the person that you hold data about them.
Canada has the Personal Information Protection and Electronic Documents Act (PIPEDA). It governs how private-sector organisations collect, use and disclose personal information in commercial activities. Under Principle 9, you can access personal information an organisation holds about you at little or no cost. You can also challenge its accuracy.
Organisations must respond to access requests within 30 days. In specific circumstances, they can extend this by 30 days if they give notice. You can file a privacy complaint with the Office of the Privacy Commissioner of Canada. It investigates and makes recommendations, but it cannot impose fines.
After the Commissioner issues a report of findings, a complainant may apply to the Federal Court of Canada for a hearing. The Court can order corrections and award damages. Provincial privacy laws limit where federal PIPEDA applies. Quebec, British Columbia and Alberta have laws for general commercial activity. Ontario, New Brunswick, Newfoundland and Labrador have laws for health information.
The practical test: could you explain your purpose to the person you searched and have them accept it as reasonable? If the honest answer is no, the legal analysis is probably going the same way.
Where it stops being legal regardless of source
Some uses are unlawful no matter how public the underlying information was. These are not edge cases; they're the reason this whole category attracts scrutiny:
Stalking and harassment. Repeatedly contacting, following, or monitoring someone who does not want it. Assembling public information into a profile that enables that is part of the offence in many jurisdictions, not a separate neutral act.
In Canada, residents can register phone numbers on the National Do Not Call List to reduce unwanted telemarketing calls. Registration is free and takes effect within 24 hours. Telemarketers break the Unsolicited Telecommunications Rules if they spoof Caller ID to display false or misleading information. Fines can reach $1,500 per violation for individuals and $15,000 per violation for corporations.
To report suspected fraud, contact the Canadian Anti-Fraud Centre at 1-888-495-8501. Unwanted telemarketing calls that are not fraud can be reported to the National Do Not Call List at 1-866-580-3625.
Doxxing. Publishing someone's home address, workplace, or contact details with the effect of exposing them to harassment. The individual facts being public is not a defence; the aggregation and publication is the harm.
Impersonation and pretexting. Posing as someone else – a bank, a colleague, the account holder – to extract information. In the US, the Telephone Records and Privacy Protection Act criminalises fraudulent acquisition or unauthorised disclosure of confidential phone-record information.
Unauthorised access. Trying to get into an account you don't own, in any way. Illegal essentially everywhere.
A workable test before you search
Three questions, in order:
- Why do I want this? If you can't say the purpose in one plain sentence without flinching, stop.
- Is this one of the regulated decisions? Employment, credit, housing, insurance, tenancy – if yes, use a proper screening provider with consent.
- What am I going to do with it? Verifying that a caller is legitimate is a use. Contacting someone who has asked you not to is not.
Uses that are straightforwardly fine
To be clear that the answer isn't "nothing is allowed", these are ordinary and lawful in most places:
- identifying an unknown or repeated caller
- checking that an online seller or buyer is a real trading entity
- confirming a person you met online is who they claim, before meeting in person
- checking a business's public details before sending money
- reconnecting with someone you've lost contact with, respecting their response
- journalism and research in the public interest, within your jurisdiction's rules
What we do about it
DeepSearch uses public sources and licensed carrier and numbering data. We also use public breach-notification indexes to name incidents. These indexes do not expose passwords, hashes or breached-record contents. We do not offer call or message contents, private subscriber records or live location. Our terms prohibit using results for FCRA-covered decisions.
Public-web claims link to their source so you can check them rather than trust them.
That combination is deliberate. You cannot verify a tool's claim without knowing its source. Do not trust an unverifiable claim when making a decision about a person.