Is it legal to look someone up?

Is it illegal to look someone up online?

No, and the question people are usually asking is a different one.

Reading what a service publishes to anybody with a browser is not an offence in the United States, the United Kingdom, the European Union or Brazil. Those records were made public deliberately, and reading them is the act every search engine performs continuously.

Search the same question with the word illegal in it and the results are criminal defence firms answering something else entirely: whether you can be arrested for what you typed into a search box. That is about the content of a query, not about looking up a person.

The real question underneath is narrower and it has four parts. Where the information sits, who is doing the looking, what it is for, and what you do next.

Four questions, not one

Almost every page on this subject collapses them into a single sentence about public records, which is why so few of them are any use.

Where the data sits decides whether a computer-misuse law is in play at all. Who is doing it decides whether data protection law lands on you or on the service you used.

What it is for decides whether a consumer-protection statute takes over, and in the United States that statute is the Fair Credit Reporting Act. What you do next is where harassment and stalking law waits, and it does not care where the information came from.

Where does a lookup stop being a lookup?

At the login.

The Ninth Circuit put the line plainly in the LinkedIn scraping case: something has to divide open spaces from closed ones on the web, and an authentication requirement, such as a password gate, is what creates it. Pages that load for anybody sit on the open side.

The Supreme Court framed it in Van Buren as a gates-up-or-down question: either you can reach an area of a system or you cannot, and a poor reason for reading something you were allowed to read is not the offence. It left open whether the gate has to be technical, and a site's terms stay a separate contractual question.

Which leaves a short practical rule. Signing into somebody's account or guessing a password is a separate federal matter under the stored communications statute. A fake profile that gets a follow request accepted is a different problem: the access was granted, and what it breaches is the platform's rules and, in some states, an impersonation statute.

Which uses does the law actually restrict?

A short, closed list of decisions about somebody's life.

The Fair Credit Reporting Act names the purposes for which a consumer report may be furnished and says no others. The list is built around credit, insurance, employment and eligibility for a licence or a benefit, with tenancy reached through the business-transaction clause.

So the trigger is the decision, not the search. Looking somebody up before a first date is not on that list and does not need to be. Looking up the same person to decide whether to rent them a flat is.

A disclaimer does not settle it either. The FTC's own guidance is titled just saying you're not a consumer reporting agency isn't enough, and its 2023 order against two people-search companies turned on how the reports were marketed.

When does looking someone up become stalking?

When it becomes a course of conduct aimed at a person.

The federal stalking statute reaches anybody who uses an electronic communication service with intent to harass, intimidate, or place another person under surveillance with that intent, in a course of conduct that causes or would be expected to cause substantial emotional distress.

The clause says nothing about where the information came from, which is the part people miss. A search that was lawful on its own becomes evidence of the offence the moment it is part of that pattern.

The working test is repetition and intent. Checking once before meeting a stranger is not surveillance. Checking every week on somebody who has asked you to stop is, and every jurisdiction has its own version of that rule.

Do the same rules apply outside the United States?

The shape is the same and the wording is better.

The GDPR does not apply to a natural person acting in the course of a purely personal or household activity, and Recital 18 extends that to social networking. The same recital adds that the Regulation does apply to whoever provides the means for that processing, which is the service rather than the reader.

Brazil's LGPD has the clearest sentence written anywhere on this. Article 7, paragraph 3 requires that processing of personal data whose access is public must still consider the purpose, the good faith and the public interest that justified making it available.

That is the search-and-use distinction written into a statute. Public did not mean unconditional when the record was published, and it does not become unconditional when somebody reads it.

What if you are the one being looked up?

You have removal rights, and they are uneven.

California's Civil Code gives a right to have a business delete personal information it has collected, and the state runs a single deletion platform that registered data brokers must begin checking every 45 days from 1 August 2026. It binds businesses rather than the person doing a search.

Every people-search publisher runs its own opt-out as well, and the process is slower and more repetitive than it looks: removal from one brand does not remove you from its sister brands, and fresh public filings put the record back.

What no law reaches is the part that is not a record. Accounts registered to your email address stay findable because the sign-up form has to answer, and there is no deletion right against a form working correctly.

Common questions