Is reverse phone lookup legal?

Short answer: in the United States, the United Kingdom, and most of the EU, searching public information about a phone number is legal. What you then do with the result is where the law actually bites - and that part gets far less attention than it deserves.

This is a general explainer, not legal advice. Rules differ by country and change; if a decision matters, take proper advice.

Why the search itself is generally fine

A reverse phone lookup searches sources that are already public: business directories, websites, public social profiles, published records, news. Reading publicly available information is not, in itself, a regulated activity. If a plumber lists their mobile number on their website, finding it by searching for that number is no different from finding it by searching for "plumber".

What separates a legitimate service from an illegitimate one is the source. A service that offers you call logs, text message contents, private carrier subscriber records, live location, or leaked credential contents is offering something outside an ordinary public-information lookup. Licensed numbering data can identify a carrier, line type, and assignment region without revealing the subscriber or device location. Obtaining private records typically requires legal process, and buying them can put you on the wrong side of computer-misuse and data-protection law.

The line that actually matters: FCRA

In the United States, the Fair Credit Reporting Act governs reports supplied by a consumer reporting agency for decisions about employment, credit, housing, insurance, or other eligibility purposes. The FTC's guidance for employers explains the steps required when an employer obtains one of those reports from a company that compiles background information.

The important distinction is not simply whether someone searched the web while making a decision. It is whether a third-party service assembled or supplied a consumer report for an FCRA purpose. That framework carries obligations a general public-web search product is not designed to satisfy:

• the subject must consent to an employment screening
• the subject has the right to see what was reported about them
• the subject has the right to dispute inaccuracies and have them investigated
• the user must follow adverse-action procedures before rejecting someone

A public-web search meets none of these. There is no consent step, no dispute mechanism, no accuracy guarantee. This is exactly why services like ours state plainly that they are not consumer reporting agencies and must not be used for those decisions - and it's why that disclaimer is a real constraint rather than boilerplate.

So: looking up a number that called you is an ordinary personal use. If you need a third-party background report to make an employment, housing, credit, insurance, or similar eligibility decision, use a provider designed to comply with the relevant screening law and follow the required consent and notice processes. DeepSearch is not such a provider and prohibits those uses. The longer decision note is A people-search result is not a consumer report.

Europe and the UK: public doesn't mean unrestricted

Under the GDPR and the UK GDPR, personal data is protected whether or not it is publicly accessible. "I found it on a public website" is not a lawful basis on its own. The ICO's current guidance requires organizations relying on legitimate interests to identify the interest, show the processing is necessary, and balance it against the person's rights and freedoms.

For most individuals this matters less than it sounds, because there is a household exemption: processing personal data for purely personal or household purposes falls outside the regulation. Checking whether the person you're meeting from a dating app is real is a personal purpose.

That exemption disappears the moment the activity becomes professional or organisational. If you are researching people as part of a business - screening, due diligence, lead generation, journalism - you need a lawful basis, usually legitimate interests, and you need to have thought about proportionality. You may also owe the person notice that you hold data about them.

The practical test: could you explain your purpose to the person you searched and have them accept it as reasonable? If the honest answer is no, the legal analysis is probably going the same way.

Where it stops being legal regardless of source

Some uses are unlawful no matter how public the underlying information was. These are not edge cases; they're the reason this whole category attracts scrutiny:

Stalking and harassment. Repeatedly contacting, following, or monitoring someone who does not want it. Assembling public information into a profile that enables that is part of the offence in many jurisdictions, not a separate neutral act.

Doxxing. Publishing someone's home address, workplace, or contact details with the effect of exposing them to harassment. The individual facts being public is not a defence; the aggregation and publication is the harm.

Impersonation and pretexting. Posing as someone else - a bank, a colleague, the account holder - to extract information. In the US, the Telephone Records and Privacy Protection Act criminalizes fraudulent acquisition or unauthorized disclosure of confidential phone-record information.

Unauthorised access. Trying to get into an account you don't own, in any way. Illegal essentially everywhere.

A workable test before you search

Three questions, in order:

1. Why do I want this? If you can't say the purpose in one plain sentence without flinching, stop.
2. Is this one of the regulated decisions? Employment, credit, housing, insurance, tenancy - if yes, use a proper screening provider with consent.
3. What am I going to do with it? Verifying that a caller is legitimate is a use. Contacting someone who has asked you not to is not.

Uses that are straightforwardly fine

To be clear that the answer isn't "nothing is allowed", these are ordinary and lawful in most places:

• identifying an unknown or repeated caller
• checking that an online seller or buyer is a real trading entity
• confirming a person you met online is who they claim, before meeting in person
• checking a business's public details before sending money
• reconnecting with someone you've lost contact with, respecting their response
• journalism and research in the public interest, within your jurisdiction's rules

What we do about it

Since it's fair to ask what a company selling this actually enforces: we use public sources, licensed carrier and numbering metadata, and public breach-notification indexes that name incidents without exposing passwords, hashes, or breached-record contents. We don't offer call or message contents, private subscriber records, or live location, and our terms say results must not be used for FCRA-covered decisions. Public-web claims link to their source so you can check them rather than trust them.

That combination is deliberate. A tool that can't show you where a fact came from can't be verified, and a tool that can't be verified shouldn't be trusted with a decision about a person.