People-search sites resell a blend of public records, marketing data, and self-reported data. They are fast, cheap lead generators and terrible evidence. The one rule that matters: a broker record is a lead, never a fact. Confirm every field you intend to use against the primary source the broker got it from — and if you cannot identify that primary source, do not use the field.

Three input streams, blended and sold:

They also buy from each other, constantly. That is the most important structural fact about the category: one wrong record propagates across every brand, and cross-checking five brokers gives you five copies of one error wearing five hats. Apparent corroboration across brokers is worth close to nothing.

whose-number-is-this

what-an-email-reveals

who-really-owns-it

The honest summary: brokers are for turning a name into candidate selectors when you have nothing else, and for auditing your own footprint. For every claim you intend to publish or rely on, go to the primary record.

Primary-source catalogue by jurisdiction and record type, with access and legal notes: reference/source-catalogue.md.

The business model is a teaser. Expect: a result page confirming a match exists with characters masked; counts ("8 phone numbers, 12 addresses") designed to imply depth; padding with public data the broker did not pay for; a progress animation implying live searching that is actually a checkout funnel; a "report" that arrives as an auto-renewing subscription with an awkward cancellation path; and results for names that do not exist, because the funnel runs regardless.

Never treat a teaser count as evidence, and assume any paid tier bills until you actively stop it. Some brokers do offer genuine investigator or business tiers with contractual use restrictions — a different product, with obligations you agree to when you sign.

In the US there is a legal line between two things that look identical:

The rule: you must not use non-FCRA broker data to make decisions about employment, tenancy, credit, or insurance. That includes screening a job applicant, vetting a tenant, or checking a contractor you are about to hire. If the decision is one FCRA covers, you must go through a regulated CRA and follow its process, including notice and adverse-action requirements. The broker's own terms will say this; it is not decoration, and both the broker and the user have been the subject of enforcement over it. This is the single most common way otherwise-legitimate investigators create real liability.

Related US restrictions worth knowing: motor vehicle and driver records are restricted to enumerated purposes under the Driver's Privacy Protection Act, and some states restrict voter-file use to electoral purposes.

The US-style people-search market barely exists in Europe, and what does exists on much thinner data. Durable reasons: aggregating and publishing personal data needs a lawful basis, and "we bought it" is not one; transparency obligations require telling the data subject you hold their data, which is fatal to a scraped aggregation business; special-category data is stricter again; and subjects have access, rectification, erasure, and objection rights that are cheap to exercise and expensive to service. Electoral registers, land registries, and court records are correspondingly more restricted than their US equivalents.

If you are in scope of GDPR, your case file is processing too. You need a lawful basis, a retention limit, and a defensible answer if the subject asks what you hold. Legitimate interests is available but requires a documented balancing test.

The most valuable use of this skill for most people. Run yourself through the major brokers, record every profile URL, then work each opt-out. What to know:

Assume every search you run is logged, sold, and potentially visible.

Use before touching any of this on a sensitive matter. Minimum: a separate browser profile, no account reuse, and never the case's real contact details in a signup form.

Never grade a claim higher because more brokers agree.

Skip trace on a judgment debtor: name plus a last-known city.

Scraping these sites breaches their terms and most deploy active anti-automation; the business tiers exist precisely to sell you the API instead. Bulk collection of personal data has its own exposure under computer-misuse and data-protection law depending on where you and the data sit. Do not use non-FCRA data for FCRA-covered decisions. Do not use broker data to locate a person who has taken steps to be unlocatable unless you have a documented lawful basis — a court order, a skip-trace mandate, an active investigation — and read ../../ETHICS.md before you start. This category is the raw material of doxxing and stalking, and the same lookup is legitimate or criminal depending entirely on the objective you wrote down at the start.