You can legally investigate a person’s background by working from public records, open online sources, and properly scoped commercial search services, and by staying clear of the federal statutes that fence off credit files, DMV data, stored communications, financial and medical records, and phone logs. The distinction that matters is between records the government makes available to anyone and protected private information that requires the person’s consent or a court order. Cross that line and you face civil liability starting at $1,000 per violation under some federal laws and up to 10 years in prison under others.
Start With Public Records
Public records are documents government agencies create in the ordinary course of their work: property deeds and tax assessments, court filings, marriage and divorce records, birth and death certificates, business filings, professional licenses, and voter registration data. With limited exceptions, anyone can request them.
The practical experience is uneven. Some records sit in free online portals. Others require a trip to a clerk’s office, a written request, and per-page copy fees. Certified copies of vital records typically run $10 to $25.
A basic internet search using the person’s full name and location is a reasonable first pass. Public social media content is fair game; anything behind privacy settings is off-limits without permission. Beyond that, specific government sources give you the official records:
- Federal court records through PACER, which covers more than a billion documents from federal bankruptcy, civil, and criminal cases at $0.10 per page, capped at 30 pages per document, with fees waived if quarterly charges stay under $30. Judicial opinions are free. Sealed records and pre-2003 bankruptcy filings aren’t available.1Public Access to Court Electronic Records. Public Access to Court Electronic Records2United States Courts. Electronic Public Access Fee Schedule
- State and local court records, which hold criminal cases, civil lawsuits, small claims judgments, and traffic offenses. Many states have online case search portals; some counties still require in-person requests.
- Property records at the county assessor or recorder, covering ownership history, tax assessments, liens, and mortgages. Most counties have moved these online.
- Vital records held by county clerks or state vital records offices. Divorce decrees come from the clerk of the court that granted the divorce; a shorter divorce certificate may be available from the state.3USAGov. How to Get a Copy of a Divorce Decree or Certificate
- Professional license databases maintained by state boards for doctors, lawyers, contractors, real estate agents, and other regulated professions. They typically show license status, disciplinary actions, and expiration dates.
- Bankruptcy filings through PACER, which show the debtor’s listed assets, debts, and creditors. Social Security numbers, financial account numbers, and dates of birth are redacted before public access.4PACER: Federal Court Records. What Information Is Available Through PACER
Federal Laws That Set the Limits
Several federal statutes draw hard lines around what you cannot obtain without the person’s consent or a specific legal justification. They apply to individuals, not just companies, and the penalties are heavy enough that not knowing isn’t a defense worth relying on.
Fair Credit Reporting Act
The FCRA controls who can access consumer reports, including credit reports and the comprehensive background reports produced by consumer reporting agencies. A consumer reporting agency can furnish a report only for specific purposes listed in the statute: in response to a court order, with the consumer’s written consent, or to someone with a qualifying business need such as extending credit, underwriting insurance, evaluating an employment application, or reviewing an existing account.5Office of the Law Revision Counsel. 15 US Code 1681b – Permissible Purposes of Consumer Reports
Personal curiosity, checking on a date, or investigating a neighbor doesn’t qualify. If you pull a consumer report without a permissible purpose, the subject can sue for the greater of actual damages or $1,000 per violation, plus punitive damages and attorney’s fees.6Office of the Law Revision Counsel. 15 US Code 1681n – Civil Liability for Willful Noncompliance Using false pretenses to get the report is a federal crime punishable by up to two years in prison.7Office of the Law Revision Counsel. 15 US Code 1681q – Obtaining Information Under False Pretenses
Driver’s Privacy Protection Act
The DPPA bars state DMVs from releasing personal information from driver’s license and vehicle registration records except for a narrow set of permissible uses: government functions, motor vehicle safety and theft prevention, verifying information a person has already given a business, and serving court-authorized legal process.8Office of the Law Revision Counsel. 18 US Code 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records
Looking up someone’s address or license photo for a personal investigation isn’t on that list. Violations carry civil liability of at least $2,500 per violation, plus potential punitive damages and attorney’s fees.9Office of the Law Revision Counsel. 18 US Code 2724 – Civil Action
Stored Communications Act
You cannot access another person’s email, text messages, cloud storage, or other electronic communications held by a service provider without authorization. The Stored Communications Act makes intentional unauthorized access to a facility providing electronic communication service a federal crime. A first offense committed for commercial advantage or in furtherance of other criminal activity carries up to five years in prison; without those factors, a first offense can still mean up to one year.10Office of the Law Revision Counsel. 18 US Code 2701 – Unlawful Access to Stored Communications
This is where amateur investigators land in serious trouble. Logging into someone’s email, guessing a social media password, or reading private messages on a shared device can all violate this statute. Physical access to the device doesn’t make the reading legal.
Pretexting: Financial and Phone Records
Pretexting means using lies to trick someone into handing over protected information. The Gramm-Leach-Bliley Act makes it illegal to obtain customer information from a financial institution through false statements, fraudulent representations, or forged documents.11Office of the Law Revision Counsel. 15 US Code 6821 – Privacy Protection for Customer Information of Financial Institutions A separate federal statute makes it a crime to fraudulently obtain confidential phone records, with penalties of up to 10 years in prison. If the phone records are obtained in connection with stalking or domestic violence, an additional five years can be added.12Office of the Law Revision Counsel. 18 US Code 1039 – Fraud and Related Activity in Connection With Obtaining Confidential Phone Records Information
Calling a bank pretending to be someone else, or a phone carrier claiming to be a customer to get call records, is exactly what these laws were written to punish.
Medical, Tax, and Federal Agency Records
Medical records are protected by HIPAA, which gives individuals the right to access their own health information but strictly limits third-party disclosure without patient authorization.13U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information Federal agency records containing personal information are covered by the Privacy Act of 1974, which prohibits disclosure without written consent except under twelve statutory exceptions.14United States Department of Justice. Overview of the Privacy Act – 2020 Edition – Disclosures to Third Parties There is no legal path for a private citizen to obtain another person’s medical records, tax returns, or bank statements without consent or a court order.
When Legal Research Becomes Stalking
This is where most people underestimate their exposure. Federal law criminalizes using the mail, the internet, or any electronic communication service to engage in a course of conduct, with intent to kill, injure, harass, or intimidate, that places another person in reasonable fear of death or serious bodily injury or that causes or would reasonably be expected to cause substantial emotional distress. The conduct has to be a pattern, not a single incident.15Office of the Law Revision Counsel. 18 US Code 2261A – Stalking
One Google search is not stalking. But repeatedly monitoring someone’s social media, showing up at locations you discovered through public records, contacting their friends and associates, or sending messages that reference what you’ve learned can cross the line. The statute reaches surveillance conducted with intent to harass or intimidate even when the surveillance itself uses only publicly available information. Every state has its own stalking and harassment laws too, and many set a lower bar than the federal one.
Gather what you need. Evaluate it. Decide. Don’t use public data to build a pattern of contact or monitoring that would alarm a reasonable person.
Commercial Background Check Services
Dozens of companies sell reports that aggregate public records, address history, phone numbers, and criminal records. Convenient, but understand what you’re buying and what you can legally do with it.
Most consumer-facing background check websites are not FCRA-compliant by design. Their terms state that reports cannot be used for employment screening, tenant selection, insurance underwriting, or credit decisions. Using a non-compliant report for any of those purposes exposes you to FCRA liability regardless of what the site told you.16Federal Trade Commission. Background Checks – What Employers Need to Know
Personal background check services generally run from around $25 for a basic search to over $100 for a comprehensive report covering criminal records across multiple jurisdictions, civil filings, and address history. Instant database results are cheaper but less reliable than reports involving actual courthouse research, which can take several days.
When evaluating a service, look at where the data comes from. A “national criminal check” for $10 is almost certainly a single aggregated database that may be incomplete, outdated, or both. County-level searches go to the original source, cost more, and take longer.
Verifying What You Find
Treat any single source as a lead, not a conclusion. Database errors, common-name mismatches, and stale records are routine. If a criminal record surfaces in a commercial search, confirm it through the court that handled the case. If a property record shows an address, verify current residency through other public sources before drawing conclusions.
Criminal records deserve particular caution because of expungement and record sealing. When a court expunges a record, official databases remove it from public view. But private data brokers often scrape and store court records before expungement, and their databases don’t reliably update afterward. A commercial background check may show a record that has been legally erased. Using that information against someone, especially for employment or housing decisions, creates legal exposure for you and is unfair to them. The FBI’s national criminal history database also handles expungement inconsistently: individuals sometimes discover that records expunged at the state level remain at the federal level and must be challenged separately.
Online material from social media, forums, and personal websites is less reliable still. People post under aliases, accounts get hacked, profiles get impersonated, context disappears. A post that looks incriminating may be sarcasm, a quote, or fabricated by someone else. Cross-reference before giving anything weight.
Storing and Disposing of What You Collect
If you obtain consumer report information or data derived from a consumer report, federal regulations require reasonable measures to prevent unauthorized access when you dispose of it. Acceptable methods include shredding paper documents so they cannot be reconstructed, permanently erasing or destroying electronic files, and hiring a certified document destruction company. Tossing printouts in the trash or deleting files without wiping storage media doesn’t meet the standard.17eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
Even for material outside the disposal rule, keeping a detailed file on someone creates its own risk. If the investigation leads to a dispute and the subject discovers you’ve been building a dossier, the collection itself can become evidence supporting a harassment or stalking claim. Collect what you need, make your decision, and destroy what you no longer have a legitimate reason to keep.