Is Reverse Phone Lookup Legal? What the Rules Say in the US, UK and EU

A number calls you, you do not recognise it, and you want to know who it is before you call back. Is reverse phone lookup legal? In the situation most people are in — identifying a caller who contacted them — the answer is yes, in the US, the UK and across the EU. The more useful question is narrower: which data a lookup service is allowed to hold, and what you are allowed to do with the result. That is where the rules differ, and where people occasionally get themselves into trouble.

This article is general information, not legal advice. Laws change and vary by state and country. If you are making a decision with legal consequences — hiring, renting, lending, or anything involving a dispute — speak to a qualified lawyer in your jurisdiction.

Is reverse phone lookup legal? The short answer

Searching a phone number is not, by itself, regulated in most places. Typing digits into a search engine, checking which region an area code belongs to, or asking a lookup service which carrier a number is on involves information that exists precisely so calls can be routed and identified. The legal weight falls on two other things:

• How the data was collected and is processed by the service — governed by privacy and data protection law.
• What the person running the search does with the result — governed by consumer reporting law, harassment and stalking law, and in some cases anti-discrimination law.

Keeping those two layers apart makes the rest of the picture much easier to follow.

The United States: the FCRA and permissible purpose

The US has no single federal privacy law covering phone numbers. Instead, a patchwork applies, and the most important piece for lookup users is the Fair Credit Reporting Act (FCRA).

What the FCRA covers

The FCRA regulates consumer reports — information about a person used to decide whether they get a job, an apartment, credit, insurance or certain licences. Companies that compile those reports are consumer reporting agencies, and they may only supply a report to someone with a permissible purpose defined in the Act. They also have to follow accuracy and dispute rules, and the person on the receiving end of a negative decision is entitled to be told about it.

Most people-search and reverse phone lookup websites state clearly that they are not consumer reporting agencies, and their terms forbid using results for FCRA purposes. That is not small print to skip. If you use a lookup result to screen a tenant, vet a job applicant or decide on a loan, you may be using a non-compliant report for a regulated purpose, which can expose you to liability even though the search itself was legal.

Other US rules worth knowing

• The Telephone Records and Privacy Protection Act makes it a federal crime to obtain someone's actual call records from a carrier by pretending to be them or by other fraud. A lookup service that offers detailed call logs for another person's number is a serious red flag.
• Stalking, harassment and cyberstalking laws apply at both state and federal level. Using a lookup to locate or keep contacting someone who does not want contact is where an innocent search becomes a crime.
• State privacy laws, led by California, give residents rights to see, delete and opt out of the sale of their personal information. California's Delete Act also created a central route for asking registered data brokers to delete a person's data.
• The Driver's Privacy Protection Act restricts access to motor vehicle records, so any site claiming to tie a phone number to DMV data deserves scepticism.

The UK and the EU: GDPR and lawful basis

In Europe the starting point is different. A phone number linked to an identifiable person is personal data under the GDPR, and in the UK under the UK GDPR and the Data Protection Act 2018. Anyone processing it as an organisation needs a lawful basis, has to be transparent about it, and must respect individual rights such as access, objection and erasure.

What that means for lookup services

A European service cannot simply scrape names and numbers from wherever it finds them and sell them back as a searchable database. That is why the broad people-search sites common in the US are largely absent or heavily restricted in Europe. What remains lawful is narrower:

• Numbering plan information — which country, region and network range a number belongs to. This describes the number, not the person.
• Network-level data such as line type and current carrier, which exists for routing and portability.
• Business numbers a company has chosen to publish.
• Public directory entries where the subscriber agreed to be listed. Under the ePrivacy rules, people must be told about directory listings and given the choice, and some countries add stricter rules for searching backwards from a number.
• Spam and nuisance reports, which a service may process under legitimate interests as long as it balances them against the rights of the number holder.

What it means for you as an individual

GDPR has a household exemption: purely personal activity, such as checking who rang your own phone, falls outside it. The exemption ends once you start publishing what you found, building a record on someone, or acting for a business. Posting a number and an alleged owner's name online, for example, can be processing of personal data that needs justification.

What is generally allowed

• Checking who called or texted you before you respond.
• Seeing which country, region, carrier and line type a number belongs to.
• Checking whether a number has been reported for spam or scams.
• Confirming that a business number really belongs to the business it claims to be.
• Reporting nuisance calls to regulators and to your carrier.

What is not allowed, or is risky

• Using a people-search result to make tenant, employment, credit or insurance decisions in the US, unless the provider is an FCRA-compliant consumer reporting agency.
• Tracking down, monitoring or turning up at the home of someone who has cut off contact.
• Getting someone's call or text records by pretending to be them.
• Publishing someone's personal details online to shame or pressure them.
• Running bulk lookups to build a marketing list, which runs into direct marketing and data protection rules in most jurisdictions.

How to tell whether a lookup site plays by the rules

1. 1Read the privacy policy. A legitimate service says where its data comes from, how long it keeps it, and how a person can object or ask for removal.
2. 2Look for an FCRA disclaimer on US people-search sites. Its absence on a site selling background checks is a warning sign, not a feature.
3. 3Be wary of promises that sound like surveillance: live location, call logs, message content. Those are not available lawfully to the general public.
4. 4Check that there is a real removal or privacy request process and a way to contact the operator.

WhoCallsMe sticks to the defensible layer: numbering plan data, carrier and line type, and community spam reports. We do not sell call records or location, and anyone can ask for their information to be reviewed through our privacy request page.

The practical takeaway

Looking up a number that contacted you is lawful and sensible. Where people go wrong is treating a lookup result as a background check, or as permission to pursue someone. Keep the purpose narrow, decide whether to answer, block or report, and leave regulated decisions to regulated tools.