OSINT and social media: what you post reduces your privacy, but doesn't eliminate it
"It's on the internet, so it can be used."
Few phrases better sum up the legal misunderstanding of our era.
Open-source investigation — OSINT — is today one of the most powerful tools in private investigation. Public registries, the press, corporate websites, social media, forums, and other accessible sources can provide extraordinarily valuable leads.
But what is visible is not automatically usable without limits.
The rule is more nuanced: a person who voluntarily exposes parts of their life reduces their expectation of privacy with respect to that specific content, but does not eliminate it, nor does it turn their entire digital life into fair game for investigation.
Open source doesn't mean "everything I can get my hands on"
In operational terms, an open source is one that can legitimately be accessed without breaching credentials, security measures, or access restrictions.
A public website, an open profile, or a registry lawfully accessible can form part of an investigation.
A closed profile, a private account, a restricted group, or a protected database do not become OSINT just because there is technically some way to get in.
If gaining access requires breaching a password, a security measure, or an authentication system, we are dealing with an entirely different legal reality.
And unauthorised access can generate liability, including criminal liability, depending on the specific conduct.
The semi-private profile calls for judgment
Requesting access to a restricted profile under a fictitious identity is not the same as consulting an open source.
It stops being pure OSINT and calls for a specific legal analysis of the purpose, the legitimate interest, the account holder's expectations, and the method used.
A lawful pretext — for example, presenting oneself as a customer in an open commercial context — must not be confused with an attempt to use deception to get past a barrier the user put in place precisely to restrict who could see their content.
Professional prudence lies in not turning the technical ability to reach a piece of information into a supposed legal authorisation to obtain it.
Privacy is a matter of degree on screen too
A public profile and a post deliberately put on display reduce the expectation of privacy with respect to that specific content.
An employee who publicly posts photographs of a sporting competition has chosen to expose that fact to an undefined circle of people.
But that does not mean they have given up their privacy on other matters.
Access-restricted content retains a reinforced expectation of privacy. And having hundreds of followers does not automatically turn a closed community into a space equivalent to a public thoroughfare.
Aggregation changes the problem
There is also an issue that modern digital investigation must take very seriously.
Each individual public data point may be trivial.
But mass compilation and systematic cross-referencing can produce a qualitatively new kind of knowledge about a person.
A public photograph, a corporate directorship, a historical geolocation, a news item, a professional relationship, and ten old posts, analysed separately, may seem trivial.
Together, they can reconstruct habits, networks, assets, movements, or profiles that the person never exposed as a whole.
The public availability of each individual piece does not remove the need to analyse proportionality, purpose, and minimisation when we turn them into a structured file.
From finding to evidence: four filters
1. Legal basis
Collecting, cross-referencing, and retaining personal data constitutes data processing.
The legitimate interest basis under Article 6.1(f) GDPR can be a relevant basis in many private investigations, but it must not be applied automatically or treated as the only possible answer.
Purpose, necessity, balancing of interests, and the data subject's rights all need to be analysed.
"It was public" is not, on its own, a legal basis. It is one element of the context.
2. Minimisation
Article 49.2 of Law 5/2014 requires that only information directly related to the object and purpose of the assignment be included in the report.
A person's digital trail can reveal health, political views, relationships, beliefs, or family life.
The fact that such data turns up incidentally does not mean it should be included.
Professional investigation is selective.
3. Verification
OSINT is also the natural territory of the fake account, the impersonated identity, content taken out of context, and, increasingly, images or voices generated using artificial intelligence.
A relevant finding must be verified against the original source whenever possible and documented with a date, URL, context, and preservation method.
A loose screenshot should not be the end of the investigation.
It should be the beginning of the verification.
4. Traceability
The investigator who signs the report must be able to explain in court where each piece of data came from, when it was accessed, how it was preserved, and what relationship it has to the assignment's legitimate interest.
Information on the internet changes. Pages get edited. Profiles disappear. Posts get deleted.
That is why traceability matters.
Public data can still be personal data
Another common mistake is thinking that data stops being protected by the GDPR once it is public.
That is not the case.
Personal data can be publicly accessible and still remain personal data.
Accessibility will influence the balancing test, the data subject's reasonable expectations, and certain obligations, but it does not automatically erase the data-protection framework.
The real value of OSINT: context, not snooping
Done well, OSINT is an extraordinary multiplier.
It guides fieldwork: where and when to look.
It reconstructs timelines.
It provides corporate and financial context.
It detects contradictions between what is alleged in a lawsuit and what is publicly displayed.
It identifies professional or business relationships that can later be verified through other means.
In our asset-tracing and employment files, the open source points the way; the professional investigation proves the case.
Technology points. Method proves.
AI multiplies the power, and the risk too
Artificial intelligence tools make it possible to summarise huge volumes of information, find connections, and prioritise hypotheses.
But that capability can easily turn a reasonable inquiry into excessive collection.
That is why using AI in OSINT requires an additional question: what data went into the system, under what legal basis, and for what specific outcome?
Automation does not reduce the need for proportionality. It increases it.
Conclusion
Professional OSINT does not consist of trawling the internet until you find everything that exists about a person.
It consists of locating, verifying, and contextualising whatever is legitimately relevant to a specific assignment.
What a person voluntarily publishes reduces their expectation of privacy with respect to that content.
It does not eliminate all of their rights.
And the difference between an open source and an intrusion does not lie solely in the screen we are looking at.
It lies in how we accessed it, what we then did with the data, and why doing so was necessary.
Related reading: La IA: Asedio a la privacidad — Editorial Tirant Lo Blanch
Truth has a method.