How to Find Professional Contact Information Ethically: A Recruiter's Guide (2026)

By Sparsh Goyal, Founder at The Cognitive. Published 2026-11-12 · Last updated 2026-11-12

• Find a candidate's contact details ethically by using sources they published for work, telling them who you are and where you found them in the first message, and stopping as soon as they say no.
• The ICO says recruiters should not search personal social media profiles even when public, GDPR Article 14 requires the source by the first message, and CAN-SPAM makes no exception for business email.
• California's CCPA has covered job candidates and business contacts since its exemptions expired on 31 December 2022, and data brokers must now process DROP deletion requests.

To find someone's professional contact information ethically, start with the details the person published for work, then a recruitment platform, then a contact finder with a lawful source, tell the person who you are and where you found them in your first message, and stop the moment they say no. Personal social media profiles, scraping extensions and harvested lists are off limits.

The stakes are real. In Gem's 2026 benchmarks, sourced candidates are nearly eight times more likely to be hired than inbound applicants, and direct sourcing delivered 11% of hires from just 2.6% of applications. Every one of those hires started with a contact detail. This guide covers where those details may come from, the rules in the UK, the EU and the US, the first message, opt-outs, and a checklist.

Disclosure: this guide is published by The Cognitive, which sells AI candidate sourcing with personal email and phone reveal. It is not legal advice. Privacy law depends on where you and the candidate are, so ask a lawyer to check your own setup.

Is it legal to find someone's professional contact information?

Yes, finding a professional's contact details is generally lawful when the source is public or properly licensed, the purpose is a relevant job, and you are open about it. The law cares most about what happens next. Three regulator lines set the frame:

• The UK Information Commissioner's Office (ICO) says it "may be reasonable to manually search for information using recruitment-based social media platforms", but that recruiters "should not search for candidates on their personal social media profiles, even when these are public-facing" (ICO, Finding candidates).
• The EU General Data Protection Regulation (GDPR) says that if you use someone's data to contact them, your notice is due "at the latest at the time of the first communication" (GDPR Article 14(3)(b)).
• In the US, the Federal Trade Commission (FTC) says the CAN-SPAM Act "makes no exception for business-to-business email" (FTC, CAN-SPAM Act: A Compliance Guide for Business).

Read together, most of the duties land on the first email, but in the UK and EU the notice clock starts when you collect the details, so do not hold a sourced list for months without writing.

What makes a contact search ethical? Five rules

An ethical, privacy-respectful contact search is one the candidate would not be surprised to hear about. That is close to the legal test too: the ICO's guidance on legitimate interests says "You must assess whether a person can reasonably expect what you intend to do," and adds, "This is an objective test" (ICO, legitimate interests). Five rules follow from it.

1. Look where the person put their work self. A portfolio, a company bio, a speaker page or a recruitment platform. Not a holiday album.
2. Have a real role in mind. A live job is a professional purpose. A list built "in case" is harder to defend.
3. Take only what the first message needs. One email address is enough. A home address or a date of birth is not part of a job approach.
4. Say where you found them. GDPR requires it in Europe, and everywhere else it is the question candidates ask first.
5. Make no easy to say, and honour it. One clear opt-out line, and a do-not-contact list the whole team respects.

A reply that starts "How did you get this address?" usually means rule one or rule four failed.

Where should a recruiter look first for contact details?

A recruiter should start with the channels the candidate chose to publish, then move to recruitment platforms, and only then to a paid contact finder. The table ranks the common sources.

The LinkedIn row deserves a note. LinkedIn lets each member choose who sees their email address: "Only visible to me", "1st-degree connections", "1st and 2nd-degree connections" or "Anyone on LinkedIn" (LinkedIn Help, Manage who can see your email address). A connections-only setting is a choice about who should hold it. For method rather than ethics, see the guides to finding candidates on LinkedIn and passive candidate sourcing.

The ICO's reasoning is about expectations. People on recruitment platforms "are reasonably likely to expect their information to be used in this way"; they are "unlikely to expect employers to obtain information about them" from personal profiles. That distinction sorts most edge cases.

What should a recruiter never do to find contact details?

A recruiter should never mine personal social media, install scraping extensions, harvest or generate addresses in bulk, or cold email a bought list.

Personal social media profiles

The ICO is direct: do not search for candidates on personal profiles "even when these are public-facing." Public is not the test; expectation is. A personal Instagram or Facebook page was published for friends, not employers. The ICO also reminds recruiters that if you "use publicly available information for your own purposes, you are a controller and are fully responsible for how you use it."

Scraping extensions

LinkedIn's Help Center says "we don't permit the use of any third party software, including 'crawlers', bots, browser plug-ins" and bans "browser extensions that scrape, modify the appearance of, or automate activity on LinkedIn's website." Anyone using one is "in violation of the User Agreement" (LinkedIn Help, Prohibited software and extensions). That is a platform rule, not a law, but it can cost a recruiter the account they source from.

Harvested or generated lists

The FTC lists "harvesting email addresses or generating them through a dictionary attack" as an aggravated violation of CAN-SPAM. A dictionary attack means generating many addresses from names and domains and mailing whatever does not bounce. Guessing one address for one person is a smaller act with the same risk: a wrong guess sends your approach to a stranger.

Bought lists for cold email

In the UK, the ICO's electronic mail guidance says the soft opt-in "does not apply to prospective customers or new contacts (eg from bought-in lists)" (ICO, electronic mail marketing). A spreadsheet with no record of where each name came from also leaves you unable to tell anyone their source.

Which rules apply where you recruit?

The rules can follow both ends of the email. An EU-based recruiter is inside the GDPR wherever the candidate lives, and a recruiter outside the EU can be inside it too when its work targets people in the EU (GDPR Article 3). A Toronto agency sourcing engineers in Berlin should plan as if the GDPR applies. In the US, the CCPA turns on whether a business does business in California and meets a threshold. The table summarises the main regimes; the sections below give the detail.

UK and EU: legitimate interest and the one-month notice

Most sourcing in Europe rests on legitimate interest, not consent. GDPR Recital 47 ties the test to a person's reasonable expectations "based on their relationship with the controller" (Recital 47). The ICO turns it into three questions:

• Purpose: "Do you have a legitimate interest for using the personal information?"
• Necessity: "Is your use of personal information necessary for that purpose?"
• Balancing: "Do the person's interests, rights or freedoms override the legitimate interest you've identified?"

A live role, a narrow search and a professional source usually pass. A permanent database of everyone in a city usually does not. Write the three answers down once per search type.

Under Article 14, when the data did not come from the person, you must tell them "the legitimate interests pursued" and "from which source the personal data originate," within one month at the latest, or by the first message if you contact them sooner. The ICO says the same for recruiters, and marks its finding-candidates page as under review after the Data (Use and Access) Act, so recheck it before relying on a detail.

Regulators are watching this point. In March 2026 the European Data Protection Board launched a coordinated enforcement action on transparency covering Articles 12, 13 and 14, with 25 data protection authorities taking part. And the money is real: the DLA Piper GDPR Fines and Data Breach Survey counts about EUR 1.2 billion in GDPR fines in 2025 and EUR 7.1 billion since May 2018. Lawful basis per stage, retention, access requests and vendor contracts are covered in depth in the guide to GDPR in recruiting.

UK: PECR and personal addresses

The UK's Privacy and Electronic Communications Regulations (PECR) add email rules on top of UK GDPR. The ICO says "You can email or text any corporate body," while "Sole traders and some partnerships are treated as individuals" and "you can only email or text them if they have specifically consented", unless they are existing customers under the soft opt-in, which the ICO says does not apply to new contacts. It also says "You must not disguise or conceal your identity" and "you must provide a valid contact address so they can opt out or unsubscribe."

Whether a one-to-one job email to a personal address counts as direct marketing under PECR is not settled on the ICO's email page, though its recruitment guidance says "Direct messaging on social media constitutes direct marketing and electronic mail." Treat a sourcing email as direct marketing: real identity, a working opt-out and a do-not-contact list. If your UK volume is high, put this question to a lawyer.

US: CAN-SPAM

CAN-SPAM is an opt-out law, so it needs no permission before the first email. It covers messages promoting "a commercial product or service," and treats content about "an employment relationship" as relationship content. A one-to-one job approach to a stranger is neither clearly one nor the other, since no employment relationship exists yet. An agency email selling its services to employers is plainly commercial.

Because the line is unclear, follow the FTC's requirements on every sourcing email: an accurate sender and subject, a valid postal address, a clear opt-out honoured within 10 business days and still working 30 days after sending. You stay responsible for email others send for you, and the FTC's guide lists penalties of up to $53,088 for each email in violation.

US: California's CCPA and the Delete Act

The California Consumer Privacy Act (CCPA) applies to for-profit businesses that do business in California and meet any one threshold, such as gross annual revenue over $25 million (the figure the Attorney General's page lists) or buying, selling or sharing the personal information of 100,000 or more California residents or households. Recruiters at covered businesses often assume candidates fall outside it. They do not: the employee and business-to-business exemptions "expired on December 31, 2022." California candidates can ask to know, delete, opt out of sale or sharing, correct, and limit the use of sensitive information.

Data brokers carry a further duty under California's Delete Act. The Delete Request and Opt-out Platform (DROP) lets a consumer, "through a single verifiable request," direct every registered data broker to delete their data, and "beginning August 1, 2026, data brokers must access the 'accessible deletion mechanism' at least once every 45 days." If you buy contact data, ask your vendor how it handles DROP. Canada, Australia and other countries have their own anti-spam laws, which this guide does not cover.

What must the first message to a sourced candidate say?

The first message to a sourced candidate must say who you are, why you are writing, where you found their details and how to say no. In Europe, GDPR Article 21(4) adds that the right to object must be "explicitly brought to the attention of the data subject" by the first communication and "presented clearly and separately from any other information" (GDPR Article 21). A line buried in a footer is unlikely to meet that.

Use this checklist on every template:

• Who you are: your name, your company, and the client if you can share it.
• Why them: one specific line about the role and their background.
• Where you found them: a recruitment platform, a conference talk, or the contact finder you used.
• Your reason in law, in Europe: a link to a privacy notice naming your legitimate interest and their rights.
• How to say no: a separate line saying they can object and will not hear from you again.
• A real address: a postal address and a reply address a person reads.

Here is a short version that covers all six points:

Hi Alex, I'm recruiting a staff data engineer for a fintech client in Berlin, and your work on streaming pipelines looks close to what they need. I found your profile on a recruitment platform and your email through a contact finder. If you are open to a 15-minute call, reply and I'll send the details. How your data is handled: [privacy notice link].

If you'd rather not hear from me, reply "no" and I won't contact you again.

The notice can live behind a link; the "how to say no" line cannot. For more wording, the recruiting email templates are written for replies, and the guide to recruiting outreach software compares the tools that send them.

What should you do when a candidate says stop or asks to be deleted?

When a candidate says stop, stop every sequence to that person at once, add them to a suppression list, and confirm in one line if they asked for a reply. Under GDPR Article 21(3), once a person objects to direct marketing, their data "shall no longer be processed for such purposes." Under CAN-SPAM, the FTC gives you 10 business days. The ethical answer is the same day.

A deletion request needs one more step. Delete the record, but keep a suppression entry so no one on your team reaches them again from a fresh search next month. If the person asks where you found them, tell them plainly.

Retention is the quieter duty. Decide how long you keep sourced people who never replied, write it down, and delete on schedule; the GDPR recruiting guide covers national guidance on periods.

How do you choose a contact finder you can defend?

A contact finder you can defend is one that can tell you where its data came from, lets people remove themselves, and does not need a scraping extension on LinkedIn. Ask any vendor five questions before you buy:

• What kinds of public and licensed sources does the data come from?
• Can a person opt out of the database, and how fast does it take effect?
• How does the vendor handle California DROP deletions?
• Does it work without a browser extension that reads LinkedIn pages?
• Can you export or delete everything held on one person, if they ask?

The vendor's answers decide what you can say in your notice. A side-by-side of the tools is in the guide to the best recruiter contact finder tools.

How The Cognitive handles contact details

The Cognitive is an AI sourcing platform that searches ~900M public profiles from a plain-English brief, then reveals contact details one person at a time.

• Reveal on demand, one person at a time. A search returns profiles, not contact details. You pick a person from the ranked results, then reveal their personal email for 4 credits, or their phone number for 12 credits.
• Charged only when found. If no value comes back, no credits are spent, and reopening a contact you already revealed is free.
• Phones on higher plans. Phone reveal is on the Sourcing Pro, Max, Business and Enterprise plans.
• Email from your own mailbox. Outreach sends from the recruiter's own mailbox, so the sender is a real, named person. A reply, an opt-out or a bounce stops the rest of the sequence, and replies are sorted by intent, opt-outs included. Outreach is on Sourcing Pro, Max, Team, Business and Enterprise.
• Privacy tools in workspace settings. Admins can look up, export and delete one person's data, choose a retention period of 6, 12, 24 or 36 months, and read an audit log. People who ask to be deleted are not contacted again from that workspace.
• No extension. Sourcing runs in the web app, with no browser plug-in on LinkedIn.

The Cognitive does not write your privacy notice, and using it does not make a process compliant on its own. You still write the first message with its source and opt-out lines. The privacy policy and the privacy and security docs describe how the product handles data.

When The Cognitive is the wrong tool

• Your candidates already applied. If inbound volume is your problem, a contact finder adds little; an applicant tracking system and a screening step matter more.
• You only reach people through InMail. The Cognitive's outreach is email. Keep LinkedIn Recruiter if InMail is how your market replies.
• You need phone numbers on a starter budget. Phone reveal starts at the Sourcing Pro plan.
• You want contact data for sales prospecting. The Cognitive is built to find candidates for open roles, not buyers for a product.

Find the person, then reach them properly Search ~900M public profiles from a plain-English brief, reveal personal emails only for the people you pick, and send from your own mailbox. Start free

The ethical contact search checklist

Run these ten checks before the first message goes out.

1. There is a live role, and this person plausibly fits it.
2. The source is one the person chose for work: their own site, a company page, a recruitment platform or a lawful contact finder.
3. No personal social media profile was used to find or judge them.
4. No scraping extension, harvested list or generated address was involved.
5. You took only what the first message needs.
6. You have written down your legitimate interest test for this kind of search, if they are in the UK or EU.
7. The message names you, your company and where you found them.
8. The opt-out line stands on its own, and a postal address is in the signature.
9. Opt-outs and deletion requests stop every sequence the same day and go on a suppression list.
10. Sourced people who never replied are deleted on a schedule you can state.

How to start: pick one open role, rewrite your first-message template against the checklist, and send it to five people before you scale it. If you want the search, the reveal and the sending in one place, create a free account; the trial includes 100 sourcing credits.

Sources

• Gem, Key takeaways from the 2026 Recruiting Benchmarks Report, 1 December.
• UK ICO, Finding candidates (employment guidance, recruitment and selection), marked under review.
• UK ICO, What is the legitimate interests basis?.
• UK ICO, Electronic mail marketing (Guide to PECR), marked under review.
• GDPR, Article 14, Article 21 and Recital 47, Regulation (EU) 2016/679.
• European Data Protection Board, CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations, 19 March 2026.
• DLA Piper, GDPR Fines and Data Breach Survey, 21 January 2026.
• US Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business, August 2023, penalties updated January 2024.
• California Attorney General, California Consumer Privacy Act (CCPA), updated 28 August 2026.
• California Privacy Protection Agency, Data brokers and the Delete Request and Opt-out Platform.
• LinkedIn Help, Prohibited software and extensions.
• LinkedIn Help, Manage who can see your email address on LinkedIn.

All posts · thecognitive.io