Searching collects information about people who never contacted you. That creates two duties — one to the websites, one to the people — and they work differently.
This lesson explains how things generally work. It is not legal advice. The rules differ by country and change often, so check anything you plan to do at scale with someone qualified where you are.
What scraping tools actually do
Most sourcing extensions work by driving a browser that is logged in as you, reading pages faster than a person could, and saving the results. Some also match profiles against other databases to attach personal email addresses and phone numbers.
Two things follow. The activity happens under your account, so the website's response lands on you, not on the tool company. And the extra contact details came from somewhere you did not choose and cannot check, which becomes your problem the moment you store them.
What the websites say
The big professional networks ban automated collection of profile data in their terms, and they enforce it. Usually by limiting or permanently closing accounts — automatically, often with no warning and no appeal. The systems that catch it look for behaviour that does not look human: too many pages, too fast, at regular intervals.
In most countries this is a business risk rather than a criminal one. But it is a real one. A blocked recruiter account in the middle of a search costs more than the tool saved, and a personal account built over ten years cannot be replaced.
Looking at public profiles yourself and copying what you need is a different activity. It is what the sites are built for.
Rules about people's data
A profile you have saved is personal data, and the duties start when you store it, not when you contact the person. Under European-style rules — and India's framework works similarly here — the practical duties are:
- A reason for holding it. Recruitment usually relies on "legitimate interest", which means you have to have actually weighed your interest against the person's rights, and be able to show that you did.
- Telling them. When you collect someone's details from somewhere other than them, you generally have to tell them — including where you got them. Usually at first contact. This is why a line in your message explaining how you found them is not just polite.
- A deletion date. Keeping people who never applied forever is hard to justify. Pick a period, apply it automatically, write it down.
- Their rights. People can ask to see, correct or delete their data, and that applies to sourced profiles exactly as it does to applicants. If you cannot find and delete one person across all your tools, you have a problem waiting to happen.
Practical rules
| Do | Avoid |
|---|---|
| Search and look at public profiles | Bulk automated downloading from sites that ban it |
| Record where each profile came from | Storing personal contact details of unknown origin |
| Say where you found them, in your first message | Calling personal phone numbers found through data brokers |
| Set a deletion date and stick to it | A permanent database of everyone ever found |
| Keep records where deletion requests can reach them | Private spreadsheets outside any process |
A simple test
Would you be comfortable telling this person exactly how you got their details? If the honest answer makes you wince, that is your answer — and it lines up closely with what the rules say, in most places, most of the time.