Ethics Guide
How to Ethically Identify a Person Behind an Email Address
Reverse-email lookup is a normal sales, recruiting, and research tool — but how you use it determines whether you're respected or reported. There's a clear ethical line between legitimate professional research and surveillance, and most teams cross it by accident rather than intent.
This guide is the framework that separates the two.
Start with purpose
Relevant B2B outreach, fact-checking, journalism, recruiting, vendor diligence, and reconnecting with a known professional contact are all legitimate. Stalking, doxing, harassment, personal investigation of private individuals, and bypassing someone's stated wish to remain unfound are not — and no amount of technical capability changes that.
Use lawful data sources
Public profiles, licensed B2B datasets, company websites, conference rosters, press releases, and patent filings are fair game. Scraping LinkedIn in violation of its terms, buying leaked credential databases, paying for "private" mobile-phone leak lists, or accessing breach data for commercial use are not.
Minimize what you collect
Need a name and role to send a relevant B2B email? Don't also store phone, home address, partner's name, and personal Instagram handle. Collect what you'll actually use for the stated purpose. "We collected it because we could" is not an ethical posture — it's a breach waiting to be relevant.
Be transparent on first contact
Mention briefly where you got the address ("public LinkedIn", "your company's website", "business contact database"), identify yourself and your company clearly, state your purpose in one line, and give a one-click opt-out. This satisfies most jurisdictions and — more importantly — most humans.
Honor opt-outs across every channel, forever
One global suppression list across every campaign, list, team, and tool. If someone says no, never email them again — not from a different list, not next quarter, not from a new domain, not from a different team member. Re-emailing someone who unsubscribed is the single biggest ethical and operational failure in outbound.
Apply a relevance test
Before you send: would this email be useful to this person, or only to you? Would a reasonable person in their seat thank you for sending it, or feel intruded upon? If you can't answer "useful to them" with a straight face, don't send it. Volume is not relevance.
Treat private individuals differently
For B2B, professional context creates a reasonable expectation of contact. For private individuals, the bar is much higher — the purpose must clearly justify the intrusion (journalism in the public interest, legal proceedings, reconnecting with a known person). Marketing is not such a purpose.
Don't combine sources to create a profile you couldn't otherwise build
One field of data from a public source is research. Twenty fields combined into a unified profile sold or stored without disclosure can be data brokerage — which is regulated in California and Vermont and increasingly scrutinized everywhere. Combination changes the ethics, not just the volume.
Choose tools that share your ethics
HuntMeLeads sources from licensed and public data, automates opt-outs across every customer simultaneously, registers as a data broker where required, and offers a DPA. The platform you use is part of your ethical footprint — picking a tool that respects subjects is half the work.
When in doubt, ask
If you're unsure whether contacting a specific person is appropriate, ask a colleague to read the situation. Five minutes of "would this be weird?" prevents most of the cases that end badly.
Frequently asked questions
What makes a lookup 'ethical'?
It uses publicly available or licensed data, respects opt-outs, doesn't deceive the subject, and serves a legitimate purpose — usually relevant business outreach, journalism, recruiting, or due diligence.
What crosses the line?
Aggregating personal accounts of private individuals, scraping platforms in violation of their terms, ignoring deletion requests, doxing, harassment, or using the data to bypass someone's stated wish to remain unfound.
Does the subject's consent matter?
Under GDPR you need a documented lawful basis — often legitimate interest for B2B. Under CASL, implied or express consent. In all regimes, honoring opt-outs is non-negotiable.
Is identifying a private individual ever OK?
Sometimes — for journalism, legal proceedings, or reconnecting with a known person. The bar is much higher than for B2B and you should think hard about whether the purpose justifies the intrusion.
What if the person publicly shared the email themselves?
Public sharing creates a reasonable expectation that the address can be found — but doesn't grant unlimited use. Outreach should still be relevant, identified, and easy to opt out of.