Is skip tracing legal?
Yes. Skip tracing — locating a person's current contact information through consumer records — is legal throughout the United States when it uses lawfully sourced data for a legitimate purpose. Collections agencies, law firms, process servers, insurers, and real-estate investors do it every day. What the law regulates is not the act of looking someone up, but *which data* you use and *what you use the result for*. Get those two right and skip tracing is routine; get them wrong and the same search can violate federal law.
What makes a skip trace legal or illegal?
Three layers of rules apply, and they stack:
- Purpose rules govern what decisions the data may feed, whoever holds it.
- Data-source rules attach to specific record types (driver records, financial data) no matter the purpose.
- Conduct rules govern what you do to the person once you've found them.
The FCRA line: locating vs deciding
The Fair Credit Reporting Act draws the most important boundary. Using consumer data to make eligibility decisions about a person — whether to extend credit, rent housing, insure, or hire them — makes the data a consumer report, which may only come from a registered consumer reporting agency under strict procedures. Employment screening, tenant screening, and background checks for hiring are all on the regulated side of that line.
Skip tracing sits on the other side: it answers *where is this person and how do I reach them*, not *should this person get something*. That's why a collections team may lawfully trace a debtor's new phone number with a non-FCRA tool, but a landlord may not use the same tool to decide on an applicant. The purpose, not the product, triggers the statute — the FCRA vs non-FCRA explainer walks through the line in detail. Informational services like CoverFi prohibit eligibility uses in their terms and require a permitted-use attestation precisely to keep every search on the lawful side.
Data-source rules: DPPA and GLBA
Two federal statutes regulate specific data sources a trace might touch:
- DPPA. Motor-vehicle records (license and registration data from DMVs) may only be used for fourteen enumerated permissible uses, and that restriction follows the data to every downstream holder. CoverFi's records are not DMV-sourced, so DPPA attestation isn't part of its flow — but any tool that does include driver data must collect one.
- GLBA. Nonpublic personal information from financial institutions may be shared for limited exceptions only. Enterprise investigative platforms that carry credit-header data operate under GLBA exceptions and vet their customers accordingly.
Data compiled from marketing files, public records, and other lawfully collected consumer sources — the basis of most skip-tracing databases, including CoverFi's — carries neither restriction, which is why such tools can be self-serve where DMV- and GLBA-fed platforms cannot.
Conduct rules: what you do with the result
Finding someone lawfully doesn't license unlawful contact:
- Harassment and stalking laws. Locating a person to stalk, harass, intimidate, or harm them is criminal everywhere. Reputable providers suppress records for people at risk and cooperate with law enforcement.
- FDCPA. Debt collectors contacting a traced debtor face strict rules — no third-party disclosure of the debt, no calls at unusual times or places, mandatory validation notices.
- TCPA and DNC. Calls and texts to traced numbers must follow the TCPA's consent, Do-Not-Call, and calling-window rules.
Is skip tracing legal in every state?
No state bans skip tracing, but state law adds texture. Some states require a private-investigator license to perform *investigative services for hire* — relevant if you trace on behalf of clients rather than for your own business. State privacy laws (California's CCPA most prominently) give residents rights to access and delete personal data held by businesses, which is why legitimate providers operate suppression and removal processes. And state mini-TCPA statutes tighten the outreach rules beyond the federal floor.
How CoverFi keeps searches on the right side
CoverFi is built to be usable only the lawful way: business accounts with a permitted-use attestation at signup and at API-key creation, terms that prohibit eligibility decisioning and any harassment use, records suppression honoring removal requests, and search results framed as leads with labeled match tiers and confidence signals — information to verify, never a verdict on a person. Search 250M+ people by name, address, phone, or email from the search page or the API, with per-lookup credit pricing and automatic refunds on zero-result searches.