| Regulatory analysis |
|
Reverse lookup sites are lawful in the UK in the narrow sense that aggregating public records survived the Experian tribunal rulings. The real exposure is billing conduct, not privacy. The DMCC Act subscription rules, carrying fines up to 10 per cent of global turnover, are not expected before Spring 2027. |
The gap is a date, not a loophole
The instinctive answer to how these services are permitted is that privacy law must contain a hole. That is not what the record shows. The rules that would actually stop a trial-to-subscription lookup funnel are consumer rules rather than data protection rules, and in the United Kingdom they have been deferred twice since the governing statute received Royal Assent. Everything that follows turns on commencement dates rather than on drafting.
The Digital Markets, Competition and Consumers Act 2024 became law in May 2024. Most of the consumer provisions in Part 4, including the direct enforcement powers that let the Competition and Markets Authority determine a breach and impose a penalty without first going to court, commenced in April 2025. The chapter dealing specifically with subscription contracts did not. It requires secondary legislation, and that legislation has not been made.
|
Commencement timeline by jurisdiction and regime Filled markers are in force. Hollow markers are expected. The gold band marks the period in which UK subscription conduct rules exist in statute but are not yet operative. Marker positions are approximate to the month. UK subscription commencement is the government's stated expectation and depends on secondary legislation. Sources: DMCC Act 2024, DBT consultation response of 2 April 2026, Data (Use and Access) Act 2025, Custom Communications v FTC, California SB 362. |
| 2Deferrals of the UK subscription regime since Royal Assent in May 2024 | 13Charges a year on a 28-day billing cycle, against 12 on a true monthly one |
| £4.2mFirst CMA penalties under the direct enforcement powers, April 2026 | 14Live CMA consumer cases open by April 2026 |
The deadline moved almost as fast as the calendar
The original expectation was that the subscription regime would commence in Spring 2026. In November 2025 the Department for Business and Trade indicated to consultation respondents that it would not now arrive before autumn 2026. On 2 April 2026 the department published its response to the November 2024 consultation and set out plans for secondary legislation, with commencement now expected in Spring 2027 and the instrument to be laid when parliamentary time allows.
|
Each revision pushed the target further out than the time that had passed Roughly seventeen months separate the original target from the April 2026 response. Over the same period the commencement date moved by about twelve months, so the regime drew closer, but only just. The Act itself has been in force since 2024. Only the subscription chapter waits on secondary legislation and supporting CMA guidance on concepts such as easy exit. |
The substance of the coming regime is what makes the delay consequential. It will require pre-contract information given close in time to the point of commitment, reminder notices at defined points, a cooling-off period when a consumer becomes liable on a relevant renewal, and a straightforward route out. Breach will attract the same direct enforcement powers already in use, including penalties of up to 10 per cent of group worldwide turnover and redress orders that can require a trader to contact every affected consumer and offer cancellation with a full refund.
Until then, the applicable law is general rather than specific. The unfair commercial practices provisions, the Consumer Rights Act 2015 and the fourteen-day cancellation right under the Consumer Contracts Regulations 2013 all apply, but none is drafted around the particular design of a low-cost trial that converts silently into a recurring charge.
Privacy law is weaker here than most assume
The assumption that data protection law plainly prohibits the commercial resale of aggregated public records has been tested in the United Kingdom, and it did not hold.
|
The regulator took a data broker to tribunal over public-records processing, and lost twice The Information Commissioner issued an enforcement notice against Experian concerning marketing data on around 51 million UK adults drawn from the open electoral roll and comparable sources. The First-tier Tribunal ruled substantially in Experian's favour in February 2023, holding that a layered privacy portal satisfied the Article 14 information duty and describing the Commissioner's position as grounded in supposition rather than evidence. The Commissioner appealed. The Upper Tribunal dismissed the appeal and rejected each alleged error of law. What survived was a narrowed order to notify 5.3 million people whose data had come from certain open sources. The practical effect is that legitimate interests remains available as a lawful basis for this class of processing, and layered notice delivered through a portal can discharge the duty to tell people their data is held. That is close to the opposite of the intuitive answer, and it explains why pressure on this sector arrives through consumer law instead. |
One element did sharpen. The Data (Use and Access) Act 2025 received Royal Assent in June 2025, with most data protection provisions commencing on 5 February 2026 and the Information Commissioner's Office confirming on 19 June 2026 that all data protection provisions were in force. Penalties under the Privacy and Electronic Communications Regulations now align with UK GDPR at up to £17.5 million or 4 per cent of global annual turnover, and the previous requirement to establish substantial damage and distress has been removed, which lowers the threshold for action.
The Act's new recognised legitimate interests basis does not assist operators of this kind. It removes the balancing assessment only for a closed list of public interest purposes such as national security, crime prevention and safeguarding. Direct marketing is not on that list, so a full legitimate interests assessment continues to be required.
Who can actually make it stop
Setting the regulators side by side produces a consistent structural result. Each holds one half of the problem.
|
Every regulator has one half of the problem solved Horizontal position reflects the strength of the legal claim against an offshore lookup operator. Vertical position reflects the realistic prospect of collecting a penalty from one.
Placement is an assessment rather than a measured score. The structural point is that the regulator with the cleanest claim against an offshore operator has the weakest collection route, while the one with the strongest collection route does not yet hold the rule. |
That is not a theoretical concern. Regulators have already fined this class of business, and the findings are on the record.
|
Regulators have fined this class of business repeatedly Clearview AI is the closest analogue on the data side: a United States company with no European establishment, building a database from publicly accessible pages. Findings included absence of a lawful basis, failure to inform under Article 14 and failure to appoint a representative. The FTC action concerned TruthFinder and Instant Checkmate, held to have operated as consumer reporting agencies notwithstanding on-site disclaimers. The CMA figure relates to drip pricing and is included because it establishes the scale of penalty the direct powers produce in practice. |
The European position: strong findings, weak collection
The European Union applies the same statutory text as the United Kingdom but has enforced it very differently against offshore data collectors. The Dutch supervisory authority fined Clearview AI 30.5 million euros and issued four injunctions requiring it to stop processing European data without a lawful basis, to inform data subjects as Article 14 requires, to answer access requests and to appoint a representative under Article 27, with further penalties of up to 5.1 million euros for continued non-compliance. Authorities in France, Italy and Greece had each already imposed 20 million euro fines in 2022, and the UK regulator imposed £7.5 million in the same period.
That record is the direct rebuttal to the argument that scraping publicly accessible pages creates its own permission. It did not. The weakness is elsewhere. The privacy group noyb filed a criminal complaint with Austrian prosecutors in 2025 under Article 84 of the GDPR precisely because the European fines had gone unpaid, which is a clear statement about the distance between a finding and a recovery.
On the consumer side the European Union sits behind the United Kingdom. The Digital Fairness Act, which is intended to address dark patterns, cancellation traps and free trials that convert into paid subscriptions on passive consent, remains in Commission preparation with an indicative proposal date in the fourth quarter of 2026. Adoption is realistically a 2027 question and staggered application is generally expected across 2028 to 2030. The Commission's own consultation evidence is stark: 62 per cent of consumers reported automatic renewal of inactive subscriptions without any preceding reminder, and 44 per cent reported unintentionally paying for additional months.
The United States: no privacy statute, a definitional line instead
There is no general federal consumer privacy law, so the principal route into this sector is the Fair Credit Reporting Act, which applies where a report is used or marketed for decisions on employment, tenancy, credit or insurance. This is the reason nearly every people-search service presents an acceptance gate in which the visitor agrees the material is not a consumer report.
The gate is not decisive. In September 2023 the Federal Trade Commission required TruthFinder and Instant Checkmate to pay 5.8 million dollars, holding that they had operated as consumer reporting agencies despite those disclaimers. One detail carries directly across to any operator running broad automated search campaigns: the complaint pointed to the purchase of advertising keywords such as best background check for landlords and pre-employment screening. The advertising contradicted the disclaimer, and the advertising won.
Billing enforcement moved backwards and then partly recovered. On 8 July 2025 the Eighth Circuit vacated the Commission's Negative Option Rule in its entirety in Custom Communications v Federal Trade Commission, days before its main requirements were due to take effect, on the procedural ground that the agency had not conducted the preliminary regulatory analysis required for an economically significant rule. The Commission submitted a fresh advance notice of proposed rulemaking on 30 January 2026 with comments due on 13 April 2026, and continues to act under the Restore Online Shoppers' Confidence Act and Section 5 of the FTC Act in the meantime.
State law is where the position is genuinely changing. Under California's Delete Act, the Delete Request and Opt-out Platform has accepted consumer deletion requests since 1 January 2026, and from 1 August 2026 registered data brokers must access the platform at least once every 45 days and process verified requests. Annual registration was set at 6,000 dollars for 2026, late registration attracts 200 dollars a day, and the state agency has already imposed a 55,400 dollar penalty for failure to register.
Three countries, one customer
The reason the model persists is not that any single jurisdiction permits it. It is that the person whose data is sold, the person who pays, and the company that banks the money are frequently in three different places, and each leg is governed by a regulator with a different weakness.
|
The arbitrage is jurisdictional rather than legal Each leg of the transaction is governed separately, and no regulator holds the whole chain. Complaint asymmetry is the structural point. The party harmed by the lookup is not the party who notices, so cases route to a consumer regulator rather than a data protection one and are scored as small billing disputes. |
Three further factors compound it. No sector supervisor owns the category, because a people-search service is not a credit reference agency and therefore sits outside the Financial Conduct Authority and the credit reporting regime, and it is not a communications provider and therefore sits outside Ofcom. Acquisition is typically bought rather than earned, through automated search campaigns that place the offer in front of someone at a moment of concern, which means poor public review scores impose little commercial cost. And billing on a 28-day cycle rather than a calendar month produces thirteen charges in a year rather than twelve, a difference that is close to invisible because each individual charge looks identical to the last.
Position by jurisdiction
Scroll the table sideways on a narrow screen.
| Jurisdiction | Processing public records | Trial-to-subscription conduct | Net position |
| United Kingdom | Lawful in principle. The Experian rulings confirm legitimate interests and accept layered Article 14 notice. DUAA raised PECR penalties and removed the damage threshold. | General unfair practices rules apply and the CMA can fine directly. The specific subscription regime is deferred to Spring 2027. | Open until 2027 |
| European Union | Enforced hard against offshore collectors. Clearview drew fines in four member states plus injunctions on lawful basis, Article 14 and Article 27. | Existing directives apply unevenly. The Digital Fairness Act is not yet proposed and application is realistically 2028 onward. | Strong law, weak collection |
| United States | No general privacy statute. FCRA applies only where the report is used or marketed for employment, tenancy, credit or insurance decisions. | ROSCA and Section 5 remain available. The negative option rule was vacated in July 2025 and a fresh rulemaking began in January 2026. | Moving to the states |
| California | The Delete Act creates registration, disclosure and a single deletion route through the state platform. | State automatic renewal laws apply alongside the federal position. | Closing now |
Read across and the pattern is consistent. Nowhere is this business straightforwardly lawful and nowhere is it straightforwardly stoppable. The variable is not whether a rule exists but whether the regulator holding it can reach the bank account before the rule itself changes.
What a consumer can do now
Where an unexpected charge has been taken, the sequence that works is to cancel first and retain the confirmation, then put the complaint to the trader in writing, then approach the card issuer for a chargeback. Section 75 of the Consumer Credit Act 1974 may give an additional route on credit card purchases above £100. Reports can be made to the Competition and Markets Authority and to Trading Standards through Citizens Advice.
Where the concern is appearing on such a service rather than paying for it, the erasure right under Article 17 and the objection right under Article 21 are exercised in writing to the controller, and since 19 June 2026 there is also a right to complain directly to the controller before escalating. If there is no substantive answer within a month the matter can go to the Information Commissioner's Office. For an operator based outside the United Kingdom, the privacy notice should identify a representative appointed under Article 27, and that is the address for service. California residents can use the state deletion platform to reach all registered brokers with a single request.
Key facts
|
Related guides |
|
Disclaimer This is a factual review of the regulatory position and is not legal advice. It describes sector mechanics and does not allege unlawful conduct by any named company. Anyone with a live billing or data protection dispute should take advice and, in the first instance, contact their card issuer or the relevant regulator. |
Frequently asked questions
Is it legal to look up someone's phone number in the United Kingdom
Compiling and reselling information drawn from public records is lawful in principle. The Experian litigation confirmed that legitimate interests can support this class of processing and that a layered privacy portal can satisfy the Article 14 duty to inform people whose data was obtained indirectly. Accuracy, purpose limitation and the individual rights of erasure and objection all continue to apply.
Does UK GDPR apply to a reverse lookup site based outside the United Kingdom
Yes, where the service is directed at people in the United Kingdom. Article 3 extends the regime to controllers without a UK establishment, and Article 27 requires such a controller to appoint a representative. The practical difficulty is not jurisdiction but service and recovery, which is why cross-border cases are slow and comparatively rare.
Can a people-search site be made to delete personal details
A request can be made under Article 17 for erasure and under Article 21 to object to the processing. It should be made in writing to the controller or to its appointed representative, and the controller has one month to respond. Where there is no substantive response the matter can be raised with the Information Commissioner's Office.
What can be done about an unexpected subscription charge
Cancel and keep the confirmation, complain to the trader in writing, then ask the card issuer for a chargeback. On credit card purchases above £100, Section 75 of the Consumer Credit Act 1974 may provide an additional claim. The fourteen-day cancellation right under the Consumer Contracts Regulations 2013 may also apply depending on how the contract was formed.
When do the new UK subscription rules come into force
The subscription contracts chapter of the Digital Markets, Competition and Consumers Act 2024 requires secondary legislation. Following the government response of 2 April 2026, commencement is expected in Spring 2027, having previously been indicated for Spring 2026 and then autumn 2026.
|
Sources
|
Last reviewed 04 September 2026
