OSINT Investigation in Canada: How a Profile Is Built

An OSINT investigation is the lawful collection and analysis of personal information drawn exclusively from publicly accessible sources — court records, business registries, social-media posts, and published directories — without accessing any system without authorization. Under Ontario’s Private Security and Investigative Services Act, 2005 (PSISA), gathering a subject’s digital footprint for a client constitutes investigative services and requires a valid licence.

Canadians reported $638 million in fraud losses to the Canadian Anti-Fraud Centre (CAFC) in 2024, and with only 5–10% of victims ever filing a report, the true annual toll runs into the billions. For the full picture of Canada’s online-threat landscape, see our research on cybercrime statistics Canada. This guide explains what lawful OSINT investigation includes, where the Criminal Code draws the line, how a licensed PI builds a subject profile, and what makes the resulting report usable in court.

What Is an OSINT Investigation

Open-source intelligence investigation is the lawful collection, correlation, and analysis of personal information drawn exclusively from publicly accessible sources — court records, business registries, social-media posts, domain registration data, and published directories — without accessing any system without authorization. A licensed OSINT investigator builds a subject profile from what the subject has left in the open digital record, not from any intrusion into private accounts, private communications, or restricted databases.

It does not include accessing password-protected accounts, intercepting private communications, or purchasing data from restricted brokers. Any of those methods requires separate legal authority or falls outside the bounds of lawful investigative work entirely.

Canada’s Criminal Code makes the legal boundary explicit. Section 342.1(1) makes it a criminal offence to obtain, directly or indirectly, any computer service, or to intercept any function of a computer system, without authorization — carrying up to 10 years on indictment. Criminal Code, R.S.C. 1985, c. C-46 s. 342.1 separately pairs with s. 430(1.1), which criminalises wilfully destroying, altering, or obstructing the lawful use of computer data. A licensed OSINT investigator who collects only what is publicly accessible operates entirely outside both offences.

Police-reported cybercrime reached 225.1 incidents per 100,000 Canadians in 2024 — more than double the 2018 rate — and online fraud was the most commonly reported category, accounting for 46,301 incidents that year. The scale of digital-identity deception underlying this threat landscape is precisely what lawful OSINT profiling counters: verifying who a person actually is before harm occurs. For the full statistical picture, see our research on cybercrime statistics Canada.

What Canadian Law Governs OSINT and Where the Line Is

Two sections of the Criminal Code draw the hard boundary between lawful OSINT and unlawful intrusion. Section 342.1(1) criminalises obtaining a computer service, intercepting a computer function, or trafficking in computer passwords without authorisation — carrying up to 10 years on indictment. Section 430(1.1) makes it a criminal offence to wilfully destroy or alter computer data, render it meaningless, or obstruct another person’s lawful access to it — also punishable by up to 10 years. Criminal Code s. 430(1.1) applies regardless of whether data is destroyed or merely made inaccessible.

A licensed investigator who collects public-web data, reads court records, or searches statutory registries never touches either provision. One who accesses an email account, a locked social-media profile, or any password-protected system without the account-holder’s consent crosses both.

PIPEDA — the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 — governs how a licensed investigator may handle the personal information collected during an OSINT engagement. Under PIPEDA s. 7(1)(d), an organisation may collect personal information without the subject’s knowledge or consent only when the information is publicly available AND falls within the categories specified by the Regulations Specifying Publicly Available Information, SOR/2001-7. Those five categories are: telephone-directory listings; professional or business directory entries; statutory registry records; publicly available court or tribunal records; and published materials that the individual voluntarily provided. The Office of the Privacy Commissioner of Canada confirmed in PIPEDA Report of Findings #2018-002 that public Facebook profiles do NOT qualify as “publications” within the meaning of SOR/2001-7 — meaning social-media data falling outside those five categories still requires a lawful basis beyond mere public accessibility.

Ontario’s PSISA reinforces the licensing requirement at every layer. Under s. 6 of the Act, no person may act as a private investigator or hold themselves out as one unless they hold the appropriate licence. This extends to OSINT-based profiling done for remuneration: gathering a subject’s digital footprint on behalf of a client is “investigative services” within the meaning of the Act. An unlicensed individual who conducts such work in Ontario commits an offence; under s. 45(1), an individual convicted under the Act is liable to a fine of up to $25,000, imprisonment of up to one year, or both.

What Lawful OSINT Evidence Consists Of

Lawful OSINT evidence is material derived entirely from sources that are publicly accessible without authentication. The following categories meet that standard under Canadian law:

• Court filings and tribunal records — publicly available under SOR/2001-7 s. 1(d), and accessible from provincial court registries without authentication in most jurisdictions
• Provincial business registries and federal corporate databases — statutory registry records fall within SOR/2001-7 s. 1(c); Ontario Business Registry, Corporations Canada, and PPSA filings are the primary examples
• Published news articles and public-record aggregators — qualifying as published materials under s. 1(e), provided the subject voluntarily made the information available in that form
• Social-media posts on unrestricted public settings — permissible under the OPC’s necessity-and-proportionality framework, but fact-specific: the OPC’s PIPEDA #2018-002 finding confirmed that not all public Facebook content qualifies as a “publication” under SOR/2001-7, so each source type requires independent PIPEDA analysis
• Domain-registration (WHOIS) records — publicly accessible registrar data not requiring authentication under Criminal Code s. 342.1

The OPC’s 2009 Guidance on Covert Video Surveillance in the Private Sector — the canonical PIPEDA practitioner document for PI work — establishes three cumulative tests any collection must meet: (1) a demonstrable, evidentiary need, not a mere suspicion; (2) collection for purposes a reasonable person would consider appropriate; and (3) covert collection as the least privacy-invasive means available. A licensed OSINT investigator who gathers only public-record data and documents the lawful basis for each source type satisfies all three tests by design.

How a Licensed PI Builds a Subject Profile: The OSINT Investigation Process

A licensed PI’s OSINT investigation follows a documented, repeatable sequence that mirrors the OPC’s necessity-and-proportionality framework. Each phase generates a written record that supports downstream use as admissible evidence.

1. Client intake and purpose statement — The investigator records the lawful purpose before any data collection begins. This is not a formality: under PIPEDA, the purpose for collection determines which SOR/2001-7 categories apply and limits how findings may be used after delivery.
2. Open-source enumeration — Court records (publicly available under SOR/2001-7 s. 1(d)), statutory business registries, professional directories (s. 1(b)), and publicly posted social-media content are queried. Each query is logged with the platform accessed, the search terms used, and the access conditions at the time of retrieval.
3. Cross-reference and corroboration — Each data point is checked against at least one independent public source before it enters the report. A subject’s name appearing once in a business registry is a lead; the same name confirmed in a court filing and a domain registration record is a corroborated finding.
4. Chain-of-custody documentation — URLs, access timestamps, and platform access conditions are logged for every datum so that the source of each entry in the report is traceable. This step is what converts a collection of Google searches into evidence under Canada Evidence Act ss. 31.1–31.3.
5. Report delivery — Findings are presented in a written report that identifies the source classification for each item — whether statutory registry, court record, published material, or public social-media content — and the PIPEDA basis for its collection. This structure supports downstream use by counsel and stands up to a PIPEDA access request.

Is OSINT Evidence Admissible in Canadian Court

Canadian federal courts and most provincial proceedings apply sections 31.1 to 31.3 of the Canada Evidence Act, R.S.C. 1985, c. C-5 to digital and electronic records. Admissibility turns on two questions:

• Authentication (s. 31.1): The party tendering a digital document bears the burden of proving authenticity “by evidence capable of supporting a finding that the electronic document is that which it is purported to be.” A licensed investigator’s source log — URL, access timestamp, and access conditions — provides exactly this evidence for each item in the report.
• Integrity presumption (s. 31.3): Integrity of the electronic documents system is presumed where (a) the system was operating properly at the material time, or any malfunction did not affect document integrity; (b) the adverse party recorded the document; or (c) the document was recorded by a neutral third party in the ordinary course of business. An investigator who logs system-access conditions for each collected item satisfies s. 31.3(a) by documentary record.
• Best evidence rule (s. 31.2): This section codifies the best evidence rule for electronic records. It is satisfied on proof of system integrity, or — in practical terms — by a printed record that “has been manifestly or consistently acted on, relied on or used as a record of the information.” A licensed investigator’s printed OSINT report, accompanied by the source log, meets this standard.
• Scope of ss. 31.1–31.4: These provisions do not affect any other rule of law governing admissibility. Authentication and best evidence are the only evidentiary rules the Act modifies; hearsay, privilege, and relevance remain subject to the ordinary rules.

The civil standard of proof — balance of probabilities — does not impose a higher threshold on the evidence itself, but courts examining OSINT reports in family, civil, or employment matters will scrutinise the source log for any gap that suggests the investigator accessed a non-public source. A well-documented chain of custody forecloses that challenge.

What This Means for You: When to Engage a Licensed Investigator

The cases where lawful OSINT investigation adds the most value are those where a subject’s public digital record carries real legal or safety implications: verifying an unknown online contact before a financial commitment, profiling a prospective business partner before a deal closes, or confirming the identity and background of a romantic contact before a relationship deepens.

Romance scams — which OSINT investigation directly counters by verifying the identity of an online contact before harm occurs — produced documented losses across hundreds of thousands of victims in 2024. The CAFC estimates only 5–10% of victims report, meaning the true scale of online identity deception dwarfs the official figures. For the compiled statistics on how these scams unfold and who is most at risk, see our research on romance scam statistics.

Criminal Code s. 184(1) makes it an offence to knowingly intercept a private communication using electromagnetic, acoustic, mechanical, or other devices — punishable by up to 5 years on indictment. A licensed OSINT investigator never intercepts a private communication. The entire discipline works on content the subject has already broadcast to the public. Retaining a PSISA-licensed investigator for digital profiling is not only a legal safeguard for the client; it ensures the resulting report carries the professional-licensing provenance that courts and counsel expect.

At Discreet Investigations, our PSISA-licensed investigators conduct open-source intelligence engagements under a documented source-classification protocol: every datum in a subject profile is tagged to its originating public source, access timestamp, and PIPEDA basis category before the report is assembled. This chain-of-custody approach means the resulting profile is court-usable under Canada Evidence Act ss. 31.1–31.3 and defensible to a PIPEDA access request — which is what separates a licensed investigator’s OSINT work from an amateur Google search. To discuss whether an OSINT investigation fits your situation, call +1 (888) 680-0036 or visit our social media and internet investigations page. For more on James Glanville’s investigative background and PSISA credentials, see the about James Glanville page.

Licensed · Insured · Bonded.