Digital footprint
Social media and digital footprint tracing in New Zealand: what is fair collection
A phone number or username is often the strongest identifier on a stale file. What that trace can lawfully reach, and what it cannot.
Published · Reviewed
Most stale files still contain something live. The postal address has failed and the employer has changed, but the mobile number on the original application still receives messages, or an email address was used to register a trade listing three years ago. Digital footprint tracing — often described as open-source intelligence — is the work of turning that identifier into an identified person with a current contact point.
What a digital footprint enquiry actually reaches
The material is information the subject or a platform has made publicly visible: profile pages, listings, registrations, business pages, reviews, forum posts, and the account signals that link one identifier to another. A phone number entered into a marketplace listing, an email address used to register a domain, a username reused across three platforms — each is a thread, and threads that converge on the same person are the result.
What it does not reach is anything behind a login the subject controls, anything obtained by pretext, and anything a platform has restricted. Requesting access to a private profile while presenting as someone else is unlawful collection, regardless of what it produces.
Fair collection is a means test, not just a purpose test
Two conditions sit over the enquiry. The first is purpose: you need a lawful reason connected with your functions, declared before the search, not reasoned backwards after it. The second is means: the collection must be fair and not unreasonably intrusive in the circumstances. A trace to serve proceedings on a named defendant is proportionate. The same trace run because a client is curious about an ex-partner is not, and no amount of public availability fixes that.
The practical consequence is that you should be able to state, in one sentence, why each identifier was searched. If a search does not connect to the declared purpose, it should not have been run. Our note on authorised purpose under the Privacy Act 2020 sets out how to frame that declaration.
Working an identifier
Phone numbers
A mobile number is the most useful identifier on a New Zealand file, because it survives address changes and is used to verify accounts. It resolves to registrations, listings and linked accounts, and it gives you something the file can act on immediately: a live contact point.
Email addresses
Email is durable and frequently reused across personal and business contexts, which makes it the identifier most likely to link a person to an entity. Business email in particular tends to connect a person to a company record, and from there to directorships, addresses and related entities.
Usernames and aliases
A distinctive handle reused across platforms produces a strong link. Treat generic handles with suspicion — a common name plus a birth year matches thousands of people, and a wrong match here propagates into every later step of the file.
Corroborate against a dated record
Online material rarely carries a reliable date. That is its weakness. A profile may have been abandoned in 2021 and still look current. So the online result is not the answer; it is the lead that tells you which dated record to check. Take the name and locality from the digital trace, then test it against credit-linked address history, a company record, a title or a PPSR registration — records that carry a date attached to the entry. When those agree, you have a result.
The order of enquiry that does this fastest is set out in our guide to finding a current address in New Zealand.
Record what you looked at, not just what you found
A trace that produced nothing still needs a record. Note the identifier searched, the purpose it served, what was returned, and what you discarded as a non-match. Months later, the question is rarely whether the result was right. It is whether the enquiry was proportionate, and the only evidence of that is the contemporaneous note.
On intelID, digital footprint tracing runs against the same authorised-purpose declaration and the same audit log as every other source. See the integrated data sources, how tracing runs on the platform, or request access.