Reviewing publicly available social media is generally lawful in Massachusetts when a licensed private investigator sticks to open-source methods. The bigger risks sit elsewhere: accessing private accounts or using someone’s credentials can violate M.G.L. c.266 §120F’s unauthorized-access statute, secretly recording calls or messages tied to a social contact can trigger M.G.L. c.272 §99’s wiretap prohibition, and using findings for hiring decisions can pull in FCRA obligations.
TL;DR:
- Accessing private social media accounts or using false identities to bypass privacy settings is illegal under Massachusetts law and can lead to criminal charges or fines.
- Recording private conversations without consent during social media investigations violates wiretap laws and exposes investigators to civil liability if secret recordings are used.
- Employers and landlords must obtain written authorization and follow FCRA and CORI procedures when using social media information for employment or housing decisions to avoid legal liabilities.
- Licensed private investigators must clearly outline and adhere to lawful collection methods, demonstrate proper evidence preservation, and avoid promising illegal access or results.
- Handling personal data securely and only reviewing publicly available content are essential to comply with data breach laws and protect investigations from legal challenges.
Table of Contents
- Lawful Open-Source Research vs. Unlawful Access: the Method Matters
- Recording and Wiretap Limits Tied to Social Contacts
- Employment Screening, FCRA, and CORI Limits in Massachusetts
- What to Confirm Before Hiring a PI for Social Media Research
- Data Handling: Meeting 201 CMR and Breach-Notification Rules
- Turning Findings Into Action Without Creating Liability
- Why Law-First Methods Matter in Massachusetts Investigations
- How Hub Investigative Group Handles Social Media Research the Right Way
- Sources
- FAQ
Lawful Open-Source Research vs. Unlawful Access: the Method Matters
Massachusetts draws its legal line at the method, not the platform. Public posts, public groups, and cached or archived snapshots sit squarely on the lawful side because anyone with internet access could view the same material. The moment an investigator logs into a private account, uses someone else’s password, sends a friend request under a false identity, or scrapes content that sits behind a login wall, the calculus changes entirely.
That’s where M.G.L. c.266 §120F comes in. Massachusetts treats unauthorized computer access as a crime, with penalties that include up to 30 days in the house of correction and fines up to $1,000. State licensing rules for private investigators don’t carve out a separate exemption for social media research, so the same access rules apply whether the target is a bank server or a locked-down Instagram account, per Massachusetts State Police licensing guidance.
A quick way to sort permitted from prohibited:
- Allowed: viewing a public profile, a public group post, or a Wayback Machine snapshot of a now-deleted page.
- Prohibited: logging in with someone else’s credentials, creating a fake profile to get past a privacy wall, or continuing to access an account after being told you’re not authorized.
- Gray zone requiring caution: mutual “friend” requests made under a fictitious identity to gain access to restricted content.
Pro Tip: Ask any investigator upfront whether their methods ever require creating a fake account or friending a subject. If the answer is yes, that’s a red flag worth walking away from.
Recording and Wiretap Limits Tied to Social Contacts
Social media investigations sometimes lead to a phone call, a video chat, or a recorded voice message. That’s where Massachusetts wiretap law becomes relevant. M.G.L. c.272 §99 prohibits secretly intercepting or recording oral communications, and it allows the person recorded without consent to sue for civil damages.
A few scenarios that create real exposure:
- Recording a phone call that started because a subject responded to a social media message, without telling them they’re being recorded.
- Capturing audio during an in-person meeting arranged through a social platform.
- Using covert recording apps tied to a messaging thread to preserve “proof” of a conversation.
The safe practice is simple: never record a private conversation without consent or a court order, and keep the investigative file limited to what was posted publicly. A well-run investigation documents that only public content was reviewed, which closes off most wiretap arguments before they start.
Employment Screening, FCRA, and CORI Limits in Massachusetts
Social media research changes character the moment it feeds an employment or housing decision. The FTC has stated that compiling social media material into a report used for hiring can trigger Fair Credit Reporting Act duties, even though the underlying posts were public. Public visibility doesn’t erase the accuracy and fairness obligations that come with a consumer report.
Employers and property managers who commission this kind of screening should plan for four steps:
- Get written authorization from the applicant before ordering the report.
- Confirm the report vendor verifies identity and corroborates findings rather than presenting raw, unverified posts as fact.
- Follow FCRA adverse-action procedures, including notice and a chance to dispute, before making a final decision.
- Respect Massachusetts CORI limits under 803 CMR, which restrict how criminal-history information can be requested and used in hiring and housing.
Skipping any of these steps turns a routine background check into a legal liability, regardless of how the underlying information was collected.
What to Confirm Before Hiring a PI for Social Media Research
A short conversation before signing a contract catches most problems early. Start with licensing: Massachusetts requires private investigators to carry a state license and a surety bond, administered through the Massachusetts State Police Certification Unit. Ask for the license number and bond documentation directly; a legitimate firm will hand both over without hesitation.
Beyond licensing, confirm these items in writing:
- A description of collection methods and where the authentication line sits (public review only, no login attempts, no impersonation).
- Evidence-preservation procedures, including how screenshots, URLs, and timestamps get logged.
- Data-security practices consistent with 201 CMR, especially if the report will include personal information.
- Contract terms covering scope, deliverables, retention schedule, and FCRA-related responsibilities if the results might touch employment.
Pro Tip: If a PI promises to “get into” a private account or guarantees results that would require bypassing privacy settings, that’s a sign to find a different firm. Legitimate private investigation services in Massachusetts don’t need to break the law to deliver useful findings.
Data Handling: Meeting 201 CMR and Breach-Notification Rules
Any firm handling personal information about a Massachusetts resident, including social media findings tied to a name, must maintain a written information-security program under 201 CMR. That means secure authentication, encrypted storage, restricted access, and staff training, not just a filing cabinet with a lock.
Practical steps that satisfy this in daily operations:
- Deliver reports through encrypted channels rather than plain email attachments.
- Limit access to the file to the investigator and the client who commissioned it.
- Retain data only as long as the engagement requires, then dispose of it securely.
If a breach happens anyway, Chapter 93H requires notice to the Office of Consumer Affairs and Business Regulation and the Attorney General, with added obligations if Social Security numbers were exposed.
Turning Findings Into Action Without Creating Liability
A social media finding is a lead, not a verdict. Treat it accordingly and the risk of overreacting, or acting on bad information, drops sharply.
- Verify the account belongs to the actual subject before drawing conclusions from it.
- Log the source URL, handle, date accessed, and who reviewed the material.
- If the finding could support an adverse decision, run it through FCRA or CORI procedures rather than acting on it directly.
- Dispose of the file once the agreed retention period ends.
Pro Tip: Keep the audit trail even for findings you decide not to use. If a decision is ever challenged, the paper trail showing careful, lawful methodology protects you as much as the client.
Why Law-First Methods Matter in Massachusetts Investigations
Over two decades in Boston security and investigative work has taught one lesson that never changes: the firms that get sued or lose their license are the ones that cut corners on access methods, not the ones that move too slowly. A documented, statute-aware workflow protects the client’s case and the investigator’s livelihood at the same time. Ask for the checklist. Ask for the written methods. A firm that hesitates has already told you something.
— Derek
How Hub Investigative Group Handles Social Media Research the Right Way
Hub Investigative Group is a professional firm offering licensed investigative services with documented collection methods, ensuring clients understand how findings are obtained.
Whether you need a social media investigation tied to a due diligence review, an asset search, or background verification before an event or a hire, experienced investigators work within applicable licensing frameworks and maintain clear chain of custody on evidence gathered. Readers navigating housing decisions tied to criminal-history findings can also learn more about the legal side of criminal records and housing applications from our partners at Bigman Law.
Start by asking to see Hub’s license and bond documentation, then schedule a consultation to define the scope of your investigation. Visit the full services page to see which engagement fits your situation and get the process moving this week.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Mass
- General Law – Part IV, Title I, Chapter 266, Section 120F
- Fair Credit Reporting Act and social media: what businesses should know | FTC
FAQ
Is it legal to view someone’s public social media in Massachusetts?
Yes. Reviewing content a person has made publicly visible, including public posts, groups, and archived pages, is generally lawful for a licensed investigator conducting legitimate research. The legal risk appears only when the method shifts to logging into private accounts or bypassing authentication.
Can a private investigator get in trouble for social media research?
Only if the methods cross into unauthorized access, which M.G.L. c.266 §120F makes a crime, or secret recording, which M.G.L. c.272 §99 prohibits. Staying within open-source public review avoids both statutes.
Does FCRA apply to social media background checks?
Yes, when the findings are compiled into a report used for an employment decision, according to FTC guidance. Employers must follow accuracy, dispute, and adverse-action procedures just as they would with a traditional background check.
How do I verify a Massachusetts PI’s license before hiring one?
Ask for the license number and surety bond documentation, which every licensed investigator carries under Massachusetts State Police Certification Unit rules. A firm that can’t produce both isn’t one worth hiring.
What should a written social media investigation contract include?
It should spell out collection methods, evidence-preservation steps, data-security practices under 201 CMR, retention schedules, and FCRA responsibilities if the results might affect employment. Hub Investigative Group provides this level of documentation as part of its private investigation services.