Are Private Investigators Legal? What They Can and Cannot Do

Yes. Private investigators are legal. Problems start with the method.

Cross-border cases are where clients usually get this wrong. A U.S. lawyer, insurer, company, or private client may ask for surveillance, background research, asset tracing, or field checks in Mexico. The work may be lawful, but the evidence is collected under Mexican conditions.

We see the same starting point often: find the person, check the property, verify the company, confirm the address. Simple request. Harder execution. Records may be online in one state and in-person in another. A fact that looks obvious from the U.S. may still need local verification in Mexico.

GrayCat PI works from Mexico City, with field operations in Nuevo León and Jalisco when a file needs local checks. This is general information, not legal advice.

A lawful PI can watch someone in public. Pull court filings, corporate records, and property records. Review open social media. Interview people who agree to talk. Write a report that says what was checked and what was not confirmed.

And the limits are real. A PI cannot break into a home, open private mail, hack a phone, wiretap a call, pull a credit report without a permissible legal basis, or detain someone because a client is angry. Serious case or not, the line stays there.

Surveillance and privacy

Watching someone from a public sidewalk is legal. Recording a private phone call without the required consent, entering a building, or placing a hidden microphone inside a residence can be a crime. The line between legal surveillance and a privacy violation is the location, the method, and whether anyone consented.

U.S. wiretap law is strict. 18 U.S.C. § 2511 permits certain interceptions where a party to the communication consents, but state law can be stricter. One-party consent does not solve every recording scenario. Several states require all-party consent, and state law can add restrictions that federal law does not.

Mexico has its own data protection framework, and it changed recently. The new Federal Law on Protection of Personal Data Held by Private Parties was published on March 20, 2025. It abrogated the 2010 law and shifted federal enforcement functions previously handled by INAI into the new anti-corruption and good-government structure. Investigators and clients should verify the current text before collecting, storing, or transferring personal data.

The Código Nacional de Procedimientos Penales also recognizes privacy and personal-data protections in criminal procedure. Article 264 treats evidence obtained in violation of fundamental rights as unlawful evidence subject to exclusion or nullity.

Public social media is fair game when the content is truly public. The investigator’s own profile has to be real. No fake accounts, no pretexting into DMs, no accessing locked profiles through deception.

For most client matters, the safe rule is simple: use public information, consent-based information, lawfully obtained records, and observations from lawful locations.

Lawful surveillance has a defined scope, a documented purpose, and stopping points. Without those, observation can become harassment.

Trespassing and property access

A private investigator cannot enter a home, office, warehouse, vehicle, hotel room, gated residential area, or private land without permission or another clear legal basis. The client’s suspicion does not create a right to enter.

In the United States, trespassing can expose the investigator and client to civil or criminal consequences. It can also make evidence harder to use. Mail is a separate issue. 18 U.S.C. § 1708 covers theft or unlawful handling of mail matter, including letters and packages taken from authorized mail locations.

In Mexico, the same practical rule applies: do not enter without authorization. A closed fraccionamiento, locked building, private patio, or guarded business site is not a public observation point. If a Mexican case may enter a criminal file, the CNPP matters because Article 264 treats evidence obtained in violation of fundamental rights as unlawful evidence subject to exclusion or nullity.

Property work should rely on lawful records, field confirmation from public access points, interviews, photographs from permitted locations, and registry checks. GrayCat PI uses record searches in Mexico when a case turns on ownership, address history, corporate links, or property documentation.

Arrests and detention

PIs are not police officers. No arrest authority. No search authority. No right to interrogate or detain anyone on a private case.

In the United States, citizen’s arrest exists but varies by state and is almost never useful in private investigation. If a PI sees a crime in progress, the move is to call police and document. That is it.

Mexico uses the concept of flagrancia. Article 16 of the Mexican Constitution states that any person may detain an accused person at the moment the person is committing a crime or immediately after, and must turn the person over without delay to the nearest authority. Article 146 of the CNPP defines flagrancia for criminal procedure.

Flagrancia is narrow. Very narrow. A PI in Mexico should not detain a person because a client wants pressure, payment, a confession, or property returned. For fraud, debt, asset, or family matters, the investigator’s job is to document, trace, verify, observe, and report. Attorneys and authorities handle legal action.

Background checks and records access

Most background checks start with public records. The legal question is what happens after that.

And “background check” covers a lot of ground: identity, litigation history, property, corporate filings, employment and education claims, criminal records, sanctions lists, media, and social media.

In the United States, consumer reports are regulated. The Fair Credit Reporting Act protects information collected by consumer reporting agencies, including credit bureaus and tenant screening companies. The FTC states that consumer-report information may be provided only for purposes allowed by the Act.

In Mexico, background research often depends on fragmented sources. Some records are online. Others require in-person requests. Property registry access varies by state. Court portals vary by jurisdiction. Older addresses, informal employment, common names, and weak identifying data can make a clean match difficult.

Registry access depends on the state. Nuevo León lists online services for some public registry and cadastral procedures through the state registry portal. Jalisco’s judiciary also has online consultation systems for certain case information. Other states still require in-person requests, local follow-up, or specific authorizations. Having people on the ground in Monterrey or Guadalajara matters. A desk-only shop cannot walk into a state registry office.

A Mexican credit report should not be pulled without the subject’s authorization and a lawful basis. A PI may be able to verify public facts, locate records, check property leads, and review court history. A PI cannot lawfully obtain private banking, tax, telecom, or credit data just because a client requests it.

For remote matters, desktop investigations and OSINT can reduce cost before fieldwork. The report should separate confirmed records from leads, assumptions, and unverified matches.

Technology and digital tools

A GPS tracker does not change the law. Neither does a drone. Every digital tool a PI uses still needs a legal basis, and most of them create evidence problems when that basis is missing.

GPS is where investigators get into the most trouble. In United States v. Jones, the U.S. Supreme Court held that the government’s installation of a GPS device on a vehicle and use of that device to monitor movements was a Fourth Amendment search.

Jones was a law-enforcement case. But the reasoning applies to private work too: sticking a device on someone’s car and tracking their movements raises both privacy and property issues. Courts notice.

In Mexico, GPS tracking is a talk-to-your-lawyer situation. Not a standard PI method. Consent, ownership, purpose, data handling, and risk of harassment all matter. GPS tracking without documented consent can create personal-data and evidence-exclusion problems. If those points are not documented, the safer answer is usually no.

Drones have separate aviation and privacy concerns. Mexico regulates remotely piloted aircraft systems through AFAC and NOM-107-SCT3-2019, listed on the AFAC RPAS-Drones page. Even when a drone flight is legal under aviation rules, filming people or private property can still create privacy issues.

Digital forensics is a different problem. If a phone, laptop, email account, or cloud account is involved, the investigator should document consent, custody, access authority, and the steps used to preserve evidence. Without that record, the report may be useful for intelligence but weak for court.

What a lawful PI report should show

We send clients a report that states the scope, the dates, the records checked, and what came back. If nothing came back, that goes in too. Photographs and exhibits are included when they were lawfully obtained. Interview notes, contact attempts, and source limits are documented. Every finding should be labeled for what it is: confirmed fact, lead, assumption, or unresolved point.

Chain of custody matters when digital or physical evidence is handled. So does restraint. A report built on illegal access, vague sourcing, or unsupported conclusions can create problems later, especially when an attorney, insurer, employer, or court reviews it. The report should be useful without pretending to know more than the evidence supports.

Hiring a private investigator in Mexico

There is no Mexican equivalent of a state PI licensing board. That does not mean the work is unregulated. Privacy law, criminal procedure, tax registration, professional credentials, and local access rules can all matter. So can the difference between record research, surveillance, and uniformed security work.

Do not confuse private investigation with private security. Mexico’s Federal Private Security Law regulates private security services when they are provided in two or more states. Guarding, armed security, and protective services may trigger rules that do not apply the same way to record research or investigative reporting.

Credentials such as an SEP professional license and SAT registration can support professional identity and tax compliance. They are not the same thing as a single national PI license. For more on how PI credentials work in Mexico, see our guide on becoming a licensed private investigator in Mexico.

GrayCat PI is based in Mexico City, with field operations in Nuevo León, Jalisco, and other states as cases require.

Before you sign anything, get answers to these:

• What legal basis supports the assignment?
• What records can be checked lawfully?
• Will fieldwork require consent, access permission, or attorney review?
• How will personal data be stored and shared?
• What will the report say if a fact cannot be confirmed?
• Who handles any police report, lawsuit, demand letter, or court filing?

If the answer sounds like guaranteed recovery, secret database access, police-style authority, or “we can get anything,” walk away. A serious investigator will explain limits before taking the case.

FAQ

Are private investigators legal?

Yes, when they use lawful methods. The rest of this article explains what that means.

Can a private investigator follow someone?

Usually yes. The PI has to stay in public areas and cannot cross into harassment, trespassing, or stalking. Jurisdiction matters.

Can a private investigator access phone records?

Phone records are protected. A PI cannot get them through deception, hacking, bribery, or unauthorized access. Consent, legal authority, or a formal request through counsel is usually required.

Can a private investigator track a car?

GPS tracking is legally restricted in both the U.S. and Mexico. State laws vary. In Mexico, tracking without documented consent can create data-protection violations and evidence problems. Talk to a lawyer first.

Can a private investigator get bank records?

A PI cannot lawfully obtain private bank records without authorization or legal process. In asset tracing, a PI can often identify public property, corporate links, registry records, addresses, litigation records, and business activity, but bank records require a lawful channel.

Can private investigators arrest people?

No. Private investigators do not have police arrest powers. In Mexico, any person may detain someone only in the narrow case of flagrancia and must turn the person over without delay to the nearest authority. A PI who detains someone outside of flagrancia is committing a crime, not solving one.

Are private investigators legal in Mexico?

Yes. A PI in Mexico can use public records, observe from public locations, interview willing sources, and produce documented reports. No police powers, no special access to private data. The work is legal when the method is legal.

When to contact GrayCat PI

If you need verified facts in Mexico, contact GrayCat PI. We handle fraud, due diligence, asset tracing, record searches, surveillance, and missing-person cases across Mexico, with field teams in Mexico City, Nuevo León, and Jalisco.

We will tell you what we can check, what needs a lawyer, and what we will not do. Start with a confidential case review.

Last updated: May 21, 2026