Ethical competitor monitoring: allowed, grey, off-limits

Short answer

Analysing what is written publicly about a competitor is normal market research, but its ethical boundary is set by three questions: is the information genuinely public, does the collection method respect the platform's and the site's rules, and how will you use it? Reading and grouping public customer reviews is acceptable. Joining closed groups with fake accounts, profiling a competitor's employees, automated collection a platform forbids, and using findings in unproven advertising against the competitor are not. This article is not legal advice; talk to a lawyer when in doubt.

Why ethics matters here

The line between competitor monitoring and espionage is drawn by rules, not by technical possibility. Today almost anything can be collected technically, but "possible" does not mean "permitted". Crossing the line creates three risks: legal (personal data and platform terms), reputational (the story of such work coming out becomes bigger news than the competitor's problem), and decision quality (information obtained covertly often cannot be verified).

Acceptable

• Reading what a competitor publishes on its own website, public social accounts and press releases.
• Reading and grouping what is written about the competitor on public forums, review sites and news comments.
• Inferring the direction of the sector from public job ads — as an inference.
• Comparing a competitor's public prices and terms.
• Doing all this within sites' robots.txt rules, request limits and terms of use.

The grey zone

• Trying a competitor's service as a customer — a real purchase, real use and an honest view are acceptable; a fake order or fake enquiry just to extract information is not.
• Hiring a competitor's former employee — normal, but not asking them to bring confidential information.
• Publishing comparison content about a competitor — when it rests on facts and verifiable information; advertising law varies from country to country.
• Collecting public profile information — seeing who wrote a post about the brand is one thing; building a separate file on that person is another.

Not acceptable

• Joining closed groups, private channels or password-protected pages with fake accounts.
• Automated collection a platform forbids. Meta's Automated Data Collection Terms, for example, accept automated collection from Facebook and Instagram only with Meta's separate written permission.
• Collecting personal profiles, contact details or information about the lives of a competitor's employees.
• Spreading false or unproven claims about a competitor, or posting ads under its complaints.
• Using collected information to agree prices or divide markets with a competitor.

What personal data law says

Azerbaijan's Law on Personal Data divides personal data into confidential and open categories. The open category includes, among other things, information the data subject has made public themselves (Article 5.3). That does not mean anything goes: an operator collecting open data must, on request, prove it belongs to the open category (8.5); the purpose of collection must be stated precisely in advance (9.1); data must be destroyed once the purpose is achieved (9.4); and special-category data — racial or national origin, family life, religious belief, health and criminal record — may be processed only in limited cases (2.1.6, 9.7). In the European Union, similar special categories are set out in Article 9 of the GDPR.

robots.txt is not permission

A site's robots.txt file tells automated visitors which pages are open to them, and following it is good practice. But the RFC 9309 standard itself states that these rules are not a form of access authorization. So a robots.txt that does not forbid a page does not grant the right to use that page's content for any purpose — the site's terms of use and copyright still apply.

How to use what you find

• For internal decisions — product, service, sales preparation: the safest use.
• To show your own advantage — with facts, without naming the competitor, or only with a verifiable comparison.
• For an open campaign against the competitor — almost always a bad idea: legal risk, and it looks weak to the audience.

Illustrative example

This is an illustrative example. A marketing manager sees "delivery is late" in a competitor's public complaints and proposes privately messaging the competitor's complaining customers with a discount. The head of monitoring stops it: that breaks both platform rules and the team's internal policy. Instead, the company states its own delivery times openly on its website and gives helpful answers to general "fast delivery" questions on forums.

An internal policy document

1. 1PurposeWhy we monitor: product, service, understanding the market.
2. 2SourcesWhich sources are allowed and which are not; closed groups and fake accounts are forbidden.
3. 3Collection methodRespect platform terms and robots.txt; formal permission for sources that require it.
4. 4RetentionHow long data is kept, who can see it, when it is deleted.
5. 5UseWhere findings may and may not be used; legal review before naming a competitor in advertising.

Who is responsible

The head of the monitoring team owns the internal policy, and the legal team reviews it once a year and whenever a new source is added. Every team member should read it, and nobody should make a grey-zone call alone. If an outside agency or contractor runs the monitoring, the same rules belong in the contract — their breach touches your reputation.

Limitations

This article describes general practice and is not legal advice. Laws, platform terms and advertising rules differ between countries and change over time; check the current texts for a specific source and use. A policy document cannot cover every case — in a new situation the safest question is "would we be embarrassed to explain this openly?"

Common mistakes

• Treating "technically possible" as "permitted".
• Treating robots.txt as access permission.
• Collecting extra information about the authors of posts.
• Privately messaging a competitor's customers.
• Having no internal policy and leaving grey-zone calls to individuals.

Boundaries in Vexvon Monitoring

Vexvon Monitoring searches only the sites you add — there is no automatic site discovery and no hidden source. When sites are crawled, robots.txt rules are followed in line with RFC 9309, and a request limit applies per domain. The AI reads each post against the brand profile and does not build a file on the author. Which sources may be monitored is decided by you, under your own internal policy. More on the Vexvon Monitoring page.

Next step

This week, write the first version of a five-part internal policy and agree it with your legal team. The practical side of competitor monitoring is in what customers say about competitors and finding new competitors; other topics are in the competitor and market monitoring section.