It’s the responsibility of the data controller (Vero’s client) to determine the legitimacy of these checks under the GDPR. However, typically consent is not relied upon. Nonetheless, we always recommend clients inform the individual that open source checks including social media will be performed.