A private investigator says he was paid by a British tabloid to investigate Meghan, the Duchess of Sussex, at the beginning of her relationship with Prince Harry.
The Sun admits it paid him, but insists the newspaper didn't ask for anything unlawful.
In 2016, Meghan Markle was working as an actor on television show Suits.
Shortly after her relationship with Prince Harry was revealed, a private investigator based in California, who is now retired, was paid by The Sun to get detailed, personal information about her and her family, according to the BBC.
The private investigator believes what he then did was unlawful.
In accessing a particular one-stop database as a licensed private investigator and giving a false statement about what he was using the data for, Danno Hanks breached US federal law.
"Pretty much everything I found out, they could find out themselves using legal means with the exception of the social security numbers," Hanks - who has been a PI for decades - told the BBC.
"When you have that information it's the key to the kingdom, do you know what I mean? Especially social security numbers because you can contact any other thing, if you contact the bank, you can contact, you know, phone companies."
There is no evidence of this information being misused in this instance.
However, the BBC has seen a comprehensive report on Meghan and her family which Hanks was paid by The Sun.
Hanks said The Sun didn't ask or care how he got the information. He said his confession was prompted by the royal couple's tell-all Oprah interview.
In November 2016, Prince Harry released a statement condemning the media, saying "the past week has seen a line crossed".
In a statement to the BBC, News Group Newspapers said: "In 2016, The Sun made a legitimate request of Mr Hanks to research contact details and addresses for Meghan Markle and possible relatives using legal databases which he had a license to use. He was paid $250.
"Mr Hanks was not tasked to do anything illegal or breach any privacy laws - indeed he was instructed clearly in writing to act lawfully and he signed a legal undertaking that he would do so.
"The information he provided could not and did not raise any concerns that he had used illegal practices to obtain the information.
"At no time did The Sun request the social security number of Meghan Markle nor the information he provided for any unlawful practice."
Prince Harry has had a long, fraught relationship with Britain's tabloid press for years.
"We all know what the British press can be like, and it was destroying my mental health. I was like 'this is toxic'," he told James Corden in a recent interview.
The royal couple has sued multiple media outlets.