When does OSINT cross from reconnaissance into creating actual operational risk?

Gathering publicly available information is standard practice in both offensive and defensive security. But aggregating, correlating, and weaponizing that data can expose individuals to doxxing, social engineering, or physical threats. Where do you personally draw the ethical line, and should the community establish clearer norms around OSINT tradecraft?