In the US, it is perfectly legal for a private citizen or company to gather information of a crime & turn that information over to the police. The private party can not break any laws while gathering said info, but need not adhere to the strict(ish) safeguards that law enforcement must.
So when do groups like Project Vigilant go from being a private actor to being a defacto arm of law enforcement?
There’s plenty of case law on that. You’ll find it under “testing informants” or maybe “tested informants”.
On a parallel path is the “silver platter doctrine”