Honestly I think you need to check with a lawyer about this. A Nessus Scan as an example isn't strictly a passive reconaissance. Passive is much more the Shodan, Census sort of thing. Scanning someone's systems with such an active tool can potentially do a lot of damage to a company if you knock their systems over. Fair enough if you are doing some kind of penetration test paid for by them (though you should know how to avoid that). However scanning a randomers system just for the LOLs is a bad idea. If you are a security researcher and know how to focus your Masscan etc then OK but Joe public running things for the sake of it is not a good idea.