Are Proxies Legal? What You Need to Know

Proxies themselves are legal

Using a proxy to route your traffic, protect your privacy, test from another location or collect public data is legal in the vast majority of jurisdictions. Enterprises use proxies routinely for cybersecurity research, ad verification, market research, QA and price monitoring. There is no jurisdiction in which the act of routing a request through an intermediary is itself unlawful.

The interesting questions are all downstream of that, and they are worth separating because they have different answers.

The four regimes that actually apply

Most public discussion collapses these into one question and gets a confused answer. Being clear that a scraping project can be fine under the first and a problem under the fourth is the single most useful thing to understand here.

Anti-hacking law: what hiQ actually decided

In *hiQ Labs v. LinkedIn*, the Ninth Circuit held in 2022 that the Computer Fraud and Abuse Act likely does not apply to websites open to the public. Following the Supreme Court's reasoning in *Van Buren*, the court used a gates-up-or-down analogy: the CFAA concerns access past a barrier, and a public page has no barrier to pass.

Two caveats matter and are usually omitted. It was a preliminary-injunction ruling on likelihood of success, not a final judgment on the merits. And the litigation later turned against hiQ on the basis that it had breached LinkedIn's user agreement — a contract question the CFAA holding said nothing about.

"Public" defeats the hacking claim. It does not defeat the contract claim, the copyright claim, or the privacy claim.

Contract: terms of service

Terms are the most commonly triggered regime and the least dramatic. Whether they bind you often depends on how they were presented — terms you clicked through when creating an account are far more enforceable than a link in a footer you never touched. Breaching them is a civil matter, and the usual consequence is account termination or a cease-and-desist rather than anything more serious.

Copyright and database rights

Collecting facts is generally safe; facts are not copyrightable. Reproducing substantial portions of creative content — article text, photographs, reviews as written — is a different matter. The EU adds a *sui generis* database right that can protect a substantial investment in compiling a database even where the individual entries are unprotectable.

Data protection: the one to watch

Under the GDPR, personal data does not stop being personal because it appeared on a public page. If you collect names, profiles, contact details or anything else relating to identifiable people in the EU or UK, you need a lawful basis, and you may owe those people information about what you are doing. This is where most scraping projects have real exposure, and it is almost never the part people worry about.

What depends on how you use them

• Scraping public data is broadly permitted, but can conflict with a site's terms of service.
• Automated ticket purchasing is regulated in some regions, notably under the US BOTS Act.
• Bypassing geo-restrictions or KYC may violate platform terms or, for KYC, financial regulation.
• Accessing private or protected data without authorisation is not legal anywhere, and a proxy changes nothing about that.
• Multi-accounting is a terms question on most platforms rather than a legal one — until payment or identity fraud enters the picture.

Where the IPs come from matters too

This is the provider's obligation rather than yours, but it becomes your problem if it goes wrong. Residential IPs should reach a pool because the device owner opted in knowingly, typically through a disclosed SDK or a paid bandwidth-sharing programme. Pools assembled through malware or undisclosed bundling have drawn regulatory attention, and buying from one means your traffic is routed through devices whose owners never agreed to it.

Ask before you buy: how do devices join the pool, and can an exit be shared with another customer simultaneously? A provider that cannot answer plainly has told you what you need to know.

How to stay compliant

1. 1Only collect publicly available data, and stop at anything behind a login you were not given.
2. 2Respect `robots.txt` and keep request rates proportionate to the site's capacity.
3. 3Read the terms of each platform, especially where you hold an account.
4. 4Minimise personal data. Collect what you need and nothing else; document your lawful basis if you are in scope of the GDPR.
5. 5Use ethically sourced proxies from a provider that will explain its sourcing.
6. 6Check your own jurisdiction — rules differ meaningfully between the US, EU and elsewhere.