Are Proxies Legal? What Buyers Need to Know

A proxy is a relay. Routing your traffic through someone else's server is no more illegal than routing it through a VPN, a CDN, or your employer's corporate egress gateway. Each of those is the same mechanism wearing a different label.

Notice the pattern. Nothing in the left column becomes legal or illegal because a proxy is involved. The proxy changes who can see you, not what you are allowed to do. Any vendor selling on the promise that proxies put you outside the law is telling you something false about their own product.

Treat these as four separate compliance workstreams. Different owners, different enforcers, different fixes.

Most buyers evaluate only the first row, then get surprised by the third or fourth. The access-method question is the one that has actually softened in recent years. The data and sourcing questions have hardened.

For the operational side of the first two rows, our write-up on ethical scraping and rate limiting covers request pacing, robots handling, and the identification practices that keep you off a site's abuse radar in the first place.

Three US decisions define the current position. All are checkable in the public record.

Van Buren v. United States, decided by the Supreme Court on 3 June 2021, narrowed the CFAA's "exceeds authorized access" clause to what the Court described as a gates-up-or-down inquiry. If a gate is open to you, using what sits behind it for a purpose the owner dislikes is not a federal computer crime. That killed the old theory that violating a website's terms of use was automatically a CFAA offence.

hiQ Labs v. LinkedIn is the case people cite and misremember. The Ninth Circuit, in its April 2022 opinion after remand in light of Van Buren, held that scraping publicly available profile data likely does not amount to access "without authorization" under the CFAA. That is the part everyone quotes. The part they skip: later in 2022 the district court found hiQ had breached LinkedIn's User Agreement, and the matter resolved with hiQ subject to an injunction. hiQ won the computer crime argument and lost the contract argument. If you take one thing from this section, take that.

Meta Platforms v. Bright Data (Northern District of California, order issued 23 January 2024) went the scraper's way on contract. The court granted Bright Data summary judgment on Meta's breach-of-contract claims covering public data collected while logged out, reasoning that the terms did not bind a party that was not logged into an account at the time of collection.

Read the three together and a clean operating rule falls out:

• Logged out, publicly reachable, no account ever created: the weakest possible claim against you.
• Logged in under terms you accepted: the contract binds you, and the analysis changes completely.

That is why serious data teams keep a hard wall between logged-out collection and anything requiring credentials. If a project genuinely needs authenticated access, read how to scrape websites behind a login with the legal side in mind, because that is precisely the boundary where liability starts.

One more data point worth tracking rather than relying on: a Delaware jury returned a verdict for Ryanair on a CFAA claim against Booking.com in July 2024, in a dispute involving automated bookings placed through the airline's account flow. Verdicts like that draw post-trial motions and appeals, so check the current posture before citing it. The direction it points is consistent with everything above.

Computer crime cases produce injunctions. Data protection regulators produce invoices.

If you collect data identifying EU or UK residents, GDPR applies regardless of where your servers or your proxies sit. Two obligations catch scrapers repeatedly:

• A lawful basis. Most commercial collection leans on legitimate interests under Article 6(1)(f), which requires a documented balancing test, not a mental note.
• Notice for indirectly collected data. Article 14 obliges you to tell people you hold their data, with narrow exemptions. Scraped datasets are indirectly collected by definition.

Clearview AI is the reference case. The Dutch data protection authority announced a 30.5 million euro fine in September 2024 over its database of scraped facial images, following penalties of 20 million euros each from regulators in France, Italy and Greece in 2021 and 2022. The company was not hacking anything. It was collecting public images at scale and building a searchable index of identifiable people.

The practical control is boring and effective: strip personal data at ingestion. If your product needs prices, stock levels and shipping times, discard names, avatars, review authorship and free-text fields before anything reaches storage. A pipeline that never persists personal data is out of scope for the entire regime. Teams building AI training corpora face a sharper version of the same question, because model weights are much harder to unwind than a database row.

In California, CCPA and CPRA reach personal information about California residents on similar logic, with a different enforcement style and a private right of action attached to certain breaches.

A handful of jurisdictions regulate anonymising services directly. The rules generally target circumventing state censorship rather than corporate data collection, but that distinction may not help you if your traffic terminates inside those borders.

Two things follow for a buyer. First, if you geo-target one of these markets, check with counsel in that market rather than reading a vendor's marketing page. Second, ask whether your provider even offers exits in the country you need, and how it sources them, because the answer often explains the price.

This is the row of the risk table almost nobody checks during procurement, and it is the one that has generated the most uncomfortable headlines.

The consent chain in peer-sourced networks has a long history of going wrong. The best documented early example is Hola, found in 2015 to be reselling its free VPN users' bandwidth through its commercial arm. The pattern since has been app developers embedding a monetisation SDK for revenue, with the disclosure buried in a consent screen almost nobody reads.

Provider-level risk is not theoretical either. As of September 2026, the domain netnut.io resolves to name servers at ns1.fbi.seized.gov and ns2.fbi.seized.gov. We are not going to characterise why, and the record may develop. The buyer's lesson stands on its own: a proxy vendor can become unavailable overnight, and your production pipeline inherits that failure.

None of this makes residential pools off limits. It means the diligence bar is higher, and that for a large share of commercial work the sourcing question never arises at all. Our residential versus datacenter comparison covers where each type genuinely wins, and the honest answer for price monitoring, SERP work, uptime checks and most B2B collection is that datacenter IPs do the job at a fraction of the cost with a far simpler provenance story.

Log retention belongs in the same conversation. A provider keeping detailed request logs holds a record of your business activity that can be subpoenaed or breached. Zero-log proxy policies explains what those claims mean and how to test them rather than take them on faith.

The bottom row is not a formality. Acceptable use enforcement is how providers stay in business, and getting cut off mid-quarter is a real operational risk that has nothing to do with courts. Market research and data collection sits comfortably in the middle tiers when it is scoped to public, non-personal data.

Send these to sales in writing. Keep the reply.

The fourth question is the counterintuitive one. Buyers often see verification as friction. It is the clearest available signal of who else shares your exit IPs. A provider that verifies nobody is a provider whose pool includes people you would rather not share reputation with, and their behaviour becomes your block rate. Our guide on evaluating a residential or datacenter proxy service turns these into a scored procurement checklist.

Two things about the commercial structure matter for compliance, and both are easy to check before you buy.

The first is provenance. SparkProxy runs datacenter and ISP infrastructure: over 1 million datacenter IPs across 80 or more countries, including more than 50,000 US datacenter IPs, with egress through gateway.sparkproxy.io on port 11000 for HTTP and HTTPS, 11002 for sticky sessions, and 13000 for SOCKS5. No consumer handset sits in that path, so the third-party consent question from the sourcing table does not arise.

The second is billing shape. Per-gigabyte billing creates a quiet incentive to collect in bigger, less careful batches, because every extra request costs money. Flat, unlimited-bandwidth plans let you build in the safety margins compliance actually wants: conservative rate limits, retries, validation passes, and throwing away data you decided you should not keep.

All four carry unlimited bandwidth and 30 days validity. Higher tiers (Pro at 1500 threads, Pro+ at 2000) exist under the fair usage policy without published prices, so ask sales rather than assuming a number. The speed figures are ceilings under that policy, not guaranteed throughput. Whitelist slots matter more than they look during a security review, because IP whitelisting is what stops a leaked credential from becoming somebody else's proxy access.

If you would rather not run proxy plumbing at all, the SparkProxy Scraping API handles rotation, retries and rendering behind one endpoint: 1,000 free credits with no card, then Starter at $49 for 250,000 credits per month with 50 concurrent requests, Growth at $99 for 1,000,000, Pro at $249 for 3,000,000, and Scale at $599 for 8,000,000 with 400 concurrent. A plain fetch costs 1 credit, JavaScript rendering 5, a screenshot or PDF 10. The compliance argument for it is narrow but real: request logging and rate control live in one auditable place instead of scattered across ten scrapers.

1. Write down, per target, whether collection happens logged out. Anything needing credentials goes to counsel before the next sprint.
2. Grep your codebase for stored credentials pointing at third-party sites. That is your CFAA exposure in one command.
3. Inventory the personal data your pipeline persists. Delete the fields nobody uses. Most teams find at least one.
4. Record a lawful basis and a retention period for whatever survives step 3.
5. Read your provider's acceptable use policy end to end, and confirm your use case is listed as permitted rather than merely not prohibited.
6. Ask the five diligence questions above in writing, and file the answers with your vendor record.
7. Set request pacing a target's operations team would consider polite. That is a legal control as much as an engineering one, because "we hammered the site" is the fact that turns a contract dispute into a damages claim.
8. Name an internal owner. Compliance that belongs to everybody belongs to nobody.

A plain-language background on what web scraping is helps if you are bringing non-technical stakeholders into this conversation, which you should.