Explainer
Are residential proxies legal? It depends on three things
It depends on how the IPs were sourced, your provider's contract and what you do. What US, EU, UK, Indian and UAE sources say. Not legal advice.
None of the US, EU, UK or Indian legal texts I read makes a residential proxy illegal by itself; they target unauthorized access, damage to computers and fraud. Whether your use is legal depends on three things: how the network got its IPs, what your provider’s contract allows, and what you do with the traffic, in your country.
Every official action I found targeted the operators of proxy networks built on hijacked devices, and every criminal charge in those actions went to operators. Separately, people who used proxies while committing fraud were charged for the fraud. I found no public case charging a buyer only for buying access.
General information, not legal advice
This page summarises public documents as of November 12, 2026. No lawyer was consulted, and nothing here predicts how any case or situation would turn out. If you handle personal data, operate in the UAE, or have received a cease-and-desist letter, talk to a qualified lawyer where you are.
Short on time?
Here's my take
- What it depends on
- Sourcing, your contract, your use
- How the network got its IPs, what your provider's terms allow, and what you do with the traffic, in your country.
- Public price, ad or geo checks through a provider that vets customers
- Fine, on the sources I read
- No law or contract I read prohibits it, if you stay within the provider's acceptable-use policy and the site's rules. That's not a guarantee.
- Scraping where the site's terms forbid it, or collecting personal data
- Grey: get your specific case checked
- A terms breach is a contract issue; in the EU, IP addresses can be personal data.
- Rotating IPs to keep going after a cease-and-desist and a block
- Clearly risky
- A US court let a computer-fraud claim go ahead on those allegations in Craigslist v. 3Taps (2013, at the pleading stage).
- Fake accounts, account takeover or fraud
- Clearly risky, with or without a proxy
- The FBI lists these among criminal uses, and a defendant in a Maryland federal fraud case that used proxy servers was sentenced to 78 months.
- Sharing your own bandwidth for money
- Read your internet contract first
- Xfinity's acceptable-use policy bans running proxy services and letting people outside your home use the connection.
- Personal data, the UAE, or a cease-and-desist letter
- Ask a lawyer
- These are the cases where general information stops being enough.
Prices verified . General information, not legal advice. Sponsors cannot buy a verdict.
This page sits in the proxies hub. For the scraping side of the law, see is web scraping legal?, and for supplier questions, my ethical residential proxies checklist.
So, are they legal? #
Generally yes, as a tool, in the US, EU, UK and Indian texts I read. The clearest official signal is what the FBI’s March 12, 2026 alert doesn’t say: it lists criminal uses such as “Account Takeovers” and “Spam and Fake Account Creation” and says “Cyber threat actors use residential proxies to facilitate illicit activities”, but it never says using or operating a residential proxy is illegal (FBI PSA I-031226-PSA).
The Dutch police said much the same when they took SocksEscort offline: their release notes that not every proxy service is illegal (Politie, March 12, 2026).
Below I cover the US, the EU, the UK, India and the UAE. I didn’t research current rules in Russia or China, so I say nothing about them; if you’re there, check locally.
Three separate questions #
Most pages on this topic blur these together. Keeping them apart is what makes the answer usable.
- How did the network get its IPs? With the device owners’ informed consent, or through malware and hidden app code? This is mainly the operator’s legal problem, but it decides whose customer list you end up on.
- What does your contract allow? Your proxy provider’s acceptable-use policy (AUP) and KYC rules are usually the first rules you meet, and they’re often stricter.
- What do you do with the traffic, and where? Computer-access, fraud and data-protection laws apply to your use, and they differ by country.
What did the takedowns actually go after? #
Networks built on hijacked devices. Here are six official actions against residential proxy networks, each linked to the authority or company that acted. Charges are allegations unless the release reports a plea.
| Network | Date | Who acted | What was alleged about the IPs | What happened |
|---|---|---|---|---|
| IPStorm | Nov 14, 2023 | DOJ, D. Puerto Rico | Built with the IPStorm botnet malware | A Russian and Moldovan national pleaded guilty to operating an illegal botnet proxy service |
| 911 S5 | May 28–29, 2024 | DOJ; US Treasury | Malware on millions of residential Windows computers; Treasury says they were “compromised without the computer owners’ knowledge” | Administrator arrested May 24, 2024 and charged; Treasury sanctioned him, two associates and three Thai companies |
| Anyproxy and 5socks | May 9, 2025 | DOJ, N.D. Oklahoma | Older-model wireless routers infected “without their owners’ knowledge” | Three Russian nationals and one Kazakhstani national indicted for conspiracy and damage to protected computers; domains seized |
| IPIDEA | Jan 29, 2026 | Google (a company, not a government) | SDKs, free VPN apps that enrolled devices “without clear disclosures”, and trojanized Windows software; many apps “did not disclose” enrollment | Google says it took legal action against command and marketing domains and removed apps through Play Protect |
| SocksEscort | Mar 11–12, 2026 | DOJ, E.D. California; Dutch police | Malware on home and small-business routers; about 369,000 IPs since summer 2020 | Court-authorized seizure of “a few dozen” US domains; Dutch police report no arrests and seized customer data |
| NetNut (also called Popa) | Jul 3, 2026 | Google, “in coordination with the FBI, Lumen, and others” | SDKs on smart TVs and streaming boxes; at least 2 million devices, by Google’s estimate | Google’s report makes no legal finding; netnut.io was headed “Seized by the Federal Bureau of Investigation” on Nov 12, 2026 |
Who was charged? #
The people accused of running the networks. The Justice Department says the 911 S5 administrator was arrested “on criminal charges arising from his deployment of malware and the creation and operation of a residential proxy service” (DOJ, May 29, 2024).
The Anyproxy and 5socks indictment charges the four administrators with conspiracy and damage to protected computers for operating the services (DOJ, May 9, 2025).
The releases do talk about customers, in less flattering terms. Treasury says 911 S5’s paying users were “often cybercriminals” (Treasury), and the SocksEscort release says “Cybercriminals used the access they purchased” (IRS-CI copy of the DOJ release). The Dutch police say they seized SocksEscort’s customer data and that work to identify users is ongoing (Politie).
Proxy users do get charged for what they do through the proxy. In a federal case in Maryland, David Godin was sentenced on June 24, 2025 to 78 months after pleading guilty to wire fraud and aggravated identity theft in an unemployment-insurance scheme that used “anonymous email addresses, virtual private networks, and proxy servers” (IRS-CI). The charges were for the fraud, not for buying proxies.
Has anyone been charged just for buying access? #
I found no public case charging a buyer only for buying access. I searched for prosecutions of residential proxy customers for buying access, searched for defendants charged after using 911 S5, and read every DOJ and police release in the table above; every charge I found was against an operator or for an underlying crime such as fraud.
That’s a statement about what I found on November 12, 2026, in public sources rather than court dockets. It isn’t a rule, and the Dutch customer-data seizure shows authorities do look at who bought access.
Where do the IPs come from, and why does it matter? #
The FBI describes two routes. With consent: app SDKs that pay developers “for each person who downloads the application”, and passive-income apps. Without it: malware, compromised smart devices, sideloaded apps and TV boxes promising free content, plus free VPNs that “may enroll users’ devices … without obtaining their consent” (FBI PSA).
Google’s January 29, 2026 IPIDEA report attributes SDK, consent and reseller-opacity findings to its investigation, and says “claims of ‘ethical sourcing’ must be backed by transparent, auditable proof of user consent”. Its July 2026 NetNut report describes its own actions with reported coordination. They support asking any provider about its supplier chain; they don’t establish that every residential supplier uses malware (IPIDEA report, NetNut report).
I’d keep the FBI’s distinction rather than label all residential traffic malicious. My ethical residential proxies checklist has the questions to put to a supplier.
Your provider’s contract is the first rule you’ll meet #
Long before any statute, you meet your provider’s acceptable-use policy. Every one I read bans unlawful or fraudulent use and reserves the right to cut you off; Bright Data’s and IPRoyal’s also name fake accounts.
| Provider | Examples of what it bans | What it says it can do |
|---|---|---|
| Bright Data AUP | “Creating fake accounts or content”, “Ad fraud or click fraud”, “Use of streaming related domains”, “Collection of nonpublic information” | “will assist law enforcement in investigating potentially abusive activities”; residential zones since July 7, 2026 go “only to registered companies” after human KYC (access rules) |
| Oxylabs AUP (updated June 25, 2024) | “Circumventing user authentication or security”, ticket-buying bots, non-public or sensitive data, breaking target sites’ terms | “immediately suspend and/or terminate” on a first offense; KYC “Applies to all customers” (KYC) |
| IPRoyal AUP (v7, effective Nov 10, 2026) | Fake accounts, click fraud, phishing, targeting “non-public content without clear authorization”, reselling, dodging its ID checks | Describes some conduct as criminal under UAE law; can suspend “at any point in time and to any customer” (KYC) |
| Decodo licence (updated June 16, 2025) | “illicit, criminal or otherwise unlawful activities” | Terminate “unilaterally and immediately”; may disclose data to authorities |
Breaking an AUP is first a matter between you and the provider, which can suspend or terminate you. Whether it’s also a legal problem depends on what the act itself was, which is the next section.
What does the law say where you are? #
None of the texts I could read names residential proxies. Each asks about access, damage, fraud or personal data.
United States #
The Computer Fraud and Abuse Act makes it an offence to intentionally access a computer “without authorization” or exceed authorized access and obtain information from a protected computer, and to knowingly transmit code that “intentionally causes damage without authorization”; it also lets victims sue for “damage or loss” (18 U.S.C. §1030(a)(2)(C), (a)(5)(A), (g)).
The Supreme Court narrowed “exceeds authorized access” in Van Buren (June 3, 2021) and left a question open. Footnote 8: “we need not address whether this inquiry turns only on technological (or ‘code-based’) limitations on access, or instead also looks to limits contained in contracts or policies” (slip opinion, p. 13 n.8).
The clearest proxy-specific case I found is Craigslist v. 3Taps. Craigslist alleged that after it sent cease-and-desist letters and blocked 3Taps’ IPs, 3Taps kept scraping “by using different IP addresses and proxy servers to conceal its identity”; in April 2013 the court held that continuing after the letters and the blocking, as alleged, “constitutes unauthorized access under the statute” (942 F. Supp. 2d 962, N.D. Cal.).
In a later order on August 16, 2013, the court denied 3Taps’ renewed motion to dismiss and limited its ruling to scraping after “(1) receiving a cease-and-desist letter and (2) employing IP rotation technology to mask its identity”, saying it didn’t reach “an unsuspecting individual”. It also noted that a terms-of-use breach alone hadn’t supported the claim (order, pp. 11–12 and n.3).
Both rulings took the allegations as true at the pleading stage; they aren’t findings of liability.
European Union #
The European Commission’s guidance lists “an Internet Protocol (IP) address” among its examples of personal data (Commission). That cuts two ways: the data you collect through a proxy may be personal data, and so may the IP addresses of the people whose connections make up the pool.
I couldn’t open the GDPR text on EUR-Lex for this page, so I go no further than the Commission’s guidance. If your project touches people in the EU, that’s a question for a data-protection specialist.
United Kingdom #
Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform any function with intent to secure, or enable, access to any program or data, where that access is unauthorised and the person knows it (legislation.gov.uk).
The section doesn’t mention proxies. The questions it asks are whether access was unauthorised and whether you knew. I didn’t check its penalties or later amendments.
India #
Section 43 of the Information Technology Act 2000 covers accessing, downloading, copying or extracting data from a computer without the permission of its owner or the person in charge; section 66 makes those acts an offence when done dishonestly or fraudulently (IT Act, India Code).
I read these sections in the official text on October 16, 2026; on November 12 the PDF refused access, so I couldn’t re-check it. I found no proxy-specific provision in them.
United Arab Emirates #
The UAE’s cybercrime law is Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, issued September 20, 2021. A legal database reports that it was amended by Federal Law No. 5 of 2024, dated April 4, 2024, and that the amendment changed Article 21 (LexisNexis Middle East record).
The official UAE legislation portal refused my requests, so I didn’t read the official text and make no claim about what any article of the law says or what penalties it sets. IPRoyal’s AUP also refers to UAE criminal law. If you’re in the UAE, this is the place to go straight to a local lawyer.
| Jurisdiction | Law | What it covers | What I couldn’t verify |
|---|---|---|---|
| US | 18 U.S.C. §1030 | Access without authorization, damage, civil suits for loss | Whether contract limits count (left open in Van Buren) |
| EU | Commission guidance on the GDPR | IP addresses as personal data | The GDPR text itself (EUR-Lex refused access) |
| UK | Computer Misuse Act 1990 s.1 | Knowingly unauthorised access | Penalties and later amendments |
| India | IT Act 2000 ss.43, 66 | Access or extraction without permission; offence if dishonest or fraudulent | Re-check on Nov 12 (read Oct 16, 2026) |
| UAE | Decree-Law 34/2021 | Cybercrimes, amended in 2024 per a legal database | The official text (portal refused access) |
What about scraping with them? #
A proxy doesn’t change the scraping question. Access, terms, copyright and personal data decide it, and my web scraping legality guide covers hiQ, Van Buren, the EU rules and India in detail.
The proxy-specific point is the 3Taps pattern: using rotating IPs to keep accessing a site after it has revoked your access and blocked you. That’s the fact pattern a US court let proceed under the CFAA. A robots.txt file is a separate question again, covered in is robots.txt legally binding?.
Is it legal to share your own bandwidth? #
No law I read forbids it as such, but your internet contract may, and the app’s terms may say more than you think. The FBI says the details of these deals are “often hidden in the terms of service”, and it lists passive-income apps among the ways devices join proxy networks (FBI PSA).
Xfinity’s acceptable-use policy, effective February 1, 2021, says you may not “resell the Service or otherwise make available to anyone outside the Premises the ability to use the Service”, lists “proxy services and servers” among the servers you may not run, and limits use to “personal and non-commercial residential use” (Xfinity AUP). Other providers have their own terms; I read only Xfinity’s, so check yours.
Clearly fine, grey or clearly risky? #
Here’s where common situations sit on the sources above. “Fine” means no law or contract I read prohibits it, not a guarantee.
| Situation | Where it sits | Why | Source |
|---|---|---|---|
| Public price, ad or geo checks through a provider that vets customers and documents consent, within its AUP | Fine, on what I read | No law or contract I read prohibits it; the FBI alert doesn't call proxy use illegal | FBI PSA |
| Scraping a site whose terms forbid it | Grey | Mainly a contract question; in 3Taps, a terms breach alone did not support the computer-fraud claim | 3Taps order, Aug 2013 |
| Collecting personal data through proxies | Grey | EU guidance lists IP addresses among personal data | European Commission |
| Buying from a provider that won't say where its IPs come from | Grey | Google says sourcing claims need auditable proof of consent | Google IPIDEA report |
| Rotating IPs to keep accessing a site after a cease-and-desist and an IP block | Clearly risky | A US court let a CFAA claim proceed on those allegations | 942 F. Supp. 2d 962 |
| Fake accounts, account takeover or fraud | Clearly risky | Listed by the FBI as criminal uses; every provider contract I read bans unlawful or fraudulent use | FBI PSA |
| Buying from a network named in an official action | Clearly risky | Dutch police seized SocksEscort customer data | Politie |
| Running a proxy on a home internet plan that bans it | Clearly risky (contract) | Xfinity bans "proxy services and servers" | Xfinity AUP |
Source: The official releases, court orders, guidance and contracts linked in each row, read 12 Nov 2026. General information, not legal advice. Scroll sideways for more columns.
Which situation are you in? #
You run price, ad or SEO checks on public pages through a provider that vets customers. On the sources I read, that’s fine. Stay inside the provider’s AUP and keep a note of what you collect and why.
You scrape at scale. Read the target site’s terms, work through the scraping legality guide, and never push past a block after you’ve been told to stop.
You’ve received a cease-and-desist letter, or a site has blocked you. Stop and talk to a lawyer before rotating IPs. That’s the exact situation in 3Taps.
You handle personal data, or people in the EU. Get data-protection advice; the Commission treats IP addresses as personal data.
You’ve been offered money to share your bandwidth. Read the app’s terms and your internet contract first; Xfinity’s bans running proxy servers. My residential proxy vs VPN explainer covers how free VPNs can enroll devices without asking.
You’re in the UAE. Ask a local lawyer. I couldn’t read the law’s official text.
If you’re still choosing a provider, the proxy providers I compared for web scraping lists their terms, and free vs paid proxies explains why a free list is the riskiest option of all.
FAQ #
Are residential proxies illegal? #
Not by themselves under the US, EU, UK and Indian sources I read; those laws target unauthorized access, damage to computers and fraud. What you do with the proxy, how its IPs were obtained and your provider’s contract decide the risk. This is general information, not legal advice.
Can I get in trouble for using a residential proxy? #
Your provider can suspend or terminate your account under its terms, and some say they help law enforcement. In the official releases I read, criminal charges went to network operators and to people who committed fraud while using proxies, not to buyers only for buying access. That’s what I found, not a prediction.
Are proxies legal for web scraping? #
A proxy doesn’t change the scraping question; access, terms, copyright and personal data do. The proxy-specific risk is rotating IPs to keep going after a site has told you to stop and blocked you, as in Craigslist v. 3Taps. My web scraping legality guide covers the rest, and the AI training guide covers training data.
Are residential proxies illegal in any country? #
I didn’t find an outright ban in the US, EU, UK or Indian texts I read. I couldn’t read the official UAE text, and I didn’t research current rules in Russia or China, so check locally if you’re there.
Is it legal to sell my bandwidth? #
No law I read forbids it as such, but your internet contract may. Xfinity’s acceptable-use policy bans running ‘proxy services and servers’ and letting anyone outside your home use the connection, and the FBI warns that the details of bandwidth-sharing deals are often hidden in the terms.
Why were 911 S5 and NetNut taken down? #
The Justice Department says 911 S5’s administrator deployed malware on millions of residential Windows computers and ran a proxy service on them; those are charges, not findings. For NetNut, Google’s July 2026 report describes SDKs on smart TVs and streaming boxes, and netnut.io showed an FBI seizure notice when I checked; I didn’t establish the court order.
Does an ethical provider make my use legal? #
No. Sourcing is about how the provider got its IPs; your use is a separate question. Documented consent lowers one risk, but scraping against a site’s terms or collecting personal data stays your responsibility.
Sources
27 sources, accessed to .
Official pricing, docs, changelogs and status pages 23
- FBI PSA I-031226-PSA on residential proxy networks, 12 Mar 2026
- Van Buren v. United States, No. 19-783 (U.S. 3 Jun 2021)
- Craigslist Inc. v. 3Taps Inc., 942 F. Supp. 2d 962 (N.D. Cal. 30 Apr 2013)
- DOJ: 911 S5 botnet dismantled and its administrator arrested, 29 May 2024
- US Treasury: sanctions on the 911 S5 botnet network, 28 May 2024
- DOJ (D. Puerto Rico): IPStorm operator pleads guilty, 14 Nov 2023
- DOJ (N.D. Okla.): Anyproxy and 5socks botnet dismantled, 9 May 2025
- IRS-CI copy of the E.D. Cal. release on SocksEscort, 12 Mar 2026
- Dutch police (Politie): criminal proxy service taken offline, 12 Mar 2026
- Google Threat Intelligence: IPIDEA report, 29 Jan 2026
- Google Threat Intelligence: NetNut report, 3 Jul 2026
- IRS-CI: sentencing in a D. Md. unemployment-insurance fraud case, 24 Jun 2025
- European Commission: data protection explained
- UK Computer Misuse Act 1990, section 1
- India Information Technology Act 2000 (official India Code text)
- Xfinity Internet acceptable use policy (effective 1 Feb 2021)
- Bright Data acceptable use policy
- Bright Data residential network access rules
- Oxylabs acceptable use policy (updated 25 Jun 2024)
- Oxylabs KYC and safety
- IPRoyal acceptable use policy v7 (effective 10 Nov 2026)
- IPRoyal KYC policy
- Decodo licence agreement (updated 16 Jun 2025)
