Are Proxies Legal? A Jurisdiction-by-Jurisdiction Guide for 2026
Yes, proxies are legal in virtually every jurisdiction. A proxy server is a networking tool that routes internet traffic through an intermediary server, and using one is no more inherently illegal than using a VPN, a firewall, or a web browser. What determines legality is not the proxy itself but what you do with it. Scraping publicly available data is generally legal; using proxies to commit fraud, bypass access controls you agreed not to bypass, or steal personal data is not. This guide provides jurisdiction-specific analysis so you can use proxies confidently and lawfully.
Quick Answer
**Using a proxy is legal in the United States, European Union, United Kingdom, Australia, and most Asian countries.** Proxies are standard networking tools used by businesses worldwide for security, privacy, competitive intelligence, and market research. Legality depends on the activity performed through the proxy, not the proxy itself. The main legal boundaries are: (1) do not access systems without authorization, (2) respect terms of service when they carry legal weight, (3) comply with data protection laws when handling personal information, and (4) do not use proxies for fraud, harassment, or other criminal activity. This guide covers the specific statutes and case law that define these boundaries in each major jurisdiction.
---
United States: The Computer Fraud and Abuse Act (CFAA)
The Core Statute: 18 U.S.C. Section 1030
The Computer Fraud and Abuse Act (CFAA) is the primary federal law governing unauthorized computer access in the United States. Originally enacted in 1986, the CFAA makes it illegal to "intentionally access a computer without authorization, or exceed authorized access."
**Key question for proxy users:** Does using a proxy to access a website constitute "unauthorized access"?
The hiQ v. LinkedIn Precedent (2022)
The most important case for proxy users is *hiQ Labs v. LinkedIn* (2022). The Ninth Circuit ruled that scraping publicly available data from LinkedIn did not violate the CFAA because the data was public -- no login was required, and no authentication was bypassed. The court held that the CFAA's "without authorization" language applies to accessing data behind authentication gates, not to accessing data that anyone with a web browser can see.
**Practical implication:** Accessing publicly available web pages through a proxy is not a CFAA violation. The website does not need to grant you explicit permission to view pages it makes available to the general public.
Where the CFAA Line Falls
| Activity | Likely Legal | Likely Illegal | Key Factor | |---|---|---|---| | Scraping public product prices | Yes | -- | Data is publicly visible | | Accessing pages behind a login without credentials | -- | Yes | Bypasses authentication | | Scraping after receiving a cease-and-desist | Gray area | Possible | Depends on TOS enforceability | | Using proxies for credential stuffing | -- | Yes | Unauthorized access to accounts | | Ad verification through proxies | Yes | -- | Viewing public ads | | Bypassing IP-based rate limiting | Gray area | -- | No authentication bypassed |
State-Level Laws
Several US states have their own computer access statutes that extend beyond the CFAA: - **California Comprehensive Computer Data Access and Fraud Act (Penal Code 502):** Covers unauthorized access, disruption, and data theft with both criminal and civil penalties. - **New York Penal Law 156:** Makes unauthorized computer access a class A misdemeanor, with felony charges for cases involving financial gain. - **Virginia Computer Crimes Act:** Addresses computer fraud, trespass, and invasion of privacy through computer systems.
These state laws generally follow the same principle: using a proxy is legal; using a proxy to gain unauthorized access to protected systems is not.
---
European Union: GDPR and the e-Privacy Directive
GDPR Article 6: Lawful Basis for Processing
The General Data Protection Regulation (GDPR) does not regulate proxy use directly. Instead, it governs the processing of personal data. If your proxy-based activity involves collecting, storing, or analyzing data that identifies or can identify a natural person (names, email addresses, IP addresses, behavioral profiles), you need a lawful basis under Article 6.
The six lawful bases under GDPR Article 6(1): 1. **Consent** -- The data subject has given clear consent. 2. **Contract** -- Processing is necessary for a contract with the data subject. 3. **Legal obligation** -- Processing is required by law. 4. **Vital interests** -- Processing is necessary to protect someone's life. 5. **Public task** -- Processing is necessary for official functions. 6. **Legitimate interests** -- Processing is necessary for legitimate business interests, balanced against the data subject's rights.
For most proxy use cases (price monitoring, ad verification, market research), **legitimate interests** is the applicable basis -- provided you are not collecting personal data unnecessarily and you have conducted a Legitimate Interest Assessment (LIA).
What GDPR Means for Proxy Users
| Activity | Personal Data Involved? | GDPR Impact | |---|---|---| | Scraping public product prices | No (prices are not personal data) | Minimal -- GDPR does not apply to non-personal data | | Collecting publicly visible social media profiles | Yes (names, photos, posts can identify individuals) | Full GDPR compliance required | | Ad verification (viewing ads in different regions) | No | Minimal | | Monitoring competitor websites for pricing | No | Minimal | | Scraping email addresses from business directories | Yes | Requires lawful basis and data minimization |
The e-Privacy Directive
The e-Privacy Directive (Directive 2002/58/EC) governs electronic communications, including cookies and tracking. If your proxy-based activity involves interacting with websites that set cookies, be aware that the e-Privacy Directive requires consent for non-essential cookies. This is relevant for automated browsing where cookies may be exchanged.
Key EU Case Law
- **Ryanair v. PR Aviation (CJEU, 2015):** Confirmed that terms of service can restrict scraping of non-copyrighted data (like flight prices), but enforcement varies by member state.
- **GDPR Enforcement Actions:** Regulators in France (CNIL), Italy (Garante), and Germany (BfDI) have issued fines for scraping personal data without a lawful basis, particularly in cases involving large-scale collection of social media profiles.
---
United Kingdom: Computer Misuse Act and Data Protection Act 2018
Computer Misuse Act 1990
The UK Computer Misuse Act (CMA) establishes three main offenses: 1. **Unauthorized access to computer material** (Section 1) -- Accessing a computer system without permission. 2. **Unauthorized access with intent to commit further offenses** (Section 2) -- Accessing a system with intent to commit fraud or other crimes. 3. **Unauthorized modification of computer material** (Section 3) -- Altering, deleting, or corrupting data without permission.
Using a proxy to access publicly available websites does not violate the CMA. The act targets unauthorized access -- logging into systems without permission, exploiting vulnerabilities, or bypassing security controls.
Data Protection Act 2018
The UK DPA 2018 implements GDPR-equivalent protections post-Brexit. The same principles apply: if your proxy-based activity involves processing personal data of UK residents, you need a lawful basis and must comply with data minimization, purpose limitation, and storage limitation principles.
The UK Information Commissioner's Office (ICO) has issued specific guidance on web scraping, noting that scraping publicly available personal data is still "processing" under the DPA and requires a lawful basis.
---
Australia: Privacy Act 1988 and Criminal Code
Privacy Act 1988
The Australian Privacy Act governs the handling of personal information by organizations with annual turnover above AUD $3 million (and some smaller organizations in specific sectors). The Australian Privacy Principles (APPs) require: - **Collection limitation** (APP 3): Only collect personal information that is reasonably necessary. - **Notification** (APP 5): Inform individuals about the collection of their personal information. - **Use and disclosure** (APP 6): Only use personal information for the purpose it was collected.
Criminal Code Act 1995
Part 10.7 of the Commonwealth Criminal Code addresses computer offenses: - **Section 477.1:** Unauthorized access to, or modification of, restricted data (up to 2 years imprisonment). - **Section 478.1:** Unauthorized access to, or modification of, restricted data intending to commit a serious offense (up to 5 years).
As with US and UK law, the key word is "unauthorized." Accessing public websites through a proxy is not an offense. Accessing restricted systems or data without authorization is.
---
Asia: Key Markets
Japan
Japan's Unauthorized Computer Access Law (1999, amended 2012) prohibits accessing computers without authorization by bypassing access controls. Using proxies to access public websites is legal. Japan's Act on the Protection of Personal Information (APPI) governs personal data processing with requirements similar to GDPR.
South Korea
South Korea has one of the strictest data protection regimes in Asia. The Personal Information Protection Act (PIPA) requires explicit consent for collecting personal data. The Information and Communications Network Act adds sector-specific requirements for online services. Using proxies is legal, but scraping personal data requires compliance with PIPA's consent requirements.
Singapore
Singapore's Computer Misuse Act (Chapter 50A) mirrors the UK CMA. The Personal Data Protection Act (PDPA) governs personal data with requirements for consent, purpose limitation, and data protection. Proxy use is legal; personal data collection requires compliance with the PDPA.
India
India's Information Technology Act 2000 (Section 66) addresses computer-related offenses. The Digital Personal Data Protection Act 2023 establishes data protection requirements. Using proxies is legal. The IT Act focuses on unauthorized access and data theft, not on the use of networking tools.
China
China has strict internet regulations including the Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (PIPL, 2021). Using proxies to bypass the Great Firewall is technically illegal under Chinese law. Businesses operating within China should consult local legal counsel for proxy use compliance.
---
Use-Case Legality Matrix
This matrix summarizes the general legal status of common proxy use cases across jurisdictions. "Legal" means generally permitted; "Conditional" means legal with compliance requirements; "Illegal" means generally prohibited.
| Use Case | US | EU | UK | Australia | Japan | South Korea | |---|---|---|---|---|---|---| | Scraping public pricing data | Legal | Legal | Legal | Legal | Legal | Legal | | Ad verification | Legal | Legal | Legal | Legal | Legal | Legal | | SEO monitoring (public SERPs) | Legal | Legal | Legal | Legal | Legal | Legal | | Brand protection monitoring | Legal | Legal | Legal | Legal | Legal | Legal | | Accessing geo-restricted public content | Legal | Legal | Legal | Legal | Legal | Legal | | Scraping public social media profiles | Conditional | Conditional | Conditional | Conditional | Conditional | Conditional | | Collecting personal data (emails, names) | Conditional | Conditional | Conditional | Conditional | Conditional | Conditional | | Bypassing login authentication | Illegal | Illegal | Illegal | Illegal | Illegal | Illegal | | Credential stuffing / account takeover | Illegal | Illegal | Illegal | Illegal | Illegal | Illegal | | Bypassing DRM or copyright protections | Illegal | Illegal | Illegal | Illegal | Illegal | Illegal | | Competitive intelligence (public data) | Legal | Legal | Legal | Legal | Legal | Legal |
---
The Ethical Use Framework
Legal compliance is the floor, not the ceiling. Ethical proxy use goes beyond minimum legal requirements:
1. Respect Rate Limits and Server Resources Even when scraping public data is legal, overwhelming a website with requests can cause service degradation. Use reasonable request rates, respect robots.txt as a courtesy (though it is not legally binding in most jurisdictions), and implement delays between requests.
2. Minimize Data Collection Collect only the data you need. If you need product prices, do not also scrape user reviews, profile images, and metadata. Data minimization reduces legal risk and storage costs.
3. Anonymize and Aggregate When possible, process data into aggregated, anonymized formats. Aggregated market pricing data carries virtually no legal risk; a database of individual user profiles carries significant risk.
4. Be Transparent About Your Purpose If you are building a commercial product that relies on scraped data, consider whether the data sources would reasonably object. Ethical businesses operate in the open, not in the shadows.
5. Review Terms of Service While TOS enforceability varies by jurisdiction (they are more enforceable in the EU, less in the US after hiQ v. LinkedIn), reading and understanding the terms demonstrates good faith. If a site explicitly prohibits automated access, weigh the legal risk before proceeding.
6. Secure Collected Data If you collect any data through proxies, secure it appropriately. Encrypt data at rest and in transit, implement access controls, and establish retention policies. A data breach of scraped data carries the same legal consequences as a breach of any other data.
---
Legal Checklist for Proxy Users
Before starting any proxy-based project, run through this checklist:
- [ ] **Is the target data publicly accessible?** (No login required, no paywall, no access controls)
- [ ] **Does the activity avoid bypassing authentication or security controls?**
- [ ] **If collecting personal data, do you have a lawful basis under applicable data protection law?**
- [ ] **Have you conducted a data protection impact assessment (DPIA) if processing personal data at scale?**
- [ ] **Are you implementing rate limiting to avoid overloading target servers?**
- [ ] **Have you reviewed the target website's terms of service?**
- [ ] **Do you have a data retention policy for collected data?**
- [ ] **Is collected data stored securely with appropriate access controls?**
- [ ] **Have you consulted legal counsel for activities in regulated industries (healthcare, finance)?**
- [ ] **Are you prepared to comply with data subject access requests (DSARs) if applicable?**
---
Frequently Asked Questions
Are proxies legal? Yes. Proxies are legal networking tools in the United States, European Union, United Kingdom, Australia, and most countries worldwide. They are used by businesses, governments, and individuals for security, privacy, and market research. What matters legally is not the proxy itself but the activity performed through it.
Is web scraping with proxies legal? Scraping publicly available data is generally legal in most jurisdictions. The US Ninth Circuit confirmed this in hiQ v. LinkedIn (2022). However, scraping data behind logins, bypassing access controls, or collecting personal data without a lawful basis can violate computer access laws and data protection regulations.
Do I need a lawyer to use proxies? For standard commercial use cases (price monitoring, ad verification, SEO monitoring, competitive intelligence on public data), you typically do not need legal counsel. For large-scale data collection, activities involving personal data, or operations in regulated industries, consulting a lawyer is recommended.
Can I use proxies to bypass geo-restrictions? Accessing publicly available content from different geographic locations is generally legal. However, bypassing geo-restrictions that enforce licensing agreements (streaming services, for example) may violate terms of service and could raise contractual issues.
Is it legal to use proxies for sneaker bots? Using proxies to purchase products online is generally legal. Websites may prohibit automated purchasing in their terms of service, but TOS violations are civil matters (breach of contract), not criminal offenses. No US court has held that using a sneaker bot constitutes a CFAA violation.
Does the GDPR apply to my proxy use? The GDPR applies if you process personal data of individuals in the EU/EEA, regardless of where your organization is located. If your proxy-based activity only involves non-personal data (product prices, public statistics, ad content), GDPR does not apply.
Can I get in trouble for using proxies? You can face legal consequences if you use proxies to commit illegal acts: unauthorized access to protected systems, credential stuffing, fraud, identity theft, or violating court orders. Using proxies for legitimate business purposes carries no legal risk in any major jurisdiction.
Is it illegal to scrape a website that says "no scraping" in its terms of service? It depends on the jurisdiction. In the US, after hiQ v. LinkedIn, TOS-based scraping restrictions have limited legal weight for public data. In the EU, TOS can carry more weight under unfair competition and database rights doctrines. Review local law and consider the risk-reward balance.
What is the penalty for violating the CFAA? CFAA violations carry penalties of up to 5-20 years imprisonment for criminal cases and uncapped damages in civil cases. However, CFAA criminal prosecutions for web scraping are virtually unheard of -- the statute is primarily used against hackers, not data collectors.
Do proxy providers keep logs that could be subpoenaed? Logging practices vary by provider. Some keep no logs, some keep connection logs, and some keep full traffic logs. If legal compliance is a concern, choose a provider with a clear privacy policy and minimal logging. Note that providers may be required to comply with lawful government requests regardless of their logging policy.
---
How Hex Proxies Supports Compliant Proxy Use
Hex Proxies is built for businesses that need reliable, ethical proxy infrastructure. The network is sourced entirely through legitimate commercial agreements with internet service providers -- no peer-to-peer SDK installations, no borrowed bandwidth from unknowing users, and no questionable IP sourcing practices.
Compliance features built into the Hex Proxies platform include rate limiting controls that let you set maximum requests per second to respect target website resources, detailed usage analytics for audit trails, and API-level access controls that restrict proxy use to authorized team members.
Hex Proxies maintains a clear acceptable use policy that prohibits credential stuffing, account takeover, unauthorized access, and any activity that violates applicable law. Customers who violate the AUP face immediate account suspension.
For organizations with specific compliance requirements (SOC 2, GDPR DPA, HIPAA-adjacent), Hex Proxies offers enterprise agreements with custom data processing addendums, dedicated account management, and compliance documentation.
Review the Hex Proxies compliance and ethics policy at [hexproxies.com/network/compliance-ethics](/network/compliance-ethics) or contact the sales team for enterprise compliance discussions.