Proxies are legal to use in the US, the UK and the EU. Nothing about routing your traffic through an intermediary server is unlawful, and businesses of every size do it routinely for testing, monitoring, security research and data collection.
The harder question is not whether proxies are legal but what you do with them, and that is where the answer becomes specific: to the data, to the jurisdiction, and to whether a login is involved.
This article is general information, not legal advice. Take advice on your own situation before starting a project of any scale.
What Is Legal to Collect, and What Is Not
The distinction that matters most is not technical. It is whether the data sits behind an access barrier.
Generally defensible:
- Publicly available data that anyone can view without an account: product listings, prices, public profiles, published articles, search results.
- Data you collect at a rate that does not degrade the service for anyone else.
- Facts, prices and other information that is not itself protected by copyright.
Substantially riskier:
- Anything behind a login, particularly where you agreed to terms to obtain the account.
- Circumventing a technical access control rather than simply requesting a public page.
- Personal data about identifiable individuals, which brings data protection law into play regardless of whether the page was public.
- Wholesale reproduction of copyrighted content, or extraction of a substantial part of a protected database.
Terms of service are contract, not crime
A site’s terms may forbid automated access. Breaching them is generally a contractual matter: it can support a breach-of-contract claim, and it is a genuine legal risk, but it is a different category from computer misuse legislation.
The distinction narrows where you accepted the terms explicitly, typically by creating an account. Scraping public pages you never agreed to terms for sits on much firmer ground than scraping from inside an account whose terms you clicked through.
Copyright and database rights
Facts are not copyrightable. A price is a fact. A list of products is largely factual. Reproducing article text, photographs or descriptions verbatim is a different matter, and collecting them at scale to republish is the clearest way to attract a claim.
The EU adds a specific database right, separate from copyright, protecting substantial investment in compiling a database even where the individual facts are unprotected. Extracting a substantial part of such a database can infringe it even if no single item is protected.
Personal data changes everything
If what you collect identifies a living person, data protection law applies whether or not the page was public. Under the GDPR you need a lawful basis for processing, and legitimate interests requires a balancing exercise you should be able to evidence. Subject rights, retention limits and transparency obligations follow. A public LinkedIn profile is public data and personal data at the same time.
How the Rules Differ by Region
| Region | Main framework | Position on public scraping | The main trap |
|---|---|---|---|
| US | Computer Fraud and Abuse Act, state law | Courts have been reluctant to treat scraping public pages as unauthorised access | Contract claims and state-level privacy law such as the CCPA |
| UK | Computer Misuse Act, UK GDPR, database right | Public data collection is not inherently unlawful | UK GDPR applies to personal data; database right protects compiled sets |
| EU | GDPR, Database Directive, DSM Directive | Similar to the UK, with an explicit text and data mining exemption for research | GDPR is strict, and the database right is broader than most expect |
Jurisdiction is rarely a single answer. Three locations matter at once: where you are, where your servers are, and where the target site and its users are. A US company scraping a German site about EU residents is dealing with EU law regardless of where its scraper runs.
Ethical IP Sourcing
Residential proxy networks are built from real people’s home connections. How those people came to participate is the industry’s most important open question, and it is worth asking directly before you buy.
A well-run network recruits participants who know what they are agreeing to: usually users of an application who are offered something of value, an ad-free tier or a paid reward, in exchange for a share of their idle bandwidth. They are told plainly, they can leave, and the provider audits which applications carry its code.
A badly-run one bundles the capability into free software as a line of small print nobody reads, or worse, ships it inside applications the user never knowingly installed. Networks built that way have been the subject of enforcement action and of research linking them to compromised devices.
This matters commercially, not only ethically. A pool assembled without consent is unstable, is more likely to contain compromised machines, and exposes you to reputational risk if the provider becomes a news story.
What to ask before you buy
- How do participants join the network, and what are they told?
- What do they receive in return, and can they withdraw at any time?
- Do you audit the applications that carry your SDK?
- What compliance certifications do you hold, and can you produce the reports?
- What is your policy when abuse is reported on an address?
Shifter maintains SOC 2 Type II, GDPR and HIPAA compliance, and those are the kinds of credential worth asking any provider to evidence rather than take on trust.
Are Proxies Safe?
Safety divides into two questions.
Is the traffic safe? With a reputable paid provider, yes. Your connection to the proxy is encrypted, and the provider has a commercial reason to protect it. With a free public proxy, no. The operator pays real bandwidth costs and recovers them somehow: logging what passes through, injecting or replacing content, or reselling your connection. Free lists are also shared with thousands of strangers and already blocked on most commercial sites.
Are you anonymous? No, and this is worth being blunt about. A proxy changes the IP address a website sees. It does not touch cookies, browser fingerprints, login state or account history, and your provider can see your traffic. Treat a proxy as a tool for managing location and request rate, not as a privacy guarantee.
Practical Guidance
- Prefer public data. The legal position is far clearer outside a login.
- Respect robots.txt and rate limits. Neither is legally binding in most jurisdictions, but ignoring them makes any dispute harder to defend and degrades someone else’s service.
- Collect the minimum. Narrower collection means less exposure under both data protection and database law.
- Avoid personal data unless you have thought it through. If you must collect it, document your lawful basis before you start.
- Keep records. What you collected, when, why and under what basis. If a question ever arises, contemporaneous records matter.
- Take legal advice for anything at scale, in a regulated sector, or involving personal data.
Conclusion
Proxies are legal. Web scraping is legal in the great majority of cases involving public data. The risk lives in specifics: logins, personal data, copyrighted content and substantial database extraction, and it varies by jurisdiction.
Choose a provider that can explain where its IP addresses come from, keep collection to public data wherever possible, and get advice before committing to anything large.
For the technical side of collection see web scraping proxies, and for the wider taxonomy, types of proxies.