Are Residential and Mobile Proxies Legal?

A residential proxy routes your request through an IP address that an internet provider assigned to a home connection; a mobile proxy does the same with an IP from a mobile carrier's network. Neither type is regulated as such in the US, the EU or the UK. The law treats them like any proxy: the act you perform decides.

Four things decide whether a given use is legal:

This page explains each, and the checks you can run on any provider.

A residential proxy network is criminal when it runs on devices that were compromised or enrolled without their owners' knowledge, typically through malware (the CFAA in the US, the Computer Misuse Act in the UK). US and European law enforcement have taken several such services down.

• May 2024. The DOJ dismantled a botnet-based residential proxy service and arrested its administrator. The FBI's guidance of May 29, 2024 calls it one of the largest residential proxy services and botnets, with over 19 million compromised IP addresses in over 190 countries and confirmed victim losses in the billions of dollars.
• 2022. The DOJ disrupted a Russian botnet that sold access to hijacked devices as proxies.
• March 12, 2026. The FBI published "Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals" (I-031226-PSA). It says residential proxy networks route traffic through home devices, often without their owners' knowledge, and names TV streaming devices, digital picture frames, smartphones, tablets and routers. On the same day an FBI FLASH described malware-infected home and small-office routers sold as residential proxies.

Infecting a device to use its connection is unauthorized access under the CFAA, 18 U.S.C. § 1030, under the UK Computer Misuse Act 1990 and under the national laws that implement EU Directive 2013/40/EU. The customers of such a service are not automatically criminals, but their traffic runs through victims' homes, and the service can disappear overnight in a takedown.

Yes. No US statute regulates buying or using residential proxies; the CFAA, the wiretap law, contract law and the laws on your specific activity apply, as they would without a proxy.

The CFAA, in its own words. 18 U.S.C. § 1030 decides most proxy questions through three definitions:

• "Protected computer" (§ 1030(e)(2)) covers any computer "used in or affecting interstate or foreign commerce or communication", which in practice means every server and every home device on the internet.
• "Exceeds authorized access" (§ 1030(e)(6)) means "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter". In Van Buren v. United States (2021) the Supreme Court read this as a "gates-up-or-down" question: are you entering parts of a system that are off limits to you? Which IP you use does not change the answer.
• Damage (§ 1030(a)(5)(A)): knowingly transmitting "a program, information, code, or command" that intentionally causes damage to a protected computer without authorization. Malware that turns a home device into a proxy exit falls here, and "damage" (§ 1030(e)(8)) is "any impairment to the integrity or availability of data, a program, a system, or information".

Yes. In Europe the questions are the GDPR, the database right and national computer-crime law, not the proxy.

GDPR. The GDPR applies to personal data, which Article 4(1) defines as any information relating to an identified or identifiable person, whatever IP you collect it from. Prices, stock levels and product specifications are not personal data. Seller names, reviewer profiles and contact details are, and an IP address can be too: the CJEU held in Breyer (C-582/14, 2016) that a dynamic IP address can be personal data for a website operator (what we keep about your traffic). If a project collects personal data, the usual basis is legitimate interests under Article 6(1)(f), with data minimization under Article 5(1)(c).

Price monitoring under the GDPR, in 4 steps:

1. Collect product, price, stock and a timestamp; leave out names, reviews and profiles.
2. If personal data does come in (a marketplace seller's name), write down your legitimate-interest balancing test and keep only the fields you need.
3. Check the site's terms and the database right before systematic extraction (below).
4. Keep your request rate modest so the site is not disrupted.

Mobile proxies are legal on the same terms as residential ones. A mobile proxy farm, a rack of phones or LTE/5G modems with SIM cards that serve as proxy gateways, is not illegal in itself in the US or Europe. What decides is whether the operator is allowed to use those lines that way under the carrier's terms, and what the customers do through them. For the product side, see mobile vs residential proxies.

It may be if it runs software you did not install on purpose or a streaming box that promises free content. The FBI's March 2026 announcement advises avoiding streaming devices that promise free content, keeping software updated, keeping unauthorized devices off business networks and segmenting them, and reporting a compromise to the FBI's Internet Crime Complaint Center (IC3) (FBI PSA).

Reselling is common and legal: many proxy brands sell access to a larger network under their own name, and white-label programs exist for that purpose. What matters for you is who answers for the network you use: its acceptable use policy, its abuse process and its support. To see whether two brands share one network, compare their infrastructure:

1. Collect exit IPs. Make 20 or more requests through each provider, across countries and sessions, and log the IP each one shows:
   ShellCopy Shell code

   for i in $(seq 1 20); do curl -s -x HOST:PORT -U "<login>:<password>" https://api.ipify.org; echo; done

2. Look up the exits. Enter each IP in RIPEstat or the ARIN RDAP search and read the holder and the ASN (an ASN is the number of the network that announces the IP; see proxy IP addresses and ASNs). On a residential network the holder should be a home internet provider, which is what makes the IP residential. A datacenter or hosting company as the holder means the "residential" label does not fit.
3. Look up the gateway. The exits name home ISPs, so the gateway is where the operator's own infrastructure shows. Resolve it with dig +short HOST, look the result up in RIPEstat, run dig -x IP for its reverse DNS, and check the ASN in PeeringDB. Two brands whose gateways resolve to the same network are likely one platform.
4. Compare fingerprints. Identical username parameters (such as -country-us-city-new_york), session presets, ports and the headers or body of a 407 Proxy Authentication Required reply (curl -v) across two brands point to the same software.
5. Test overlap. Run both providers in the same city at the same time and compare the exit IPs. A large share of identical IPs across many samples suggests a shared pool; a few matches are normal, because home IPs are reassigned and one IP can appear in more than one network.

Treat the result as evidence, not proof: IP ranges are leased, gateways run on cloud hosting, and a reseller can add its own support, billing and abuse handling on top. Questions worth asking the provider directly: who runs the gateway and the pool, and who handles abuse reports and support.

Before you buy, check what the provider promises and what it enforces:

1. An acceptable use policy that forbids fraud, spam and unauthorized access, and says what happens when it is broken.
2. Verification when an account shows signs of abuse, and for resellers.
3. A published abuse process with response times and outcomes.
4. No anonymity promises. A provider that says its traffic cannot be traced is a red flag; lawful customers do not need that promise.
5. Lawful use cases only on its own pages: no ticket scalping, account farming or fraud tools.
6. Who answers for the network: whether the brand handles abuse reports and support itself, or passes them to another company (see the reseller checks above).

• DOJ, botnet-based residential proxy service dismantled (May 2024)
• FBI/IC3 public service announcement I-052924-PSA (May 29, 2024)
• DOJ, Russian botnet disrupted (2022)
• FBI, I-031226-PSA (March 12, 2026)
• FBI FLASH on infected routers sold as residential proxies (March 2026)
• 18 U.S.C. § 1030 (CFAA)
• 18 U.S.C. § 2511 (interception of communications)
• DOJ Justice Manual 9-48.000, Computer Fraud and Abuse Act
• 18 U.S.C. § 1839 (Defend Trade Secrets Act definitions)
• Van Buren v. United States (2021)
• GDPR, Regulation (EU) 2016/679
• CJEU, Breyer, C-582/14 (2016)
• Database Directive 96/9/EC
• CJEU, Ryanair v PR Aviation, C-30/14 (2015)
• Directive 2013/40/EU on attacks against information systems
• § 202a StGB (Germany)
• § 87b UrhG (Germany)
• Computer Misuse Act 1990, s.1
• RIPEstat, ARIN RDAP search, PeeringDB

This is not legal advice. Laws and court decisions change, and the primary sources linked on this page are the authority.