Are residential proxies legal in the UK and EU? (2026)

Is it legal to use a proxy in the UK?

Yes. No UK law prohibits using a proxy server, including a residential or 4G/5G mobile proxy. Businesses use proxies every day for price monitoring, ad verification, SEO tracking and app testing.

The law looks at the activity, not the tool. Four sets of UK rules matter most when you collect web data:

• Computer Misuse Act 1990: accessing data without authorisation.
• UK GDPR and the Data Protection Act 2018: collecting personal data, even when it is public.
• Copyright and database right: copying protected content or a substantial part of a database.
• Contract law: the terms of the websites you visit.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It amends the UK GDPR and the 2018 Act in stages, so check the ICO's current guidance before a new project.

Is it legal to use a residential proxy in the EU?

Yes. EU law does not ban proxies either. The same activity-based rules apply, and most of them are harmonised across the 27 member states:

• Illegal access: Directive 2013/40/EU requires each member state to punish intentional access to an information system "without right", where a security measure is infringed.
• Personal data: the GDPR (Regulation (EU) 2016/679) applies directly in every member state.
• Databases: Directive 96/9/EC gives database makers a sui generis right.
• Text and data mining: Directive (EU) 2019/790 sets two exceptions, which member states had to transpose by 7 June 2021.

National criminal and contract law still differ. A project that collects data in Germany and one in Spain can face different details.

When does using a proxy become a crime under the Computer Misuse Act?

It becomes a crime when you access data you know you are not authorised to access. Section 1 makes it an offence to make a computer perform a function to secure unauthorised access, knowing that it is unauthorised. Section 17(5) treats access as unauthorised when you are not entitled to control it and lack consent from someone who is.

Typical examples involve logins and security controls, not public pages:

• logging into accounts that are not yours, including with leaked passwords (credential stuffing);
• reaching content behind a login without the owner's permission;
• using another person's API keys or session cookies.

The maximum penalty for a section 1 offence is two years in prison on indictment. Section 3 covers unauthorised acts that impair a computer's operation and carries up to ten years. Flooding a site with requests until it slows down can fall under section 3.

Does GDPR apply when you scrape public web pages?

Yes, whenever the pages contain personal data. In August 2023, the ICO and 11 other authorities issued a joint statement on scraping. It says that publicly accessible personal information "is still subject to data protection and privacy laws in most jurisdictions". The EDPB said in July 2026 that the GDPR applies to web scraping when it includes personal data processing.

If you collect names, profiles, usernames or contact details, you need to:

• have a lawful basis: for private companies, usually legitimate interests (Article 6(1)(f));
• minimise: data must be "adequate, relevant and limited to what is necessary" (Article 5(1)(c));
• inform people: Article 14 applies to data you did not collect from them, with an exception for disproportionate effort;
• protect and delete: keep the data secure and only for as long as you need it.

Price tables, product specifications and stock levels usually contain no personal data. That is why price monitoring and SERP tracking raise fewer GDPR questions than scraping social profiles.

Can a website's terms of service forbid scraping?

Yes, terms of service can restrict scraping as a matter of contract. In Ryanair v PR Aviation (C-30/14, 15 January 2015), the CJEU looked at a database protected neither by copyright nor by the sui generis right. It ruled that the Database Directive does not stop the maker from laying down contractual limits on its use, subject to national law.

Whether a visitor is bound by terms they never clicked depends on national contract law. A breach of terms is usually a civil matter, not a crime. It can still lead to account bans, damages claims or injunctions.

Practical rule: read the terms of each target. If they ban automated access, ask for permission, or use an official API or a licensed data feed.

Is copying data from a website a database right infringement?

It can be, if you take a substantial part. Under Article 7(1) of Directive 96/9/EC, the EU sui generis right protects a database that required a substantial investment. That investment can be in obtaining, verifying or presenting the contents. The maker can then prevent extraction or re-use of all or a substantial part of it.

Two details matter for scrapers:

• Repeated small extractions count. Article 7(5) forbids repeated and systematic extraction of insubstantial parts that conflicts with normal exploitation of the database.
• The right lasts 15 years, counted from 1 January of the year after the database was completed (Article 10(1)).

The UK has the same right in the Copyright and Rights in Databases Regulations 1997. Regulation 16 says repeated and systematic extraction of insubstantial parts may amount to a substantial part.

What do the text and data mining exceptions allow?

They allow copying for automated analysis, within limits. Directive (EU) 2019/790 defines text and data mining as automated analysis of text and data to generate information such as patterns, trends and correlations.

• Article 3 (EU): research organisations and cultural heritage institutions may mine works they can lawfully access, for scientific research. Contract terms cannot override this (Article 7(1)).
• Article 4 (EU): anyone may mine lawfully accessible content for any purpose, including commercial use. The exception does not apply if the rightholder has expressly reserved it, for online content by machine-readable means, for example.
• Section 29A (UK): a person with lawful access may copy a work for computational analysis for non-commercial research. Contract terms that prevent this are unenforceable (section 29A(5)).

As of October 2026, section 29A is the only text and data analysis exception in the UK Copyright, Designs and Patents Act 1988. Commercial mining of copyright works in the UK therefore needs a licence or another exception. In both regions, treat robots.txt rules and clear reservations in site terms as opt-outs.

What does PontProxy allow and block?

PontProxy allows legitimate public-data work only. Permitted uses include public-data web scraping, SEO and SERP tracking, and price and ad verification. Brand protection, market research, social media management and app or website geo-testing are also allowed. The full rules are in our Acceptable Use Policy.

• Blocked targets: online banking, government portals, payment processors and outgoing email (SMTP ports 25, 465 and 587).
• Prohibited: fraud, account takeover, credential stuffing, spam, DDoS and any unauthorised access.
• Abuse desk: [email protected]; reports reviewed within 24 hours.
• Data we keep: account number, order history, payment records and per-day traffic totals; connection metadata (timestamp, target domain, bytes) kept 7 days for abuse handling, then deleted.

No KYC — no ID, no selfie, no documents. Pay in crypto. We apply GDPR data minimisation to ourselves: we do not collect ID documents we do not need. Details are in our privacy policy, terms and no-KYC page.

Does a proxy change who is legally responsible?

No. A proxy changes the IP address a website sees. It does not change which laws apply to you or who is responsible for the requests. You remain the controller of any personal data you collect, and you remain bound by any terms you accepted.

Proxy providers can also receive lawful requests from authorities. Our privacy policy lists what we keep and for how long.