P PROXYDECK
Home / guides / Legal aspects of proxy use: GDPR, ToS, fair use
Find one →Find one
Home / Learn / Legal

Legal aspects of proxy use: GDPR, ToS, fair use

10 min read Intermediate Legal updated 30.07.2026

What's legal and what isn't. Analysis of GDPR fit, ToS nuances, well-known court cases (LinkedIn vs hiQ Labs) and how to protect yourself in a B2B context.

The technology itself is fully legal. The question is how exactly you use it.

Unambiguously legal:

  • Scraping public data (without bypassing authentication)
  • Marketing analytics
  • Ad verification and brand protection
  • Testing your own products from different regions
  • Privacy and VPN-style functionality

Grey area:

  • Bypassing geo-blocks of paid streaming services (a ToS breach, but rarely prosecuted)
  • Scraping permitted public data while violating robots.txt
  • Multi-account on platforms where it's not explicitly forbidden

Illegal:

  • Bypassing CAPTCHAs on closed resources
  • Accessing private APIs without permission
  • Scraping personal data outside GDPR exemptions
  • Ad fraud (click fraud, install fraud)
  • Creating fake accounts for manipulation

GDPR and scraping public data

GDPR doesn't prohibit scraping public data, but it has nuances. The key article is 6(1)(f) — "legitimate interests". If your purpose doesn't substantially affect a data subject's interests, processing is lawful without explicit consent.

Concretely for proxy scraping:

  • Allowed: scraping public profiles for B2B lead generation, news aggregation, price monitoring
  • Not allowed: collecting personal data from closed groups, "scrape and resell" private information

Remember the right to erasure — if a person asks you to remove their data, you have to satisfy the request within 30 days.

ToS violations vs unlawful actions

Most sites prohibit scraping in their ToS. That doesn't make scraping illegal — it means the site can ban your IP/account.

In the US the leading precedent is hiQ Labs vs LinkedIn (2019): the court ruled that automated collection of publicly available data does not violate the Computer Fraud and Abuse Act. So scraping public pages is legal in the US, even when ToS forbids it.

In the EU there's less case law, but the same approach overall: ToS is a contract between the site and you as a user; breaching it gives the site the right to ban you, not the prosecutor the right to charge you.

Notable court cases

hiQ vs LinkedIn (2019, US): hiQ scraped public profiles for analytics; LinkedIn told them to stop. The court sided with hiQ — public data can be scraped.

Meta vs Bright Data (2024, US): Facebook/Instagram accused Bright Data of obtaining and selling data. The court rejected the claim regarding public data and accepted it for logged-in/authenticated sessions.

Ryanair vs PR Aviation (2014, EU): the European Court ruled that simple databases (without original selection or arrangement) are not protected as databases. So scraping public flight schedules is legal.

How to protect yourself in B2B

If you use proxies for your SaaS or data product:

  • Keep an audit trail — who you collect from, why, how you store it
  • Document data sources clearly in your privacy policy
  • Don't aggregate personal data from multiple sources (this can violate GDPR even if each source is legal)
  • Have an erasure-on-request process
  • Avoid scraping authenticated parts of sites — even if you technically can
  • Work only with compliance-ready providers for enterprise (Bright Data, Oxylabs)
This text isn't legal advice. Discuss specific questions with a lawyer who specialises in data privacy in your jurisdiction. Especially relevant for B2C projects and PII aggregation.