Proxy acceptable use policy: what providers ban and why

A proxy acceptable use policy is the part of a proxy provider’s terms that says what customers may not do through its network, which targets it blocks, how it checks who customers are, and what happens on a breach. It binds the customer, not the websites. The target site’s own terms still apply on top of it.

Most buyers skim it once, at checkout. Then a job gets suspended, the balance is gone, and the policy turns out to be the only document that mattered.

This guide reads the policies the way a buyer should: what they ban and why, the grey areas where real jobs sit, how verification and enforcement work, what a breach costs, and what to check before paying. The last sections quote proxymint’s own terms.

What proxy acceptable use policies cover

A proxy provider rents out exit IPs that other customers share, over time or in reputation. The acceptable use policy is how the provider keeps one customer’s traffic from burning addresses for everyone else, and how it stays on good terms with the networks and ISPs behind its exits.

Look for four documents, because the policy rarely lives in one place:

• Terms of service. The contract. Usually carries the ban list, suspension rights, refunds and liability.
• An AUP page. Sometimes a separate page that expands the ban list and names blocked targets.
• A KYC or verification page. Who has to prove identity, when, and with what.
• Product or fair-use notes. Limits on “unlimited” plans, concurrency and bandwidth.

Two clauses outside the ban list catch buyers most often. The account clause makes the customer answerable for everything done under their credentials, so a proxy password leaked in a public repo or a shared script turns someone else’s abuse into the customer’s breach. A changes clause lets the provider revise the policy by posting a new version, sometimes with an email or a notice period, and continued use counts as acceptance.

A proxy acceptable use policy governs the customer’s relationship with the provider. No clause in it grants permission to access a site. Even a scraper that follows the provider’s rules can still breach a target’s terms of use, and the provider’s policy usually says so.

Activities every policy prohibits

The ban lists across providers are close to identical, because the same abuse shows up on every pool. The common core:

• Fraud and identity theft. Payment fraud, account takeover, phishing, money laundering.
• Unauthorized access. Credential stuffing, password spraying, brute-forcing logins, port scanning, exploiting systems.
• Attacks on availability. DoS and DDoS, flooding, anything that degrades a target.
• Malware. Distribution, command and control, hosting payloads.
• Spam and fake activity. Unsolicited bulk messages, fake accounts, fake reviews, fake engagement, ad click fraud.
• Illegal content. Child sexual abuse material, terrorist content, non-consensual imagery.
• Surveillance of people. Stalking or tracking identifiable individuals outside what the law allows.
• Sharing access without approval. Sub-letting or passing access to third parties the provider has not approved.

Each ban protects the pool as much as the victims. Credential stuffing through a residential exit gets that address flagged by IP-intelligence services, and the next customer who draws it inherits the flag. Spam runs trigger abuse reports to the ISP that owns the range, and the ISP can act against the whole range. So the policy is part of the product. Every pool stays only as clean as the least careful customer the provider lets in.

Blocked target categories

Beyond banned activities, most providers block some destinations outright, whatever the stated purpose. Government domains and adult sites are the common ones. Lists are usually short and end with a clause that lets the provider block anything else it judges risky.

For a buyer, the practical question is whether a job’s targets sit on that list. An uptime check against a public government portal or a QA suite for a payment page can be refused by the network even though the work is legitimate. Ask before ordering, not after the first failed request.

Where legitimate jobs meet the line

Most buyers are not near the ban list. They run price monitoring, search tracking, ad verification and QA. The policy still shapes how those jobs have to run.

Scraping and public data rules

Most providers allow collection of public data and forbid getting past access controls. In practice that means no scraping behind a login the customer has no right to use, no paywalls, no defeating a site’s access controls, and no collecting sensitive personal data without a lawful basis.

Target terms and rate limits still apply on top. When a site returns a block or a captcha, the safe reading of almost every policy is to stop, not to escalate. The best proxies for web scraping guide covers which tier fits which target once the job is inside those lines.

Accounts, ads and QA

Accounts the customer owns. Logging in to a seller dashboard or an ad account the business runs is usually fine. Creating accounts in bulk, or using proxies to get around a platform’s limits, is the “fake accounts” ban. Each platform’s own route (team access, business manager, partner access) comes first; a proxy only keeps the login origin consistent.

Ad verification. Loading a page to see which creative appears in a market is a standard, permitted use. Clicking ads to inflate counts is click fraud.

QA and localization. Testing an app or checkout flow from another country is normal. Load testing a target the customer does not own is an attack.

Customer verification and KYC

Know-your-customer checks decide who shares the pool. Practice varies widely. Some providers verify identity before any residential access. Others use a risk-based model: a card and email to start, and a verification request when something triggers it. Common triggers are free trial requests, high volume, traffic to sensitive domains and accounts that share access with others.

What a buyer should expect to provide:

• a legal name, and a company name and registration for a business account;
• a government ID or a business document, often through a third-party verification service;
• a short description of the use case and the main targets.

That description can become a limit. Some providers tie access to the use case approved at verification and block requests to domains outside it, so a new target mid-contract may need a fresh request.

Sanctions terms sit in the contract either way, so a buyer on a sanctions or denied-party list is excluded whether or not identity is checked.

Enforcement, suspension and refunds

Enforcement ladders look similar everywhere: a warning, throttling or a blocked target, suspension, termination. Most policies reserve the right to skip straight to the end without notice when the risk is high. Many add that the provider may report serious crime to the authorities, and that the customer indemnifies the provider for claims caused by their traffic.

What a breach costs

Buyers tend to miss the refund clause. A normal refund window does not cover a termination for breach, so the unused balance goes with the account. Under proxymint’s terms, a first purchase of data can be refunded in full inside 7 days unless more than 10% of it, or 1 GB, whichever is larger, has been used, and there is no refund when an account is suspended or closed for breaking the terms.

Network terms pass through to customers

Rules set by the networks a provider works with can sit inside its policy, and the provider enforces them on customers the same way as its own. So the effective policy can be stricter than the ban list on the main page, and it can change when those rules change. Read the whole document, not just the list, and ask whether any outside rules apply to the job’s targets.

Why providers enforce acceptable use

Residential and mobile exits are someone’s home or phone connection. When those exits carry abuse, the damage lands on the device owner, the target and every other customer of the pool.

Abuse at this scale is on record. In January 2026 Google’s threat intelligence team observed more than 550 threat groups using one residential network’s exit nodes in a seven-day window, for password spraying and access to victim SaaS environments among other things, and found that network’s SDK in more than 600 Android apps (Google GTIG, 2026-01-28). In March 2026 the FBI warned that criminals route traffic through residential proxies so it appears to come from ordinary homes and small businesses. One example in the notice is logging in to a stolen bank account through an exit in the victim’s own city, so the bank is less likely to flag it (FBI IC3 PSA I-031226-PSA, 2026-03-12).

For a buyer, that makes a strict policy worth reading as a feature. Enforcing named bans and acting on abuse protects the reputation of the addresses a buyer is paying for. How residential proxies work, and why their reputation matters, is covered in the pillar guide.

How to read a policy before paying

Ten minutes with the terms saves a suspended order. Score each item the way a security team scores a vendor questionnaire: a vague answer counts as no.

• Ban list. The policy names the banned activities, such as credential stuffing, fraud, spam, fake accounts and malware, rather than saying only “no illegal use”.
• Blocked targets. It names the blocked categories and gives a way to ask before ordering, so failed requests are not how a buyer finds out.
• Verification. It states the provider’s verification rights and the sanctions terms in the contract.
• Enforcement. It promises a reason on suspension and publishes an abuse contact.
• Money on breach. It states what a breach costs plainly, with the normal refund rules beside it.
• Outside rules. It says whether rules from the networks the provider works with apply.
• Changes. It says how a new version is announced and whether material changes reach account holders directly.

Then map the job against it. List the targets, the request rates, whether any login is involved, and whether the work touches personal data. If any item is unclear, ask the provider in writing and keep the answer.

The proxymint acceptable use terms

proxymint publishes its rules in its terms of service, last updated 3 October 2026.

Responsibility. Its “You are responsible for your traffic” section makes the customer responsible for all traffic and content, and for having the rights and lawful basis for the data collected. Its rules: collect public data only, do not get behind logins, paywalls or DRM without a right to, do not defeat access controls or rate limits where the law requires respecting them, and do not collect sensitive personal data without a lawful basis.

Bans. Its “Acceptable use” section bans breaking any law, illegal content, fraud, money laundering, sanctions evasion, identity theft, DoS and DDoS, port scanning, credential stuffing, unauthorized access, malware, interception, spam, fake ad traffic and click fraud, fake accounts, reviews and engagement, surveillance of people outside the law, and passing the service on to others without written approval.

Targets and network rules. That section also applies the acceptable use requirements of the networks that carry the traffic, lets proxymint block high-risk categories (adult and government targets are the named examples), and says proxymint acts on abuse quickly.

Verification. “Your account and verification” says proxymint may verify identity before or at any time, one verified identity per account, and makes the customer responsible for everything done under their credentials and API keys. “Who can use it” excludes anyone on a US sanctions or denied-party list.

Enforcement. “Suspension and termination” allows suspension without notice where the risk requires it, and says the customer will be told why. “Billing and refunds” rules out refunds on a termination for breach. “Abuse reporting” names abuse@proxymint.com, and “Law enforcement” allows reporting serious criminal activity to the authorities. “Changes” says a new version is posted with a new date, and material changes are also emailed to account holders. What a provider records, and so what it could hand over, is covered in do proxy providers keep logs.

For a target or use case the terms do not name, ask before ordering and keep the answer in writing.

Which jobs fit a strict proxy AUP

If the job is public-data collection, price monitoring, ad verification or QA, any strict proxy acceptable use policy fits. Check the blocked-target list against the target list, and pick from the types of proxies on the job’s merits. Rotating residential proxies fit broad collection from targets that block datacenter ranges.

If the job logs in to accounts the business owns, read the fake-account and account-sharing clauses first, use the platform’s own team or partner access, and look at static ISP proxies for a fixed login origin.

If the job needs anything on the ban list, no tier fits. A provider that accepts that traffic is selling a pool other customers will get blocked on.