On July 3, Google Cloud reported the disruption of NetNut, described in its blog post as a malicious residential proxy network linked to more than 2 million consumer devices and used by threat actors to route abusive traffic. ARDC welcomes Google Cloud’s continued efforts, along with others across the security community, to disrupt malicious residential proxy networks built on stolen, hijacked, or non-transparent infrastructure. These operations harm users, create security risk, and weaken trust in responsible public web data collection.
The issue is not residential proxy technology. The issue is irresponsible operation. A network built through hidden software, deceptive SDK practices, unclear participation terms, or device enrollment without informed consent does not meet responsible data collection standards.
Residential proxies serve an important role in a fair and open internet. They support security research, fraud detection, ad verification, brand protection, market research, price comparison, academic research, and access to public information from different geographies. These uses help organizations detect abuse, verify services, improve products, and understand public markets.
Policy and enforcement should target misconduct, not an entire category of technology. Malicious operators should face action. Responsible operators should follow clear, verifiable standards. Broad bans or identity-based restrictions on residential proxies would harm legitimate research, competition, accountability, and access to public web data.
Responsible residential proxy networks follow a clear model. They rely on informed consent, clear user notice, meaningful user control, a simple opt-out path, acceptable use policies, monitoring, abuse prevention, and accountability. When individuals participate, they should understand the value exchange and keep control over participation.
ARDC’s principles provide a useful framework. Organizations should limit collection to publicly available data, adopt acceptable use policies, monitor for misuse and domain health, document collection processes, retain query logs for data provenance, and maintain mechanisms to address misuse. These practices help separate responsible public web data access from abuse of compromised or non-transparent infrastructure.
Residential proxy operators should comply with applicable privacy laws across both their residential networks and their own data collection practices. This includes clear disclosures, lawful processing, data minimization, security controls, and respect for user rights.
Trust in public web data access depends on verifiable practices. ARDC will continue to promote standards designed to protect users, support responsible data collection, and preserve open access to public information.