Reddit's lawsuit names a proxy provider. Read your supplier contract again.

Last week a proxy vendor filed a motion arguing it should not be a defendant in a scraping lawsuit. It sells bandwidth and addresses. It did not run the crawlers Reddit is complaining about. That argument is now sitting in front of a federal judge in Manhattan.

For most of the last decade it would not have needed making. Scraping litigation had a two-party shape: a platform sued the company that collected from it, and the suppliers underneath that company, the proxy networks and the unblocker vendors, stayed off the caption. Nobody wrote supplier contracts on the assumption that the supplier would be a co-defendant, because suppliers were not co-defendants.

That assumption is being tested right now in the Southern District of New York.

What the docket actually shows

The case is Reddit, Inc. v. SerpApi LLC, No. 1:25-cv-08736, filed 22 October 2025 and assigned to Judge Paul Engelmayer. Reading the docket record on 27 July 2026, the named defendants include Perplexity AI, SerpApi, AWMProxy and Oxylabs, and the record lists the Digital Millennium Copyright Act among the causes of action. Reddit has since amended its complaint. On 21 July 2026, six days before this was written, Oxylabs moved to dismiss that amended complaint. No ruling on that motion appeared on the docket as of 27 July 2026.

That is the whole factual basis for this post, and the boundaries are worth stating. Being named as a defendant is not a finding of liability, and a motion to dismiss tests whether a complaint is legally sufficient rather than whether anything alleged in it happened. There is no prediction here about how any of it resolves, and nothing here is legal advice.

What survives regardless of the outcome is the theory itself, which is now in circulation whether or not it prevails: that the party supplying collection capacity can be pulled onto the caption alongside the party doing the collecting. If you buy proxies or unblocking as a service, that is a procurement problem before it is a courtroom problem. Procurement decisions run on the range of possible outcomes, not the final one. The range changed in October 2025.

The distinction your crawlers make and your contract does not

Coverage of the case keeps flattening a distinction the filings depend on. "Scraping" covers two activities that sit on different legal footing.

Logged-out retrieval of a page any browser can fetch without an account is one. Authenticated retrieval, where a session exists because somebody accepted a set of terms, is the other. The second brings a contract into the picture, and with it a party who agreed to something. Whatever you think about how courts should treat either, they are not the same fact pattern.

Your crawlers already know the difference. Authenticated jobs have different credential handling, a different session store, different retry logic and different failure modes than logged-out fetches. You can usually tell them apart from a config file.

Your proxy contract almost certainly cannot. The standard acceptable-use clause says something close to "customer will comply with applicable law and with the terms of service of any target site," and stops there. It does not ask which of your jobs authenticate. It does not distinguish a residential proxy request that fetches a public product page from one that carries a logged-in session cookie. That vagueness is comfortable while nothing is happening and useless the moment something is. Which of your targets need which treatment is worth mapping for technical reasons anyway; the same map is the input to this conversation.

The gap runs the other way too. A vendor selling undifferentiated bandwidth has, by design, no view of what its customers fetch. That was long treated as a feature on both sides. It kept the vendor out of your business and kept your target list private. If suppliers do start getting named alongside collectors, the incentive flips: a vendor that cannot describe what runs over its network has a harder time distancing itself from any single customer, and the cheapest way for it to fix that is to push more disclosure and more restriction down into your contract at renewal. Expect acceptable-use schedules to get longer before they get clearer.

Four clauses worth rereading

Indemnification, and which direction it runs. Most proxy agreements indemnify the vendor against claims arising from customer traffic. Fewer indemnify the customer against anything. Where a customer-side indemnity does exist, it is often drafted for intellectual property claims against the vendor's own software and says nothing about claims brought by a target platform over collection. Read who indemnifies whom, for which categories of claim, and against what cap. A cap set at twelve months of fees is a common shape and tells you how much risk the vendor is actually absorbing.

A sourcing warranty with a remedy attached. Does the vendor warrant, in the contract, how it obtained the addresses in its pool? A compliance page on a website is a marketing asset. A warranty is a promise you can enforce. The gap between the two has become a live procurement question, and we covered the scrutiny of consumer-device supply separately in our note on IP sourcing. Larger vendors in the proxy networks category publish some of this. Oxylabs' KYC page, read on 27 July 2026, states that "every customer has to answer a KYC questionnaire to get access to our solutions" and that unique use cases are assessed by its teams. IPRoyal's residential product page, read the same day, says only that residential addresses "are acquired from household devices" and defers the detail to a separate sourcing page. Publishing a policy and warranting it in an agreement are different acts, and a policy page can be revised without telling you. Ask for the second.

Notice obligations, running both ways. Nearly every contract obligates you to notify the vendor if you receive a claim. Far fewer obligate the vendor to notify you when a target platform sends it a demand letter that concerns your traffic. That asymmetry matters, because the demand letter is the point at which a dispute is still cheap. Ask for a defined notice window, and ask what the vendor will disclose about you and on what basis. A vendor that will hand over customer identity on request without telling you first is a different counterparty from one that commits to notify you and give you a chance to respond where the law permits it.

Continuity when capacity disappears. Two failure shapes are worth pricing. An injunction against a pool is the dramatic one and the less likely. The quiet one is a vendor settling a dispute by agreeing to block a target domain across its network, which is almost always cheaper for the vendor than litigating. If your most important target is on that list, your crawl starts failing on a Tuesday for reasons your logs will describe as an anti-bot problem. Termination rights point the same direction: the Oxylabs KYC page states that illegal or unethical use is "subject to refusal of service with immediate contract termination." That is a defensible policy for a vendor to hold, and it is also a one-sentence description of your worst operational day. Find out what happens to prepaid balances and committed volume when it is exercised, and whether a target-specific restriction ends the whole agreement or only the affected traffic. This is the underappreciated argument for running a second vendor: the second contract buys legal continuity as well as uptime. It also matters whether you buy a raw pool or a managed unblocker, because the managed product makes more decisions on your behalf and carries more of this surface.

Where the vendor sits commercially shapes how much of this is negotiable. Enterprise agreements with Bright Data or Oxylabs, whose products overlap heavily, are negotiated documents with a legal team on the other side. Bright Data publishes a Master Service Agreement and a separate acceptable use policy in its legal index, which is more than many peers disclose; the operative text is what binds you, not the summary page. Self-serve plans are click-through terms with no counterparty to talk to, and the pricing model you are on is usually a good predictor of which conversation you can have.

The same questions on the dataset side

If you buy finished datasets rather than collection capacity, the same questions arrive in a different shape. A data provider such as Coresignal or People Data Labs is selling you the output of a collection process you did not run and cannot inspect. Marketplaces add a layer: on Datarade, the commercial relationship frequently runs to the underlying supplier rather than to the marketplace, so read carefully who is actually warranting anything to you. The diligence questions for providers are the same four, translated: who indemnifies you, what is warranted about provenance, who tells you when a source objects, and what happens to your pipeline when a source is dropped.

What to do this week

Pull your current proxy and unblocker agreements. For each one, write down four answers: the indemnity direction and its cap, whether IP sourcing is warranted or merely described, whether the vendor owes you notice of third-party demands, and what happens commercially if a target domain is blocked mid-term. Most teams cannot answer more than two of those from memory.

Then separate your collection jobs into authenticated and logged-out, and know which vendor carries which. That split costs an afternoon and it is the first question anyone will ask you, internally or otherwise.

None of this depends on how the New York case comes out. The motion is undecided, I have no view on how it should be decided, and the contract work is worth doing even if the complaint is dismissed next month.