Where the addresses came from is the one property of a residential network you cannot establish by testing it. Latency you can measure, coverage you can sample, pricing you can model. Sourcing has to be evidenced from documents and from how a provider behaves when asked a direct question in writing.
That makes ethical proxy sourcing a due-diligence exercise rather than a technical one. This article sets out what a defensible consent chain looks like, which documents actually prove something, how to interrogate a sourcing claim without becoming an auditor, and what remains your responsibility once the supply question is settled.
Consent has to be meaningful, not merely obtained
Every residential network relies on people whose connections carry other people's traffic. The question is whether those participants understood the arrangement, received something in exchange, and can leave without difficulty. A checkbox buried in an installer satisfies none of those tests, even where it technically records agreement.
Meaningful consent is recognisable by its plainness. The participant is told in ordinary language what their connection will be used for, what is and is not visible to the network operator, what they receive in return, and how to stop. Where a disclosure requires legal training to interpret, the reasonable conclusion is that it was not written to be understood.
Read the participant-facing material, not the buyer page
Provider websites are written for buyers, and sourcing sections there tend toward reassurance rather than detail. The more informative document is the one shown to the people supplying the addresses: the software licence for the bundled application, the rewards programme terms, or the panel agreement. Those documents describe the actual exchange.
Read them for four specific things, and treat anything absent as unproven:
- An explicit statement that the connection may relay third-party traffic
- A named benefit given in exchange, whether cash, credit, or an ad-free tier
- A withdrawal route that takes effect promptly and needs no support ticket
- A stated boundary on what the operator can observe while traffic is relayed
- A contact route for participants who believe the terms were not honoured
Enforcement is the part buyers can verify
A sourcing policy with no enforcement mechanism is a statement of intent. What distinguishes a serious operator is a documented abuse process: a route for reports, a named owner, a stated response window, and the demonstrated willingness to suspend a paying customer. Ask what proportion of accounts were suspended in the last year. A provider who has never suspended anyone is either extraordinarily lucky or is not looking.
Customer verification belongs in the same category. Networks that check who is buying before opening access add friction to their own funnel, which is precisely why the check is meaningful. Identity verification at signup is an inconvenience worth welcoming rather than avoiding.
| Evidence requested | Strong answer | Weak answer |
|---|---|---|
| Participant disclosure | A public document written in plain language | A summary paragraph on a sales page |
| Withdrawal route | One action, effective within a stated period | Contact support and request removal |
| Abuse handling | Named owner and published response window | A general contact form |
| Customer checks | Identity confirmed before the first request | Instant access with a card |
| Onward resale | A statement that supply is not resold | Silence on the question |
Ownership changes reopen every answer
Supply arrangements are among the first things restructured after an acquisition, and sourcing documentation is frequently the last thing updated. If a provider on your shortlist changes hands, treat the earlier answers as expired and ask again. The same applies when a network launches a substantially cheaper tier, since the economics of a lower price usually come from somewhere in the supply chain.
Keep the replies with the contract rather than in a chat thread. A dated written answer is the only form of this evidence that survives staff turnover on either side, and it is the artefact a compliance review will ask for.
Build an audit trail you can hand over
Sourcing diligence has no value if it lives in one person's memory. The output of the exercise should be a short file that another team can read in ten minutes and act on: what was asked, what came back, when, and from whom. Compliance reviews, customer security questionnaires and renewal negotiations all draw on the same material, so assembling it once pays repeatedly.
A workable file holds five items, and none of them require specialist expertise to collect:
- A dated copy of the participant-facing disclosure as it stood when you bought
- The provider's written answers to your sourcing questions, with the sender named
- The acceptable-use policy version referenced by your order form
- A note of who inside your organisation reviewed and approved the arrangement
- The date the file should next be revisited, usually the renewal date
Storing copies rather than links matters more than it sounds. Provider pages are edited without version history, and a term you relied on can disappear between purchase and review with nothing to show it was ever there.
Red flags that should end an evaluation early
Sourcing described only in adjectives
Pages that describe supply as ethical, premium, or clean without naming a mechanism are marketing copy. The word to look for is a verb: how participants are recruited, what they are told, what they receive. An adjective-only answer that survives a follow-up question is a decision in itself.
Withdrawal handled by support ticket
If leaving the network requires contacting a human who may or may not respond, consent is effectively one-way. A withdrawal route that depends on the operator's goodwill is not a control the participant holds.
Silence on onward resale
Capacity resold between networks makes the consent chain unverifiable, because the operator you are buying from did not obtain the addresses and cannot speak for how it was done. Ask the question directly; an evasive answer is more informative than a negative one.
Ethical supply does not transfer downstream
The request is still yours
A consent-verified network says something about how the address was obtained. It says nothing about whether your particular request respects the destination's terms, applicable privacy rules, or the intellectual property in the material you collect. Those obligations sit entirely on your side of the connection and cannot be delegated to a supplier.
Proportionality is part of the standard
Volume that a destination would consider unreasonable does not become reasonable because the route is ethically sourced. Rate limiting your own collector, honouring published guidance, and stopping when a site signals distress are practical expressions of the same principle the sourcing question is about.
Document your own position too
Write down the lawful basis for the workload, who approved it, and what would cause it to stop. Buyers who ask providers for documented policies and hold none themselves are asking for a standard they have not met.
Sourcing due diligence, condensed
- Request the participant disclosure text
- Confirm how consent can be withdrawn
- Ask who reviews abuse reports
- Check whether supply is resold onward
- File every answer with the contract