This is not legal advice. We build software; we are not lawyers. Laws differ between countries, and how they apply depends on facts this article can't know. Use this page to understand the questions and find the primary sources, then ask a qualified lawyer in your jurisdiction about your situation.
The short answer
An antidetect browser is a web browser that keeps many profiles separate, each with its own cookies, proxy and fingerprint settings. We are not aware of laws that single out this kind of software, and owning or running a browser with extra privacy and separation settings is generally not the legal issue. What you do with it can be.
The same profile can be used to manage a client's ad account under a signed contract, or to run fake accounts that deceive buyers. The browser is the same in both cases. The law, and the platform's terms, look at the conduct.
So the useful questions are:
- Whose accounts are you running, and are you authorized to run them?
- What do the terms of each platform you use say?
- Could anything you do deceive someone, cause them a loss, or access a system you aren't allowed into?
- What personal data do your profiles hold, and how do you protect it?
The tool versus the use
Most technology that can protect privacy can also hide misconduct. VPNs, proxies, private browsing, password managers and virtual machines all fall in this category. Their legality is generally judged by use.
Legitimate uses of an antidetect browser include:
- An agency keeping each client's social and ad accounts in a separate profile, with the client's permission.
- A company running separate stores for separate brands or markets, each in its own profile.
- A QA team testing a site from different locations, languages and fresh-cookie states, with test accounts it controls.
- A person keeping work, personal and research browsing from being linked by trackers.
Uses that are likely to be unlawful in many places, whatever browser is used, include:
- Logging in to accounts you have no permission to use.
- Creating fake identities to defraud buyers, sellers, advertisers or platforms.
- Writing fake reviews, or creating fake reviewers.
- Using stolen identity documents or payment details.
Terms of service are contracts, not laws
Platform rules and laws are different things, and it helps to keep them apart.
A platform's terms of service are a contract between you and the platform. Breaking them is usually not a crime in itself. The platform's remedies are typically the ones written in its terms, such as removing content, restricting features, or suspending and closing accounts. Those consequences can still be serious for a business.
Terms often speak directly to multiple accounts and identity. Two examples:
- Google. Google's Terms of Service (effective July 30, 2026, when we checked) list "hiding or misrepresenting who you are in order to violate these terms" among the forms of abuse they prohibit.
- Meta. Meta's Terms of Service, at the time of writing, ask users to "create only one account (your own) and use it for personal purposes".
Terms change, and the version that applies is the current one on the platform's site. Read the terms of every platform you use, along with any separate policies for advertisers, sellers or developers.
Many platforms also provide official ways to delegate work: business managers, partner access, user roles and seller sub-accounts. When a platform offers a way for an agency or a VA to work in a client's account, use it. Separate browser profiles help keep that work organized; they don't replace the platform's own permission system.
If a platform has suspended or banned an account, creating new accounts to get around that decision is a terms violation on most platforms. Multime is not built for that, and we don't help with it.
Where the law comes in
Some conduct goes beyond a contract dispute. The examples below show the kinds of laws involved. They are not a complete list, and the exact rules differ by country and state.
Computer misuse laws
In the United States, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, covers anyone who "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains" information from a protected computer (§ 1030(a)(2)). Section 1030(a)(4) covers access with intent to defraud. Section 1030(g) also lets "any person who suffers damage or loss by reason of a violation" bring a civil action, so companies can sue as well as prosecutors charging.
The Supreme Court addressed what "exceeds authorized access" means in Van Buren v. United States (2021). The Court held that a person exceeds authorized access when they access a computer with authorization but then obtain information in areas of it, "such as files, folders, or databases", that are off limits to them. In footnote 8, the Court said it did not need to decide whether this turns only on technological limits or also on limits in contracts or policies. That question matters for terms-of-service cases, and the Court left it open.
Other countries have their own laws. In the United Kingdom, section 1 of the Computer Misuse Act 1990 covers causing a computer to perform a function with intent to secure access to a program or data when the person knows that access is unauthorized. In the European Union, Directive 2013/40/EU on attacks against information systems requires member states to make certain kinds of illegal access a criminal offense.
The common thread is authorization. Logging in to an account you own or have been given permission to manage is a very different situation from getting into one you have no right to use.
Fraud and deception
Fraud laws apply regardless of the tools involved. In the US, the wire fraud statute, 18 U.S.C. § 1343, covers schemes to defraud that use wire, radio or television communications in interstate or foreign commerce. In England and Wales, section 2 of the Fraud Act 2006 covers dishonestly making a false representation intending to make a gain or cause a loss.
Fake reviews are a specific example. The US Federal Trade Commission's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, makes it an unfair or deceptive practice for a business to write, create or sell reviews that misrepresent, among other things, that the reviewer exists. Running a set of profiles to post reviews from invented customers is the kind of conduct this rule targets.
The privacy angle: GDPR and ePrivacy
Privacy law touches antidetect browsers from two sides.
Websites that fingerprint you
In the EU, the European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive state that fingerprinting falls within the scope of that article, the same provision behind cookie consent banners. Limiting how much your browser reveals to trackers is a reasonable privacy choice. We explain the techniques in what is browser fingerprinting.
Data you hold in your profiles
If you manage accounts for clients, your profiles hold other people's data: cookies, saved logins, 2FA secrets and the contents of the accounts themselves. Under the GDPR, personal data includes information that identifies a person directly or indirectly, including through "an online identifier" (Article 4(1)). Recital 30 names IP addresses and cookie identifiers as examples of online identifiers that can be used to build profiles of people.
If GDPR applies to your work, a few articles are especially relevant:
- Article 28 requires a contract or other legal act when one business processes personal data on behalf of another, which is often the case when an agency manages client accounts.
- Article 32 requires appropriate technical and organizational security measures and names encryption as one example.
- Article 5 sets out principles such as data minimization and storage limitation, so remove profiles and saved logins you no longer need.
Where your data lives is part of this. Multime keeps profiles, cookies and saved logins in a local database on your computer, not in a Multime cloud, and encrypts passwords, 2FA keys, proxy passwords and cookies with AES-256-GCM, with the key protected by macOS Keychain or Windows DPAPI. That makes it easier to know where client data is. It doesn't make you compliant by itself; your contracts, access rules and habits matter more. Read more on our local-first page.
Questions to ask before you start
Run through these before you set up profiles for a new client or project:
- Do we have written permission from the account owner to access and manage each account?
- Have we read the platform's terms and any advertiser, seller or developer policies, and does our setup follow them?
- Is there an official delegation feature (business manager, partner access, user roles) we should use instead of, or alongside, shared logins?
- Could anything we do mislead buyers, users, advertisers or the platform about who is acting?
- What personal data will the profiles hold, who can see it, and when will we delete it?
- Which countries' laws apply, given where we, our clients and their users are?
- Do we need advice from a lawyer before we start? For anything that involves other people's money, identity or data at scale, the answer is often yes.
How Multime approaches this
Multime helps people keep accounts separate and organized. Platform rules still apply. We don't describe Multime as a way to avoid detection, we don't make claims about what any platform can or can't detect, and we don't give advice on getting around bans or restrictions.
The features are built for authorized work: separate profiles per client or store, encrypted saved logins in each profile, per-person permissions for VAs, a lock so one person uses a profile at a time, and an activity log of every action on the owner's dashboard.
Sources
- 18 U.S.C. § 1030 (Computer Fraud and Abuse Act), Legal Information Institute, Cornell Law School.
- Van Buren v. United States, No. 19-783, Supreme Court opinion, decided June 3, 2021.
- 18 U.S.C. § 1343 (wire fraud).
- 16 CFR Part 465, Rule on the Use of Consumer Reviews and Testimonials.
- Computer Misuse Act 1990, section 1 and Fraud Act 2006, section 2, legislation.gov.uk.
- Directive 2013/40/EU on attacks against information systems.
- Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC (ePrivacy Directive).
- EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, adopted October 7, 2024.
- Google Terms of Service and Meta Terms of Service.