Are Phone Farms Legal?

Search for “phone farm” and half the results describe a crime while the other half describe a business tool. Both are right, because the term covers very different operations. This guide separates them: what the law prohibits in the UK, the US and India as of October 2026, what platform terms prohibit (a different thing with different consequences), and how legitimate operators stay on the right side of both. Every law and policy quoted here is linked to its official source, and listed with the date we checked it at the end.

This article is general information, not legal advice. Laws change and differ by country. If your business depends on the answer, have a lawyer in your jurisdiction review your setup.

Are phone farms legal?

In the three jurisdictions this guide checks, no law we found bans owning or renting many phones. Agencies, QA teams and app developers run fleets of devices every day. What the law targets is what the phones are used for, plus, in the UK, one specific kind of hardware: the SIM farm, whose possession without a good reason is an offence from 29 October 2026.

Three layers decide whether a given phone farm is a problem:

• The law: fraud, fake reviews, selling or buying fake engagement, telecom fraud and, in the UK, possessing a SIM farm without a good reason.
• Platform terms: each app’s own rules on multiple accounts, automation and authenticity. Breaking them is not a crime in itself; the usual consequence is losing accounts.
• Your own contracts: client agreements, confidentiality duties and your provider’s acceptable-use policy.

Phone farm, click farm, SIM farm: what is the difference?

The three terms overlap in conversation but describe different things, and only one of them is a named offence in UK law.

• Phone farm: any fleet of smartphones operated together, whether loose phones on racks, a box of phone mainboards, or cloud phones rented in a datacenter. The term says nothing about purpose.
• Click farm: an operation that produces fake clicks, installs, likes, follows, views or reviews, by people or by scripts, often on a phone farm. The output is the problem, not the hardware.
• SIM farm: under the UK’s Crime and Policing Act 2026, a device able to use five or more physical SIM cards, at the same time or in turn, to call phone numbers or to send and receive text messages. It is defined by SIM capacity, not by the apps it runs.

A phone farm can be turned into a click farm, and a hardware farm whose boards take SIM cards can also meet the SIM-farm definition. A phone farm built on cloud phones that hold no SIM card is neither by default. What it becomes depends on what you do with it.

Why do ad-fraud companies say phone farms are illegal?

Because they are describing one specific use. Attribution and fraud-prevention companies write about device farms from the advertiser’s side, where the farm exists to fake installs and clicks and collect payouts for them. AppsFlyer’s glossary defines device farms as “a type of mobile ad fraud” and says that device farms maintained for ad fraud “are illegal in much of the world.”

The mechanics explain the framing. An ad-fraud farm installs an advertised app on many devices, opens it, then resets the device’s advertising identifiers so each install looks like a new user; AppsFlyer calls this DeviceID reset fraud. The advertiser pays for users who never existed. That is fraud under ordinary law, whatever hardware performs it.

Those glossary pages rarely mention that the same hardware runs QA labs, regional testing and agency account work. Read them as a description of one misuse, not as a ruling on the equipment.

What makes a phone farm illegal?

Across the jurisdictions checked here, the uses that turn a phone farm into a legal problem are consistent:

• Selling or buying fake engagement for a commercial purpose: followers, views, likes or subscribers produced by bots or fake accounts. The US FTC rule described below targets this directly.
• Fake reviews: writing, commissioning or posting reviews that do not reflect a real customer’s experience. The UK bans this outright and the FTC rule covers it in the US.
• Ad and install fraud: faking clicks or installs to collect advertising payouts.
• Scam calls and texts: the main use of SIM farms, already illegal under fraud law and also targeted at the hardware level in the UK.
• Account takeover and impersonation: logging into accounts you do not own, or creating accounts in someone else’s name without their consent.
• Telecom identifier fraud: in India, tampering with IMEI numbers or obtaining SIM cards through fraud are offences under the Telecommunications Act, 2023.

Notice what is not on that list: owning many devices, running accounts you are entitled to run, automating your own work, or using proxies. Some of those can break a platform’s rules, a separate question covered further down, but no law we checked makes them crimes in themselves.

What does the UK SIM-farm law ban?

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Sections 151 and 152 create two offences: possessing a SIM farm without a good reason or lawful authority, and supplying one unless set conditions are met. After a six-month transition, the offences apply from 29 October 2026, according to Home Office guidance published on GOV.UK on 27 July 2026.

The definition is narrow and hardware-based. A SIM farm is a device “capable of using five or more physical SIM cards simultaneously or interchangeably” to make calls to telephone numbers or to send messages to, or receive them from, such numbers. The guidance explains the reasoning: scam texts are frequently traced to SIM farms, and while sending scam messages was already illegal under the Fraud Act 2006, owning the equipment was not.

Key points from the guidance:

• Possession is an offence only without a good reason or lawful authority. Broadcasting, transport and electronic communications are given as examples, and the guidance says the list is not exhaustive.
• Suppliers must have a good reason, take reasonable and proportionate steps to check that the buyer has one, and keep a record of each supply: the date, a description of the device, the recipient and the checks made.
• From 29 October 2026, a person convicted may be liable, on summary conviction, to a financial penalty.
• Bonded-IP video encoders used by broadcasters are generally not classed as SIM farms, because in many cases they cannot make calls or send texts.

For phone farms, the test is physical SIM cards used for calls and texts. An ordinary phone with one or two SIM slots does not reach a five-SIM threshold. Equipment that runs five or more SIM cards through one device for calls or texts, such as a SIM box or a SIM-equipped phone-farm chassis, may meet the definition, so UK owners of that kind of hardware should be able to show a good reason for holding it. DeviceFarm cloud phones hold no SIM cards. If you are unsure how the definition applies to your equipment, ask a UK solicitor.

The UK also bans fake reviews

Separately, the Digital Markets, Competition and Consumers Act 2024 added an explicit ban on posting and commissioning fake reviews to the UK’s list of banned practices. The Competition and Markets Authority announced the new consumer regime as in force on 7 April 2025 and can fine companies that break consumer law up to 10% of their global turnover.

What does US law say about fake followers and views?

The Federal Trade Commission’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, announced on 14 August 2024 and in effect since 21 October 2024, is the clearest federal rule on fake engagement. Section 465.8 makes it an unfair or deceptive practice to sell or distribute, or to buy or procure, fake indicators of social media influence that the person knew or should have known were fake, when they misrepresent influence or importance for a commercial purpose.

The rule defines those indicators broadly: followers, friends, connections, subscribers, views, plays, likes, saves, shares, reposts and comments. They count as fake when generated by bots, by accounts not tied to a real individual, by accounts created with someone’s personal information without consent, or by hijacked accounts.

The FTC said the rule lets it seek civil penalties against knowing violators, and the same rule bans fake consumer reviews and testimonials. Two limits matter for operators. The rule is about commercial misrepresentation, so running several honest accounts does not create a fake indicator. And it covers buyers as well as sellers: purchasing followers or views for a commercial account is exposed, not only selling them.

Is phone farming illegal in India?

We found no Indian law that names phone farms. The closest rules are in the Telecommunications Act, 2023, which the Department of Telecommunications summarized in a Press Information Bureau release on 24 November 2025:

• Section 42(3)(c) prohibits tampering with telecommunication identifiers such as IMEI numbers.
• Section 42(3)(e) bars obtaining SIM cards or telecommunication identifiers through fraud, cheating or impersonation.
• Section 42(3)(f) makes it an offence to willfully possess radio equipment, such as a handset, modem, module or SIM box, knowing that it uses unauthorized or tampered telecommunication identifiers.

Penalties reach three years in prison, a fine of up to Rs 50 lakh, or both, and DoT describes the offences as cognizable and non-bailable. DoT also warns that people who hand SIM cards registered in their name to others can be held liable if those SIMs are misused. Anyone operating devices in India should have local counsel review their hardware, SIM sourcing and use case.

Is running multiple accounts against TikTok’s or Instagram’s rules?

Not in itself. Multi-accounting is common and often explicitly allowed. What platforms prohibit is deception, automation that bypasses their systems, and bought engagement. Here is what each says in its own terms, as checked in October 2026:

• TikTok: its Community Guidelines, released 25 August 2026 and effective 24 September 2026, say “You can have multiple accounts—for example, for fan content or creative expression—but not to deceive others or break the rules.” The same section lists “Using automation to run many accounts or send repetitive content” and “Buying or selling followers or engagement for financial gain” as spam, and says TikTok strictly prohibits “automation tools, scripts, or other tricks designed to bypass our systems.”
• Instagram: the Terms of Use require accurate registration information and forbid impersonation, creating an account for someone else without their express permission, and “creating accounts or accessing or collecting information in an automated way without our express permission.” The Help Center says you can have up to 10 accounts logged in at one time; Instagram multiple accounts covers what links them.
• Facebook: Meta’s Terms of Service ask each person to “Create only one account (your own) and use it for personal purposes.”

So the same activity can be fine on one platform and a violation on another, and automation is where the rules are strictest. If you plan to automate, read each target platform’s current rules first. Automation tools, ours included, do not change what the destination app allows.

Breaking a platform’s terms is a matter between you and the platform, not a crime in itself, and the usual consequence is account restrictions or bans. It becomes a legal problem when the same conduct is also unlawful on its own: fraud, impersonation, or selling fake engagement.

What happens when you break platform rules?

Platforms enforce against accounts and the people behind them, and their own terms describe how far that reaches:

• TikTok says that if it finds deceptive account behavior it may ban your account, ban additional or new accounts you create, or restrict your account, which can limit posting, search visibility and the For You feed. It also removes fake likes, followers and other inflated signals it detects.
• TikTok adds: “If your account is restricted or banned, you may not create or use another account to get around it.”
• Meta’s Terms say that if Facebook disables your account for a violation, you agree not to create another account without its permission.

This is why account linking matters even for fully legitimate operators. When a platform connects accounts through a shared device, IP address or phone number, enforcement on one can reach the others; does TikTok ban all your accounts walks through how that linking works. Keeping each client’s accounts on separate devices and networks is how agencies stop one client’s problem from becoming every client’s problem; running multiple accounts without bans covers the mechanics, and device isolation defines what has to be separate.

What are the legitimate uses of a phone farm?

Most fleets exist for unglamorous reasons. The common legitimate ones:

• Agencies managing client accounts: each client’s accounts on their own devices, with the client’s consent and the client as the account owner. Phone farm for agencies shows how teams structure this.
• QA and app testing: checking builds across Android versions and device profiles, often alongside an emulator grid. The Android device farm page covers the testing side.
• Regional testing: seeing an app, store listing or ad the way users in another country see it, through a proxy in that country. A single Android cloud phone with a proxy in the target market is enough for that.
• Brand operations: a business running its own accounts across several platforms and regions, with staff working from one dashboard.
• Development: building integrations or automation against apps whose terms allow it.

The line between a phone farm and a click farm is easy to state: every account belongs to a real person or business that knows about it, and nothing the farm produces pretends to be an audience that does not exist.

How do legitimate operators stay compliant?

• One real owner per account: a person or business that consents to the account and can recover it. No accounts in other people’s names.
• No bought engagement: no purchased followers, views, likes or reviews, for yourself or for clients.
• Read the target platform’s rules before automating: scheduling your own posts is different from using scripts to run many accounts, and some platforms prohibit the latter outright.
• Written client agreements: who owns each login, who may post, and what happens to the accounts when the contract ends.
• Careful handling of credentials: client logins and any personal data in the accounts belong in an access-controlled workspace or password manager, not a shared spreadsheet.
• Your own records: which device runs which account, who on your team worked on it, and when. A simple register answers questions from clients and platforms long after memory fails.
• Know your hardware: if you run devices in the UK that take five or more SIM cards, be ready to show a good reason under the SIM-farm rules, which apply from 29 October 2026.

What DeviceFarm does not support

Our terms of service prohibit using DeviceFarm for illegal activity or to violate third parties’ rights; for unsolicited bulk messages, spam, phishing or malware; for attacking or probing other systems; and for violating the terms of the apps you run in ways that expose us to legal liability. You remain responsible for the content you post and for following each destination platform’s terms. We do not sell followers, views, reviews or accounts, and our cloud phones hold no SIM cards.

The short version

Phone farms are legal equipment in the UK, the US and India; fraud, fake engagement, fake reviews and SIM-based scam operations are not. The UK adds a hardware offence for devices running five or more physical SIM cards, which applies from 29 October 2026, and India penalizes tampered telecom identifiers and fraudulently obtained SIMs. Platform terms are a separate layer: breaking them costs accounts unless the conduct is also unlawful. Run client accounts with consent, on isolated devices, without bought engagement, and you are where legitimate operators are. To see what an isolated fleet costs, the pricing page lists every tier from 20 to 6,000 phones, phone farm rental explains the 30-day terms, and cloud phones for TikTok shows the one-device-per-account setup in practice.

Sources

• Home Office, Crime and Policing Act 2026 guidance: offences relating to the possession and supply of SIM farms, GOV.UK, published 27 July 2026, checked 4 October 2026.
• Crime and Policing Act 2026 (c. 20), legislation.gov.uk, checked 4 October 2026.
• CMA to boost consumer and business confidence as new consumer protection regime comes into force, Competition and Markets Authority, published 7 April 2025, checked 4 October 2026.
• Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials, FTC, 14 August 2024, checked 4 October 2026.
• Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, Federal Register, 22 August 2024, checked 3 October 2026.
• Department of Telecommunications release on the Telecommunications Act, 2023, Press Information Bureau, 24 November 2025, checked 3 October 2026.
• What is a device farm?, AppsFlyer glossary, checked 4 October 2026.
• TikTok Community Guidelines: Integrity and Authenticity, released 25 August 2026, effective 24 September 2026, checked 4 October 2026.
• Instagram Terms of Use, checked 3 October 2026.
• Instagram Help Center: add and switch between multiple profiles, checked 3 October 2026.
• Meta Terms of Service, checked 3 October 2026.