A Pokémon card bot is a program that buys for you. It watches a store. When a product goes on sale, it adds it to the cart and checks out faster than a person can click.
This page explains how Pokémon Center tries to keep a drop fair. It also covers what its rules and US law say about bots, and where proxies come in. On 12 October 2026 we also checked how eight stores that sell the cards answer a plain request from our server.
The short answer
- Pokémon Center's terms bar bots. They allow purchases "for personal use" and forbid "robots or similar data gathering or extraction methods".
- No US federal law bans retail checkout bots. The BOTS Act covers event tickets. A bill to cover online shops has been introduced in every Congress since 2018 and never came to a vote.
- Stores answer with limits, queues and bot defenses. Pokémon Center and GameStop blocked the plain request from our server.
- Proxies let one bot look like many shoppers. That is the part the store's terms forbid, so this page sets up no bot and no proxy for a store.
How Pokémon Center tries to keep a drop fair
Pokémon Center describes several measures on its help pages.
- Purchase limits. "Adhere to Pokémon Center purchase limits, which are displayed on the product page."
- A virtual queue. The store calls it "one measure of many". Extra tabs, other links or "attempting any workarounds will not help you bypass the virtual queue". Also, "Waiting in line does not guarantee product availability".
- Invitations. For some products, chosen customers in the US, Canada and the UK get a personal link to buy. More newsletter sign-ups or email addresses do not raise the odds, and "Such actions may result in the invitation being voided".
- No VPN. The queue page says "Refrain from using a VPN." The FAQ for the 30th Celebration cards says "Turn off your VPN if you are using one."
The store's terms, below, are where bots are named. Our page on Pokémon Center's bot check and queue goes deeper into the store itself.
What the store's terms say
Pokémon Center's terms were last updated on 17 April 2026. The store answers our server with a block page, so we read the Internet Archive copy of 29 June 2026.
They allow purchases "for personal use by either yourself or your intended recipient of the products". The store may limit quantities "per order, per account, per credit card, per person, or per household". It may also "refuse service to any customer or reject any order at any time" and refund the money.
The same terms bar three things.
- Anything that would "bypass or circumvent measures employed to prevent or limit access" to the store.
- Applications that interact with the store "without our prior written consent".
- "data mining, robots or similar data gathering or extraction methods".
A checkout bot is an application that talks to the store, so it needs that written consent. The store's help page on canceled orders names other common reasons: a product that ran out, or a card that changed after the order.
What US law says
The BOTS Act of 2016 is about event tickets. It makes it unlawful to get around a measure "used by the ticket issuer to enforce posted event ticket purchasing limits". It also covers reselling tickets bought that way.
A bill called the Stopping Grinch Bots Act would add the same rule for online shops. Its 2025 version bars getting around a measure used "to enforce posted purchasing limits or to manage inventory". The Federal Trade Commission and state attorneys general would enforce it.
GovTrack, which follows the records of Congress, lists nine bills under that name. All nine stopped at "introduced".
| Year introduced | Bills | Status |
|---|---|---|
| 2018 | H.R. 7160 | Introduced, no vote |
| 2019 | H.R. 5263 and S. 2957 | Introduced, no vote |
| 2021 | H.R. 6096 and S. 3276 | Introduced, no vote |
| 2023 | S. 3511 and H.R. 6837 | Introduced, no vote |
| 2025 | H.R. 6822 and S. 3516 | Introduced, no vote |
So in the US, the rule a card bot breaks is the store's own. We did not check the laws of each state or of other countries.
What eight card stores did with a plain request
On 12 October 2026 we asked each store for its home page once, from our server. The request used a desktop Chrome user agent and no JavaScript. Our server has a datacenter address. We also read each store's robots.txt file for rules about carts, checkout and orders.
| Store | Answer | Bot defense in headers and cookies | Cart, checkout or order rules in robots.txt |
|---|---|---|---|
| Pokémon Center | 403, a block page | Imperva, DataDome | 6 |
| GameStop | 403, a Cloudflare challenge | Cloudflare | robots.txt refused too |
| Target | 200, the shop | HUMAN (PerimeterX) | 12 |
| Walmart | 200, the shop | Akamai | 1 |
| Best Buy | 200, the shop | Akamai | 6 |
| Costco | 200, the shop | None seen | 15 |
| Amazon | 202, a 2 KB page without the shop | None seen | 3 |
| TCGplayer | 200, the shop | None seen | 0 |
The two blocks match our August study of 52 retailers. Pokémon Center ran Imperva there too, and GameStop challenged a datacenter address.
A shop that loads can still score the visitor before checkout. Target, Walmart and Best Buy set the cookies of their bot defenses on the very first answer. Six of the eight stores ask crawlers to stay out of carts, checkout or orders.
Where proxies come in
Limits and bot defenses look at the network address, among other signals. A bot that runs many checkouts at once spreads them over many addresses, so each looks like a separate shopper.
A home connection can pass where a datacenter address is stopped. In our August study, nine stores loaded for a home connection and blocked or challenged the same request from a datacenter server.
Using many addresses to get past a store's limits is what Pokémon Center's terms bar. It is a way to "bypass or circumvent measures employed to prevent or limit access". The store also asks shoppers to turn VPNs off.
So this page shows no bot setup and no proxy settings for a store. If you buy cards for yourself, follow the store's own advice. Use your own account and address, no VPN, and the queue or an invitation. Our page on proxies for Pokémon TCG covers proxy cards and the tournament rules.
What this page could not check
- One plain request per store, from one server, without JavaScript. A browser may get a different answer, and stores change their defenses.
- We did not join a queue, log in, buy anything or run a bot.
- Pokémon Center's terms come from an Internet Archive copy of 29 June 2026, because the live page showed our server a bot check.
- US federal law only. We did not check state laws or other countries.
- The list of bills comes from GovTrack, because congress.gov refused our server.
- We will check this page again by 12 January 2027.
Sources
- Pokémon Center Support: Pokémon Center Virtual Queue, 30th Celebration TCG FAQ, Pokémon Center: Invite Only FAQ and Why was my order canceled?.
- Pokémon Center Terms of Use, last update 17 April 2026, read from an Internet Archive copy of 29 June 2026.
- 15 U.S.C. 45c, the BOTS Act: govinfo.gov.
- H.R. 6822, the Stopping Grinch Bots Act of 2025, as introduced: govinfo.gov.
- GovTrack, the bill records: govtrack.us.
- Our requests to eight stores from our own server, 12 October 2026, and our retail bot-defense study of 24 August 2026.
