YouTube's fake engagement policy prohibits anything that artificially increases views, likes, comments or subscribers, whether through automated systems or by tricking people into playing videos they never chose. Breaking it can mean removed content and, in serious or repeated cases, a terminated channel.
The legal side depends on where you are and why you're buying. In the United States, a 2024 Federal Trade Commission rule prohibits buying or selling fake social media influence, including bot views and subscribers, to misrepresent influence for business purposes. If your channel sells anything, that's worth knowing. This is general information, not legal advice.