United StatesComputer Fraud and Abuse Act (unauthorized access and the gates-based authorization test)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Scraping a public, unauthenticated page does not by itself expose you to Computer Fraud and Abuse Act (CFAA) liability (hiQ Labs v. LinkedIn, 9th Cir. 2022).
- Do not continue accessing a site, or circumvent a technical block, after the operator has sent an individualized notice revoking your access (Facebook v. Power Ventures, 9th Cir. 2016).
- A CFAA win does not clear you of state-law exposure: hiQ itself was ultimately held liable under contract and trespass-to-chattels theories for the same conduct.
These lines are LexLint's reading of the law's text. Also read by: U.S. Department of Justice (guidance, recorded ); Van Buren v. United States, No. 19-783 (U.S. ) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Ninth Circuit distinguished Facebook v. Power Ventures, which involved password-protected profiles, from the public pages at issue in hiQ Labs v. LinkedIn.
- As of
- Case link
- https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf
- Guidance link
- https://www.justice.gov/jm/jm-9-48000-computer-fraud
- Case citation
- Van Buren v. United States, No. 19-783 (U.S. )
- Guidance body
- U.S. Department of Justice
- Open questions
- Does the gates-up-or-down inquiry of Van Buren v. United States turn only on technological limits on access, or also on limits in contracts or policies, when a site's terms of service bar automated collection from pages that carry no login?
What it makes you log
Logging duty
Section 1030(a)(2) makes it an offense to intentionally access a computer without authorization, or exceed authorized access, and thereby obtain information. The section imposes no duty to create, keep, produce or review a log or record; its mentions of a financial record describe the information the offender obtains. The definition of a protected computer in section 1030(e)(2)(B) reaches a computer outside the United States used in a manner that affects interstate or foreign commerce or communication of the United States.
- Kind
- None
- As of
What this law does
The Computer Fraud and Abuse Act (CFAA) prohibits intentionally accessing a protected computer without authorization, or exceeding authorized access.
The Supreme Court held in Van Buren v. United States (593 U.S. 374, 2021) that exceeding authorized access is a gates-up-or-down inquiry into files or areas an existing permission structure puts off limits, not a purpose-based test, and the Ninth Circuit held in hiQ Labs v. LinkedIn (31 F.4th 1180, 2022) that without authorization does not reach a computer presumptively open to all comers, so a public, unauthenticated page has erected no gate at all.
The line runs through revocation: in Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016), discussed inside the hiQ opinion, liability attached once the scraper, after an individualized cease-and-desist, circumvented an IP block to keep reaching password-protected profiles. hiQ's own case did not end there: on remand it entered a stipulated consent judgment (N.D. Cal., filed Dec.
2022, secondary-sourced) holding it liable for breaching LinkedIn's User Agreement and for California trespass to chattels and misappropriation, for $500,000 and a permanent injunction, despite winning the CFAA claim outright. Section 1030 was added by the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub.
L. 98-473, title II, § 2102(a); the without-authorization and exceeds-authorized-access language the courts above construe was already present in that original 1984 enactment, so the section dates to its original commencement rather than to the 1986 amendments that broadened its reach to protected computers generally.
How courts have read itPremium data
Our analysis of this law draws on 46 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .