Law / United States / 
California
Comprehensive Computer Data Access and Fraud Act (knowing access without permission)
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not continue accessing a California site, or circumvent a technical block, after the operator has sent a cease-and-desist notice (Facebook v. Power Ventures, 9th Cir. 2016; Craigslist v. 3Taps, N.D. Cal. 2013).
- Note that this statute's without permission standard has no threshold requirement that your initial access be unauthorized, unlike the federal Computer Fraud and Abuse Act (CFAA).
These lines are LexLint's reading of the law's text. Also read by: Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://cdn.ca9.uscourts.gov/datastore/opinions/2016/07/12/13-17102.pdf
- Case citation
- Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016)
- Open questions
- Does a scraper act "without permission" under Penal Code section 502(c)(2) when the operator has imposed only a technical block, such as an IP block, and has sent no cease and desist letter?
- Does a scraper that copies data from a publicly accessible page act "without permission" under Penal Code section 502(c)(2) because the operator's terms of use prohibit automated collection?
What it makes you log
Logging duty
Section 502(c) lists the public offences of knowing access without permission, from altering or deleting data to taking, copying or using it, subdivision (e) gives the owner a civil action and subdivision (d) sets the punishments. Nothing in the section requires anyone to create, keep, produce or review a log or record; the word record appears only in the definition of a computer contaminant. Subdivision (j) treats a person who accesses a computer in one jurisdiction from another as having accessed it in each, which turns on where the computer is and names no territorial hook.
- Kind
- None
- As of
What this law does
Section 502(c) criminalizes knowing access without permission, and the Ninth Circuit has said the statute is different from the federal Computer Fraud and Abuse Act (CFAA) because it does not require unauthorized access and merely requires knowing access. Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016) held a scraper's originally-permitted access did not violate this section, but access became without permission once Facebook sent a cease-and-desist and IP-blocked the scraper and it continued anyway.
Craigslist v. 3Taps (964 F. Supp. 2d 1178, N.D. Cal. 2013) denied a motion to dismiss CFAA and section 502 claims against a scraper alleged to have kept scraping after a personally addressed cease-and-desist letter and an IP block. The court reasoned that a person of ordinary intelligence would understand those actions as a revocation of authorization to access the website. The current section was added by chapter 1499 of the Statutes of 1987.
The section's history note records only its most recent amendment, and no day on which chapter 1499 came into force has been located.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .