Law / United States / 
Georgia
Georgia Computer Systems Protection Act, computer theft, trespass, invasion of privacy, forgery, password disclosure
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not use a Georgia-connected computer or computer network in a manner that exceeds the right or permission its owner granted; ordinary access to a page that grants and denies no specific permission at all does not, on the statute's own text, become use 'without authority.'
- Do not take, delete, alter, or interfere with computer data, programs, or operation without authority; doing so with the required intent is computer theft or computer trespass regardless of whether the access was automated.
- Do not use a computer without authority to examine another person's employment, medical, salary, credit, or other financial or personal data; this reaches automated collection of such data just as it reaches direct access.
- Expect a private civil action for damages in addition to criminal prosecution if your access violates this Act; the civil claim under subsection (g) carries a four-year discovery-based limitations period.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Computer theft, computer trespass, computer invasion of privacy, and computer forgery are each punishable by a fine of up to $50,000 or imprisonment of up to 15 years, or both. Computer password disclosure carries a separate, lower penalty of a fine up to $5,000 or up to one year of incarceration, or both.
Penalty structure
The $50,000 maximum fine applies to computer theft, computer trespass, computer invasion of privacy, and computer forgery. Computer password disclosure carries a separate, lower fixed cap of $5,000, tied to a one-year imprisonment maximum rather than 15 years.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Criminal prosecution proceeds through the ordinary state criminal process (district attorneys and solicitors-general); subsection (g)'s civil action is privately enforced and runs independently of any prosecution.
Settledness
- As of
- Open questions
- Does an automated request to a public web page made against the operator's terms of use come within 'uses a computer or computer network with knowledge that such use is without authority' in section 16-9-93(b), when the request obstructs, interrupts or interferes with the use of a computer program or data?
- Does a person 'whose property or person is injured by reason of a violation' under section 16-9-93(g)(1) recover where the only loss is the cost of responding to automated access, given that 'damages' include 'loss of profits and victim expenditure'?
What it makes you log
Logging duty
Subsections (a) to (e) define computer theft, computer trespass, computer invasion of privacy, computer forgery and computer password disclosure, subsection (g) gives an injured person a civil action for damages and costs with a four-year limitation, and subsection (h) sets the criminal penalties. Subsection (g)(2) directs the court, at the request of a party, to protect the secrecy and security of any computer, network, data or program involved in the proceedings, which is a rule for how a court conducts the case and not a duty on anyone to create, keep, produce or review a log or record. No subsection requires a log, record, retention period or audit, and the section states no territorial hook.
- Kind
- None
- As of
What this law does
Section 16-9-93 makes it a crime, whenever committed without authority, to take or appropriate another's property using a computer (computer theft), to delete, obstruct, or damage computer data, programs, or operation (computer trespass), to examine another person's employment, medical, salary, credit, or other financial or personal data (computer invasion of privacy), to create, alter, or delete data in a way that would be forgery if done on paper (computer forgery), or to disclose a password or access code resulting in damages over $500 (computer password disclosure).
'Without authority' is defined at Section 16-9-92(18) to include use that exceeds any right or permission the computer's owner granted, a test closer to the federal Computer Fraud and Abuse Act's exceeds-authorized-access standard than to Virginia's added malicious-intent or deceptive-means requirement. Subsection (g) grants any person injured by a violation a civil action for damages and costs, not limited to the criminal remedy, with a four-year discovery-based limitations period.
Subsection (f) is a general savings clause preserving the applicability of any other law that presently applies or may apply to the same conduct; it does not name contract law specifically. The section's history note names the act that enacted it, and the codified text does not state the day on which the section came into force.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .