How the Computer Fraud and Abuse Act Defines Illegal Computer Access

What is the Computer Fraud and Abuse Act?

United States federal prosecutors and civil plaintiffs rely on the Computer Fraud and Abuse Act, a 1986 law codified at 18 U.S.C. § 1030, to pursue anyone who accesses a computer without permission or beyond the permission they were given. The statute's core provision, § 1030(a)(2), imposes liability on a person who "intentionally accesses a computer without authorization or exceeds authorized access" and thereby obtains information from a computer used in interstate commerce, a category that covers nearly any computer connected to the internet. The CFAA supports both criminal charges brought by the Department of Justice and civil lawsuits brought by a company whose computers were accessed, which is why it shows up constantly in disputes over scraping, former employees, and account misuse.

This page explains what the statute says and how two court rulings shaped its meaning. It is not legal advice, and a business weighing a scraping project or an access dispute needs its own lawyer to apply these rulings to its facts.

What does the CFAA actually prohibit?

The CFAA prohibits seven categories of conduct against a "protected computer," and the two that come up most often outside national security cases are accessing a computer "without authorization" and accessing a computer with permission but then obtaining information the accesser is not entitled to obtain, which the statute calls exceeding authorized access. Section 1030(e)(6) defines "exceeds authorized access" as accessing "a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." The statute attaches criminal penalties and, through § 1030(g), a civil right of action to this conduct when it causes qualifying damage or loss.

The mechanism that makes the CFAA so contested is what it leaves undefined. Congress wrote a precise definition for "exceeds authorized access" but never defined "without authorization" at all, leaving courts to work out where a person's permission to be on a computer system ends.

What does "without authorization" mean under the CFAA?

The phrase "without authorization" is not defined anywhere in 18 U.S.C. § 1030, and that gap is the reason the CFAA has produced conflicting rulings across the federal courts of appeal for two decades. Some courts read the phrase narrowly, to mean bypassing a technical barrier like a password or a login wall, while others read it more broadly, to include violating a website's terms of service after being told to stop. A company that wants a visitor treated as unauthorized has to point to something concrete, such as revoked credentials or a cease-and-desist letter, rather than relying on the statute's own wording to supply the line.

What did Van Buren v. United States decide?

The Supreme Court decided Van Buren v. United States on June 3, 2021, holding that a person "exceeds authorized access" under the CFAA only when they access a computer with permission and then reach a file, folder, or database that is off limits to them, not when they misuse information they were otherwise allowed to reach. The case involved a Georgia police sergeant, Nathan Van Buren, who used his own valid patrol-car credentials to search a license plate database in exchange for money, a use his department's policy forbade. Writing for a six to three majority, Justice Barrett rejected the government's argument that violating a computer-use policy while otherwise authorized counts as exceeding access, calling that a "gates-up-or-down" question: either a person can access a particular file or system, or they cannot, and the CFAA does not police what they do once they are let in.

That reading matters beyond one police database, because the government's rejected argument would have made a federal crime out of any employee who checked personal email or read the news on a work computer in violation of company policy, a result the majority called a "breathtaking amount" of newly criminalized, commonplace computer use. The Eleventh Circuit's judgment against Van Buren was reversed and remanded.

What did hiQ v. LinkedIn decide about scraping public data?

The Ninth Circuit held, first in 2019 and again on remand in 2022, that hiQ Labs had raised a serious legal question that scraping data LinkedIn members had already made publicly viewable, with no account or password required, falls outside the CFAA's "without authorization" clause. HiQ, a data analytics company, used automated bots to collect information from public LinkedIn profiles; after LinkedIn sent a cease-and-desist letter and blocked hiQ's access, hiQ sued for an injunction rather than wait to be sued itself. The Ninth Circuit's original opinion, filed September 9, 2019, affirmed a preliminary injunction keeping LinkedIn from blocking hiQ, reasoning that the CFAA's "without authorization" language most naturally limits its coverage "to computer information for which authorization or access permission, such as password authentication, is generally required."

The Supreme Court later vacated that judgment and sent the case back for reconsideration in light of Van Buren. On remand, the Ninth Circuit reaffirmed the injunction on April 18, 2022, concluding that Van Buren reinforced its earlier reasoning: the CFAA prohibits accessing a "protected computer" without authorization, and hiQ still raised a serious question about whether scraping public profile pages, which required no password to view, could be "without authorization" at all. Both rulings came at the preliminary-injunction stage, so the court was assessing whether hiQ was likely to win, not issuing a final judgment that all scraping of public data is lawful; a page that requires a login, or a company that has revoked a specific user's access, sits on different legal ground.

Does the CFAA apply to a social listening or monitoring tool?

A tool that reads posts and comments a platform already shows to the public, the same way is web scraping legal explains for scraping generally, sits closer to the hiQ side of this line than the Van Buren side, because there is no login being bypassed and no specific access grant being misused. The mechanism that actually controls a monitoring tool's legal footing is the platform's own terms of service and any robots.txt rule, which operate independently of the CFAA and can restrict conduct the CFAA itself does not reach. A team relying on a public API, the way RedReplier's Reddit API comparison explains for Reddit data, avoids the authorization question entirely, since the platform is granting access on its own stated terms rather than having that access inferred from what a crawler like CCBot can technically reach.

Frequently Asked Questions

Is the Computer Fraud and Abuse Act a criminal law or a civil law?

Both. The Department of Justice can bring criminal charges under 18 U.S.C. § 1030, and a company that suffers qualifying damage or loss can also sue civilly under § 1030(g). Van Buren was a criminal prosecution, while hiQ v. LinkedIn was a civil dispute over an injunction.

Did the Supreme Court rule that scraping public data is always legal?

No. The Supreme Court's own 2021 ruling was Van Buren v. United States, which addressed "exceeds authorized access," not scraping. The scraping question was decided by the Ninth Circuit in hiQ v. LinkedIn, at the preliminary-injunction stage, which found a serious question in hiQ's favor rather than a final rule covering every scraping dispute.

What is the difference between "without authorization" and "exceeds authorized access"?

"Exceeds authorized access" is defined in § 1030(e)(6) and covers someone who has some access but reaches files or data beyond what they are entitled to obtain. "Without authorization" is undefined in the statute and covers someone with no access at all, the question Van Buren left for later cases and hiQ addressed for public data.

Does logging in and then breaking a website's terms of service violate the CFAA?

Van Buren's holding says exceeding authorized access requires reaching a file, folder, or database that is off limits, not just violating a use policy while otherwise allowed in. That reasoning weighs against treating a terms-of-service violation alone as a CFAA violation, though a court could still find the access unauthorized on other facts, such as a login the site owner has revoked.

Does hiQ v. LinkedIn mean any company can scrape any public LinkedIn profile?

No. HiQ addressed data LinkedIn had made visible with no account required, and both Ninth Circuit rulings were preliminary, finding a serious legal question rather than issuing a final judgment for every scraper. A platform's terms of service, copyright claims, and state law claims can still restrict scraping even where the CFAA does not reach it.

Where can I read the actual court opinions instead of a summary?

Van Buren v. United States is published as a Supreme Court slip opinion at 593 U.S. ___ (2021), and hiQ Labs, Inc. v. LinkedIn Corp. is published at 938 F.3d 985 (9th Cir. 2019) and, on remand, 31 F.4th 1180 (9th Cir. 2022). Both are available from the courts' own websites and from free legal databases such as Justia and CourtListener.

What is a "protected computer" under the CFAA?

Section 1030(e)(2) defines a protected computer as one used in or affecting interstate or foreign commerce or communication, a category that covers nearly any computer connected to the internet. Both prongs of the CFAA's core provision, accessing without authorization and exceeding authorized access, apply only to a protected computer.

Can breaking a robots.txt rule count as a CFAA violation?

Not on its own. Robots.txt operates independently of the CFAA, alongside a platform's terms of service, and can restrict conduct the CFAA itself does not reach. A robots.txt violation is a separate question from whether access was "without authorization" or exceeded authorized access.

What is the "gates-up-or-down" test from Van Buren?

Justice Barrett described exceeding authorized access as a "gates-up-or-down" question in Van Buren: either a person can access a particular file or system, or they cannot. The Court used that framing to reject the government's argument that misusing information you're otherwise allowed to reach, such as violating a computer-use policy, counts as exceeding access.

Why did the Supreme Court send hiQ v. LinkedIn back to the Ninth Circuit?

The Supreme Court vacated the Ninth Circuit's original 2019 judgment in hiQ v. LinkedIn and remanded the case for reconsideration in light of its own Van Buren decision. On remand, the Ninth Circuit reaffirmed its injunction on April 18, 2022, concluding that Van Buren reinforced rather than undercut its earlier reasoning.