Regulation
18 U.S.C. § 1030

Computer Fraud and Abuse Act

Statute, United States Federal
Effective: October 16, 1986 Enforced by: U.S. Department of Justice (DOJ), Federal Courts (private right of action), FBI Last reviewed May 9, 2026

Overview

The Computer Fraud and Abuse Act is the primary federal anti-hacking statute. For platform governance, CFAA is foundational because it provides the legal framework under which platforms define and enforce 'authorized access' through their terms of service.

The Supreme Court's 2021 decision in Van Buren v. United States narrowed 'exceeds authorized access' to mean accessing information a person is not entitled to, rather than using permitted access for impermissible purposes.

Platform terms of service routinely reference CFAA-adjacent concepts: prohibitions on scraping, automated access, reverse engineering, and accessing accounts without authorization.

Penalties

Criminal: up to 5-20 years imprisonment. Civil: compensatory damages and injunctive relief (requires $5,000 minimum loss).

Key Articles & Sections

ⓘ

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology

Official Source

View official regulation text →

Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.

Frequently Asked Questions

What does CFAA require?

How does ConductAtlas monitor CFAA compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect CFAA obligations. Every change is archived with cryptographic verification.