18 U.S.C. § 1030

Computer Fraud and Abuse Act

Statute — United States Federal
Effective: October 16, 1986 100 platforms tracked 6082 provisions indexed Enforced by: U.S. Department of Justice (DOJ), Federal Courts (private right of action), FBI Last reviewed May 9, 2026

Overview

The Computer Fraud and Abuse Act is the primary federal anti-hacking statute. For platform governance, CFAA is foundational because it provides the legal framework under which platforms define and enforce 'authorized access' through their terms of service.

The Supreme Court's 2021 decision in Van Buren v. United States narrowed 'exceeds authorized access' to mean accessing information a person is not entitled to, rather than using permitted access for impermissible purposes.

Platform terms of service routinely reference CFAA-adjacent concepts: prohibitions on scraping, automated access, reverse engineering, and accessing accounts without authorization.

Penalties

Criminal: up to 5-20 years imprisonment. Civil: compensatory damages and injunctive relief (requires $5,000 minimum loss).

Key Articles & Sections

Platforms We Track Subject to CFAA

Recent Changes Related to CFAA

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology

Provisions Governed by CFAA (6082 across 100 platforms)

Services unavailable in unlicensed jurisdictions 23andMe
Medium
Bone marrow recipient sample prohibition 23andMe
Medium
Two-factor authentication account protection 23andMe
Medium
License Restricted To Personal Use Not Resale Acorns
Medium
Personal Non-Commercial License To Use Site And Application Acorns
Medium
Acorns Right To Restrict Site Areas To Registered Users Acorns
Medium
Prohibition On Framing Or Mirroring Site Acorns
Medium
Do not refer others without their permission Acorns
Medium
Proxy email users responsible for receiving account communications Acorns
Medium
User Must Notify Acorns Of Unauthorized Account Use Acorns
Medium
Account eligibility restricted to natural persons 18 plus Activision
Medium
Obligation to provide accurate registration information Activision
Medium
Legal entities prohibited from creating accounts Activision
Medium
Obligation to notify Activision of unauthorized account use Activision
Medium
UK Online Safety Act compliance obligation Activision
Medium
Prohibition on unauthorized server connections Activision
Medium
Prohibition on scraping aggregating other users' information Activision
Medium
Prohibition on unauthorized data mining software Activision
Medium
Parents responsible for children's account use Activision
Medium
Username restrictions prohibiting offensive or trademarked names Activision
Medium
Prohibition on unauthorized matchmaking services Activision
Medium
Adobe May Require Multi-Factor Authentication Adobe
Medium
Educational Version Restricted to Eligible Users and Country Adobe
Medium
Prohibition on Spam Phishing and Unsolicited Messages Adobe
Medium
License Limited to One Person Cannot Be Shared Adobe
Medium
Sample Files Restricted to Provided Purpose Only Adobe
Medium
NFR Version Restricted to Stated Period and Non-Commercial Use Adobe
Medium
User Responsible for All Account Activity Adobe
Medium
No Job Posts Soliciting Unpaid Creative Work Adobe
Medium
Prohibition on Advertising Without Prior Written Approval Adobe
Medium

Showing 30 of 6082 provisions. View all →

Official Source

View official regulation text →

Get alerted when platforms change their policies, including CFAA-relevant provisions.

Subscribe to Monitor, $19/mo

Frequently Asked Questions

What does CFAA require?

Which platforms does CFAA apply to?

ConductAtlas tracks CFAA-relevant provisions across 100 platforms. Each platform's specific provisions are classified by severity and mapped to CFAA requirements.

How does ConductAtlas monitor CFAA compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect CFAA obligations. Every change is archived with cryptographic verification.