18 U.S.C. § 1030

Computer Fraud and Abuse Act

Statute — United States Federal
Effective: October 16, 1986 100 platforms tracked 1047 provisions indexed Enforced by: U.S. Department of Justice (DOJ), Federal Courts (private right of action), FBI Last reviewed May 9, 2026

Overview

The Computer Fraud and Abuse Act is the primary federal anti-hacking statute. For platform governance, CFAA is foundational because it provides the legal framework under which platforms define and enforce 'authorized access' through their terms of service.

The Supreme Court's 2021 decision in Van Buren v. United States narrowed 'exceeds authorized access' to mean accessing information a person is not entitled to, rather than using permitted access for impermissible purposes.

Platform terms of service routinely reference CFAA-adjacent concepts: prohibitions on scraping, automated access, reverse engineering, and accessing accounts without authorization.

Penalties

Criminal: up to 5-20 years imprisonment. Civil: compensatory damages and injunctive relief (requires $5,000 minimum loss).

Key Articles & Sections

Platforms We Track Subject to CFAA

Recent Changes Related to CFAA

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology

Provisions Governed by CFAA (1047 across 100 platforms)

Employer and Insurer Use Prohibition 23andMe
Medium
Prohibition on Employer and Insurance Company Use 23andMe
Medium
Account Deletion and Irreversible Sample Discard 23andMe
Medium
Prohibition on Insurer and Employer Use 23andMe
Medium
Age Restriction and Authorized Representative Requirement 23andMe
Medium
Account Deletion and Irreversibility 23andMe
Medium
Account Termination by 23andMe 23andMe
Medium
Account Termination Acorns
Medium
Account Termination by Acorns Acorns
Medium
License (Not Sale) and Revocability Adobe
Medium
Termination and Account Suspension Adobe
Medium
Account Termination & Service Access Affirm
Medium
Electronic Consent Withdrawal Triggers Account Closure Afterpay
Medium
AI Acceptable Use — Broad Platform Discretion to Terminate Afterpay
Medium
Account Closure Terms and Liability Survival Afterpay
Medium
Prohibition on Competing Model Training AI21 Labs
Medium
Export Controls Compliance Amazon
Medium
Acceptable Use and Prohibited Conduct Amazon
Medium
Spam and Unsolicited Communications Prohibition Amazon
Medium
Harmful or Illegal Content Prohibition Amazon
Medium
Prohibition on Network and Abuse Activities Amazon
Medium
Prohibition on Spam and Unsolicited Messaging Amazon
Medium
AUP Reporting Mechanism Amazon
Medium
Age and Eligibility Restriction Amazon
Medium
Intellectual Property Infringement Prohibition Amazon
Medium
Prohibition on Malware and Harmful Code Amazon
Medium
Prohibition on Intellectual Property Violations Amazon
Medium
Broad User Content License Grant Amazon
Medium
Account Termination and Suspension Amazon
Medium
DMCA Copyright Policy and Counter-Notification Amazon
Medium

Showing 30 of 1047 provisions. View all →

Official Source

View official regulation text →

Get alerted when platforms change their policies — including CFAA-relevant provisions.

Subscribe to Monitor — $19/mo

Frequently Asked Questions

What does CFAA require?

Which platforms does CFAA apply to?

ConductAtlas tracks CFAA-relevant provisions across 100 platforms. Each platform's specific provisions are classified by severity and mapped to CFAA requirements.

How does ConductAtlas monitor CFAA compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect CFAA obligations. Every change is archived with cryptographic verification.