What Is the CFAA? – Definition and How It Works
Learn what the Computer Fraud and Abuse Act prohibits, how courts have narrowed it, and what still creates exposure.
The Computer Fraud and Abuse Act is the principal United States federal computer-crime statute. It prohibits accessing a computer "without authorization" or "exceeding authorized access". This page is a general explanation, not legal advice.
1. Why It Matters for Web Collection
For years the CFAA was the statute most often raised against automated collection, on the theory that violating a website's terms of service made continued access unauthorised — turning a contract breach into a federal crime.
The scope of that theory has been substantially narrowed, which changed the risk picture considerably without eliminating it.
2. The Narrowing
Two lines of authority matter.
Van Buren v. United States (Supreme Court, 2021) adopted a "gates-up-or-down" reading of "exceeds authorized access": the provision concerns accessing areas of a system one is not entitled to enter, not misusing information one is entitled to access. Using permitted access for a forbidden purpose is not, on that reading, a CFAA violation.
hiQ Labs v. LinkedIn (Ninth Circuit) concluded that scraping data from a publicly accessible website — no login, no authentication — does not constitute access "without authorization", because there is no gate to pass.
Together these support a broad proposition: collecting genuinely public data from a public website is not a CFAA violation, even where terms of service prohibit it.
3. What Still Creates Exposure
The narrowing is real and it is not a general permission. Circumstances that remain risky:
| Circumstance | Why |
|---|---|
| Authentication | Logging in means a gate exists; terms then govern the access |
| Credential sharing or misuse | Using someone else's account |
| Circumventing a technical access control | Defeating a barrier rather than walking through an open door |
| Continuing after a specific revocation | A direct demand to stop is a gate being lowered at you |
| Bypassing an IP block | Arguably evading a revocation |
| Causing damage or impairment | Separate provisions address damage and denial of service |
The authenticated case is the important one. Once a login is involved, the reasoning that protects public scraping stops applying.
4. The CFAA Is Not the Only Statute
A collection activity can be lawful under the CFAA and still create liability under other law:
- Breach of contract, where terms of service were accepted.
- Copyright infringement, in the copying and reuse of protected content.
- Trespass to chattels, where the access burdens the target's systems.
- Privacy law, where personal data is involved — CCPA, GDPR, and sector rules.
- State computer-crime statutes, some broader than the federal one.
- Trade secret law, where the data was not in fact public.
So "the CFAA does not reach this" is a narrow conclusion, not a clearance.
5. Practical Risk Reduction
- Prefer public pages over anything requiring a login.
- Do not create accounts to collect data where the terms prohibit it.
- Never share or reuse credentials.
- Do not defeat technical access controls.
- Stop when specifically told to stop. A cease-and-desist directed at you changes the analysis materially.
- Do not burden the target. Rate limit properly; impairment has its own provisions.
- Honour published access rules, which is both good practice and evidence of good faith.
- Take legal advice for anything commercially significant, since this area is jurisdictional and fact-specific.
Point 5 deserves emphasis: continuing after a direct, specific revocation is the fact pattern that most reliably converts a defensible activity into a contested one.
6. Why Terms of Service Still Matter
The CFAA no longer readily turns a terms breach into a crime, and a terms breach is still a terms breach — actionable as contract, and relevant to other claims.
It also matters reputationally and commercially. A dispute with a data source is expensive regardless of who is right, and losing access to a source you depend on is a business problem independent of any legal outcome.
7. Summary
The CFAA prohibits access without authorisation or exceeding authorised access, and courts have narrowed it substantially: Van Buren limited "exceeds authorized access" to entering areas one may not enter, and hiQ held that scraping a public website is not unauthorised access.
Exposure remains where authentication, credential misuse, circumvention of technical controls, a specific revocation, or system impairment is involved — and CFAA analysis says nothing about contract, copyright, privacy, or state law, so it is one question among several rather than the whole answer.