The Computer Fraud and Abuse Act is the principal United States federal statute addressing unauthorized computer access, codified at 18 U.S.C. § 1030. Enacted in 1986 as an amendment to a 1984 federal computer-crime provision, it has been amended repeatedly, most substantially by the USA PATRIOT Act (2001) and the Identity Theft Enforcement and Restitution Act (2008). The statute creates seven categories of offense, defines a "protected computer" broadly enough to reach nearly any internet-connected machine, and supplies both criminal penalties and a private civil right of action. Its central operative phrases — access "without authorization" and conduct that "exceeds authorized access" — were narrowed by the Supreme Court in Van Buren v. United States (2021), and that narrowing determines much of the statute's present reach over automated data collection.
Scope and definitions
The statute's jurisdictional hook is the term protected computer, defined at § 1030(e)(2) to cover a computer used exclusively by or for a financial institution or the United States Government where the offense affects that use; a computer "used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States"; and a computer that is part of a voting system used for the management, support, or administration of a federal election or that has moved in or otherwise affects interstate commerce (Source: law.cornell.edu).
Exceeds authorized access is defined at § 1030(e)(6) as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." The statute does not define "without authorization."
Damage means "any impairment to the integrity or availability of data, a program, a system, or information." Loss means "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service" (Source: law.cornell.edu).
Offense provisions
Section 1030(a) sets out seven offenses:
| Subsection | Conduct reached |
|---|---|
| (a)(1) | Obtaining national-defense, foreign-relations, or restricted data by unauthorized access and willfully communicating or retaining it |
| (a)(2) | Intentionally accessing without authorization or exceeding authorized access and obtaining financial-record or consumer-report information, information from a US department or agency, or information from any protected computer |
| (a)(3) | Intentionally accessing without authorization a nonpublic US government computer, where the conduct affects the government's use |
| (a)(4) | Knowingly and with intent to defraud accessing a protected computer without authorization or in excess of authorization, furthering the fraud and obtaining anything of value, subject to a $5,000-per-year exclusion where the only thing obtained is computer use |
| (a)(5) | Causing transmission of a program, code, or command that intentionally causes damage; or unauthorized access that recklessly causes damage; or unauthorized access that causes damage and loss |
| (a)(6) | Knowingly and with intent to defraud trafficking in passwords or similar access information, where the trafficking affects interstate or foreign commerce or the computer is used by or for the US Government |
| (a)(7) | Transmitting, with intent to extort, a threat to damage a protected computer, a threat to obtain information from or impair the confidentiality of information on a protected computer, or a demand for value in relation to damage caused to facilitate the extortion |
(Source: law.cornell.edu)
Civil liability
Section 1030(g) permits any person who suffers damage or loss by reason of a violation to bring a civil action for compensatory damages and injunctive or other equitable relief. The action may be brought only where the conduct involves one of the factors in § 1030(c)(4)(A)(i)(I)–(V); where the only qualifying factor is subclause (I) — the aggregate-loss threshold — damages are limited to economic damages. An action must be begun within two years of the act complained of or of the discovery of the damage (Source: law.cornell.edu).
The civil provision is why the CFAA appears in commercial disputes over data access rather than only in prosecutions. It is pleaded alongside contract and trespass-to-chattels theories in scraping litigation, including Amazon v. Perplexity AI.
Van Buren and the authorization question
In Van Buren v. United States, 593 U.S. 374 (2021), a police sergeant ran a license-plate search in a law-enforcement database he was authorized to use, for a private purpose he was not permitted to pursue. The government argued that using authorized access for an improper purpose "exceeds authorized access." Justice Barrett, writing for a six-Justice majority joined by Justices Breyer, Sotomayor, Kagan, Gorsuch, and Kavanaugh, rejected that reading and held that an individual "exceeds authorized access" only when he accesses a computer with authorization but then obtains information located in particular areas of the computer — files, folders, or databases — that are off-limits to him. The Court described the resulting standard as a "gates-up-or-down inquiry — one either can or cannot access a computer system, and one either can or cannot access certain areas within the system." It reasoned that the government's purpose-based reading would "attach criminal penalties to a breathtaking amount of commonplace computer activity," since an employee sending a personal email or reading the news on a work computer would violate a typical business-use-only policy. Justice Thomas dissented, joined by Chief Justice Roberts and Justice Alito (Source: supremecourt.gov).
The practical consequence is that violating a website's terms of service, standing alone, is a weaker basis for CFAA liability than it was before 2021. Access restrictions that function as technical gates — authentication, IP blocking, rate limits enforced by the server — map more readily onto the Van Buren framework than contractual prohibitions do.
Application to AI training data and agents
The statute is invoked in two AI-related settings.
The first is data acquisition. Where a model developer or a data vendor collects web content at scale, the question is whether any collection crossed a technical access gate. Publisher-side countermeasures — paywalls, robots.txt enforcement backed by blocking, per-crawl licensing — bear on that question, and are discussed at Training Data Walls and Pay-per-Crawl (Pigouvian Pricing of Agent Traffic). The CFAA is one of the theories available to a site operator alongside copyright, contract, and state-law claims; AI Liability treats the overlapping set.
The second is agent conduct. Where an autonomous system takes actions on third-party systems without a human directing each step, the statute's intent elements — "intentionally accesses," "knowingly and with intent to defraud," "intentionally causes damage" — must be satisfied by someone. Whose intent is attributed, and on what theory, is unsettled; the general question of allocating responsibility for autonomous system behaviour is treated at AI and Tort Liability. Reported incidents in which models reached third-party networks during evaluation, including the August 2026 disclosures by evaluation-environment provider Irregular, put the question in a concrete posture without resolving it.
The scholarly treatment most often cited on the authorization question is Orin Kerr's account of computer trespass norms, summarized at Norms of Computer Trespass — Orin S. Kerr (Essay, 2022); see also Orin S. Kerr.
Relationships
- depends-on: AI Liability
- related: Training Data Walls
- related: Pay-per-Crawl (Pigouvian Pricing of Agent Traffic)
- related: AI and Tort Liability
- supports: Amazon v. Perplexity AI
- related: Norms of Computer Trespass — Orin S. Kerr (Essay, 2022)
- related: Orin S. Kerr
Open questions
- Whether a technical countermeasure short of authentication — rate limiting, IP blocking, or a
robots.txtdirective backed by enforcement — constitutes a "gate" for Van Buren purposes has not been settled by the Supreme Court. - Whether and how the statute's intent elements attach where an autonomous agent, rather than a directing human, initiates the access has not been addressed in a reported decision.