About | HeinOnline Law Journal Library | HeinOnline Law Journal Library | HeinOnline

1 1 (April 21, 2020)

handle is hein.crs/goveaxg0001 and id is 1 raw text is: 







              Congressional                                            ______
           ~.Research Service
               informing the Iegislativ d bate since 1 14 ___________________




From Clickwrap to RAP Sheet: Criminal

Liability under the Computer Fraud and

Abuse Act for Terms of Service Violations



Updated April 21, 2020

Computers and the internet are ubiquitous, and so too are contractual restrictions on their use. Users of
smartphones, tablets, personal computers, social media websites, apps, online shopping platforms,
streaming services, and more are generally bound by terms of service (ToS) agreements-contracts that
govern the use of a product. Often, ToS agreements take the form of clickwrap agreements requiring users
to click a box indicating that they are aware of, and agree to, certain terms on a website. In other instances
ToS agreements may simply amount to a written notification that by using a product, the user agrees to be
bound by the product's ToS. Either way, at least according to some empirical studies, users generally do
not read TOS agreements. That is perhaps unsurprising given that ToS agreements are often lengthy,
covering everything from the number of authorized users of a product to the types of content that may be
shared through a device or service. But providers of computer and internet products and services rely on
ToS for a variety of purposes, including limiting liability, protecting proprietary data, and preventing their
products or services from being used in a harassing, threatening, or abusive manner. Against this
backdrop, federal courts have diverged on the issue of whether an individual may-under certain
circumstances-be criminally liable under federal law for ToS violations.
The judicial disagreement stems from two conflicting interpretations of the Computer Fraud and Abuse
Act (CFAA), 18 U.S.C. @ 1030-a civil and criminal cybersecurity law prohibiting certain computer-
related activities. Federal appellate courts are divided on when an individual who violates a ToS
agreement runs afoul of the CFAA and is subject to liability under the statute. The United States Supreme
Court appears poised to weigh in on the issue; on April 20, 2020 the Court agreed to hear Van Buren v.
United States, an appeal from the Eleventh Circuit.
This Sidebar begins with background on the relevant provisions of the CFAA, before examining the split
among the federal appellate courts over when, if ever, the CFAA imposes criminal liability for violations
of ToS agreements. It then briefly describes the background and implications of the Van Buren case. The
Sidebar concludes with some considerations for Congress.



                                                               Congressional Research Service
                                                               https://crsreports.congress.gov
                                                                                   LSB10423

CRS Legal Sidebar
Prepared for Members and


Committees of Congress

What Is HeinOnline?

HeinOnline is a subscription-based resource containing thousands of academic and legal journals from inception; complete coverage of government documents such as U.S. Statutes at Large, U.S. Code, Federal Register, Code of Federal Regulations, U.S. Reports, and much more. Documents are image-based, fully searchable PDFs with the authority of print combined with the accessibility of a user-friendly and powerful database. For more information, request a quote or trial for your organization below.



Short-term subscription options include 24 hours, 48 hours, or 1 week to HeinOnline.

Contact us for annual subscription options:

Already a HeinOnline Subscriber?

profiles profiles most