Law note · California
Comprehensive Computer Data Access and Fraud Act (unauthorized access, broader than the federal without-authorization test)
What it asks of an app
- Do not continue accessing a California site, or circumvent a technical block, after the operator has sent a cease-and-desist notice (Facebook v. Power Ventures, 9th Cir. 2016; Craigslist v. 3Taps, N.D. Cal. 2013).
- Note that this statute's without permission standard has no threshold requirement that your initial access be unauthorized, unlike the federal Computer Fraud and Abuse Act (CFAA).
When LexLint raises it
crawls_web
What we found
Section 502(c) criminalizes knowing access without permission, textually broader than the federal Computer Fraud and Abuse Act (CFAA)'s without authorization because it carries no threshold requirement that the initial access itself be unauthorized. Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016) held a scraper's originally-permitted access did not violate this section, but access became without permission once Facebook sent a cease-and-desist and IP-blocked the scraper and it continued anyway.
Craigslist v. 3Taps (964 F. Supp. 2d 1178, N.D. Cal. 2013) held a cease-and-desist letter plus an IP block are sufficient notice, so circumventing the block after notice states a claim under this section. The current section was added by Stats.
1987, ch. 1499 (a legislative-history research service confirms this against the annotated statutory history), but leginfo.legislature.ca.gov's own code page carries only the most recent amendment note, not the full history back to 1987, and no session-law or secondary source located this pass pinned the specific operative date, which turns on whether the 90-day constitutional waiting period from enactment ran past January 1, 1988 (in which case the section commenced January 1, 1989 instead). The commencement date is left unset rather than guessed between those two candidates.