Law note · Virginia
Virginia Computer Trespass, malicious intent or deceptive means requirement
What it asks of an app
- Ordinary, non-disruptive automated access to a Virginia-connected public page does not by itself violate this statute; it requires malicious intent or intentionally deceptive means, plus removing, disabling, altering, or damaging data, programs, software, or operation.
- Intentionally deceptive circumvention of a technical barrier to disable or alter data or programs squarely fits this statute's elements.
- This statute does not override or displace an ordinary contract or license governing your access to a Virginia-connected computer service; ToS enforcement is a separate, civil track.
When LexLint raises it
crawls_web
What we found
Section 18.2-152.4(A) makes it unlawful for any person, with malicious intent or through intentionally deceptive means and without authority, to remove, disable, alter, damage, or otherwise interfere with computer data, programs, software, or operation.
Unlike a bare without-authorization standard (the Computer Fraud and Abuse Act (CFAA)'s, and most peer states' own statutes), this section requires malicious intent or intentionally deceptive means in addition to lack of authority, so ordinary unauthenticated, non-deceptive, non-malicious automated access to a public page that performs none of the listed disruptive acts does not fit the statute's elements at all, regardless of authorization; this makes Virginia's statute narrower and more scraping-favorable on its face than a pure authorization test, though no Virginia case law was found applying it to a scraping or automated-collection fact pattern specifically.
Subsection (C) expressly states the statute is not to be construed to interfere with or prohibit terms or conditions in a contract or license related to computers or computer services, preserving ordinary contract law as the separate track for ToS enforcement; no Virginia case addresses browsewrap versus clickwrap for a scraping dispute specifically.