1

Suppose I make a video conferencing website, but I specify in the Terms of Service that the free version is not to be used for commercial purposes. Someone uses the website without reading the Terms and uses it for a commercial purpose (meeting with one of their customers, for example). Or suppose I want to limit users to one account to limit usage and charge more, but a customer uses one work account and one personal account with the pseudonym John Doe.

Clearly, since they violated the ToS, I could ban the person from the site. I may be able to claim damages from a civil lawsuit. However, I was curious as to whether, if a person does not read the Terms of Service and violates them in a substantial way, would the person have criminal intent, recklessness, or negligence? In some cases, it may be clear without the Terms of Service that you cannot, for example, spread a virus or delete data from the server.

This is also true for a contract as well.

2
  • There has been a legally incorrect belief that violation of a TOS constitutes "unauthorized access" to a computer, which is a crime (carious answers here have relied on that thinking). This theory was recently definitively disposed of by SCOTUS in Van Buren v. United States.
    – user6726
    Jul 27 at 16:52
  • @user6726 I have just read * Van Buren v. United States.* and the above comment does not in my view, correctly summarize it. Jul 27 at 17:34
3

In general, a ToS document for a web site or online service is simply a contract or agreement. Normally violations of such an agreement are possible grounds for a civil suit, but are not crimes.

Moreover, some terms that some TOS documents claim are not legally enforceable. For example some insist that a user waive a right that the law says cannot be waived.

The kind of terms mentioned ion the question are probably enforceable in most jurisdictions.

If a person intentionally supplies false information to a site operator or service provider, with the intention of gaining some financial benefit that would not be available without the false statements, under circumstances where it would be reasonable for the site operator to rely on the statements, that would be fraud in many jurisdictions. Fraud is often a matter for a civil suit, but in some cases it can be a crime also. Those cases vary in different jurisdictions, and the question does not specify any particular jurisdiction.

Criminal fraud is the only case where I can think of where a ToS violation would be a crime.

Some TOS documents prohibit things which are already crimes. For example a communication site might include in its ToS that users are not to use it to assist in committing a crime, or to unlawfully harass someone. If a user violated those provisions, they would also be committing a crime, but only because those actions would be crimes even if the TOS had never mentioned them.

It is a crime to plan a murder via a chat site, whether the TOS says so or not. But that is because it is a crime to plan a murder in general, with nor without the chat site.

There are some specifically online crimes. For example, posting so-called "revenge porn" is a crime in many jurisdictions. But that is a crime because of a law against it, not because of a TOS that prohibits it.

In all usual cases, a ToS violation will be dealt with via a civil suit, or by limiting or canceling the user's access, if it is dealt with at all.

CFAA

In the the Computer fraud and Abuse Act (CFAA), specifically 18 U. S. C. §1030(a)(2), makes it a crime for anyone who

... intentionally accesses a computer without authorization or exceeds authorized access ...

The recent case of Van Buren v. United States, 593 U.S. ___ (2021) dealt with the "exceeds authorized access" language. (See the Wikipedia article) In that case, Van Buren, a police officer, accessed official databases to determine id the holder of a given license plate was in fact an undercover police officer. Van Buren thought that this information was being provided to a criminal, and was paid $6,000 for it. Van Buren knew that the access policy prohibited access for "personal use" or any "non-official purpose". He was charged with a felony violation of the CFAA on the ground that he accessed information with an "improper purpose", although he would have been authorized to access that same information with a proper purpose. After a long discussion of the meanign of the words "so" and "entitled" in the stsatute, the court opnion says:

If the “exceeds authorized access” clause criminalizes every violation of a computer-use policy, then millions of otherwise law-abiding citizens are criminals. Take the workplace. Employers commonly state that computers and electronic devices can be used only for business purposes. So on the Government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA. Or consider the Internet. Many websites, services, and databases—which provide “information” from “protected computer[s],” §1030(a)(2)(C)—authorize a user’s access only upon his agreement to follow specified terms of service. If the “exceeds authorized access” clause encompasses violations of circumstance-based access restrictions on employers’ computers, it is difficult to see why it would not also encompass violations of such restrictions on website providers’ computers. And indeed, numerous amici explain why the Government’s reading of subsection (a)(2) would do just that—criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook.

...

... For example, one police department might prohibit using a confidential database for a non-law-enforcement purpose (an access restriction), while another might prohibit using information from the database for a non-law-enforcement purpose (a use restriction). Conduct like Van Buren’s can be characterized either way, and an employer might not see much difference between the two. On the Government’s reading, however, the conduct would violate the CFAA only if the employer phrased the policy as an access restriction. An interpretation that stakes so much on a fine distinction controlled by the drafting practices of private parties is hard to sell as the most plausible.

In sum, an individual “exceeds authorized access” when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him.

This case clearly says that a person who has authorization to access a computer, but does so for a purpose prohibited by system policy, perhaps as expressed n a TOS contract, is not subject to criminal prosecution under the CFAA. It does not directly deal with the case where, as a condition of access, a person must furnish truthful ID information, or comply with some other condition, and whether violating such a condition would constitute a crime under the CFAA. But it casts significant doubt on any interpretation of the CFAA which would treat that as a crime

2
  • I added the United States tag, which did have a case where someone who used a false name on a social networking site was prosecuted, but found not guilty of violating the CFAA, I think. Jul 27 at 16:48
  • @joseph-parsons The CFAA generally prohibits accessing computer services without permission. Doing so is a crime whether the ToS says so or not. But permission might be conditioned on providing an accurate name. Jul 27 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.