The American Civil Liberties Union (ACLU) recently filed an action in the US District Court for the District of Columbia challenging the constitutionality of the Computer Fraud and Abuse Act (CFAA). The lawsuit, Sandvig v. Lynch, was brought by the ACLU on behalf of a group of academic researchers and a media organization against US Attorney General Loretta Lynch.

The CFAA provision at issue in the suit, which prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access” and thereby obtaining information from a computer that is used in or affects interstate or foreign commerce or communication, has been interpreted by some courts to permit a criminal action against parties that violate a website’s terms of service or terms of use (TOU). Of particular importance in the action are provisions of TOU that prohibit providing false information, creating multiple accounts, or collecting data, including publicly available data, through automated methods (called “scraping”). See below for examples of some typical provisions that could be implicated by the suit:

You agree that you will not create an account for anyone other than yourself. You also represent that all information you provide or provided to us upon registration and at all other times is and will be true, accurate, current, and complete, and you agree to update your information as necessary to maintain its truth and accuracy.

We prohibit crawling, scraping, caching, or otherwise accessing any content on the site via any automated means or device, script, bot, spider, crawler, or scraper, including but not limited to, pricing information, user profiles, and user submitted content. You agree that you will not access or use the site in connection with any of the foregoing.

As explained by the ACLU, “The problem is that those are the very methods that are necessary to test for discrimination on the internet, and the academics and journalists who want to use those methods for socially valuable research should not have to risk prosecution for using them.” The ACLU draws comparisons to audit testing that has been used in an offline context to uncover racial discrimination in housing and employment and to enforce civil rights laws. The ACLU claims that the criminal actions permitted under the CFAA are overly broad and in violation of the First Amendment and the Due Process Clause of the Fifth Amendment.