In June 2016 we and the National Project on ACLU’s Speech, Privacy and Technology filed the complaint in this case, challenging a provision of federal law (section 1030(a)(2)(C) of the Computer Fraud and Abuse Act (“CFAA”)). That provision, at least as interpreted by the Department of Justice, makes it a crime to use a website in violation of the site’s Terms of Service and therefore probably would make criminals of us all. The lawsuit alleges that some uses prohibited by CFAA are necessary to enforce antidiscrimination laws. For instance, “testers” to determine whether an employment-opportunity website discriminates based on race need to submit made-up job applications in order to determine whether two individuals of different races who are equally qualified would be treated differently. We represent academics and a media organization who wish to conduct “testing” or related investigative work to determine whether online websites are treating users differently based on their membership in a protected class.
In September 2016, the government moved to dismiss the case, arguing (i) that the plaintiffs don’t have standing because they face no real threat of prosecution, and (ii) in any event, the challenged statute doesn’t violate their rights. Our opposition to that motion cited the DOJ guidance that contemplates prosecution of people like our clients and explained how the CFAA chills our clients’ rights to both express and gather information.
In March 2018, the court granted the motion to dismiss in part and denied it in part. It ruled that the statute did not actually prohibit most of the activities that our clients engage in or wish to engage in, and therefore does not violate their First Amendment rights. However, one activity—the plan to create fictitious user accounts on employment sites—is prohibited by the statute; as to that activity the court ruled that the complaint properly alleged a First Amendment violation and denied the government’s motion to dismiss.
After discovery, both sides moved for summary judgment, and in March 2020 the court ruled that the CFAA does not criminalize mere terms-of-service violations on consumer websites and that our clients’ research plans are therefore not crimes under the statute. The case was therefore dismissed as moot.
While this ruling was a victory for us, it was just one judge’s opinion, and there was no court order preventing the government from prosecuting our clients if they continued to disagree with the court. So we filed an appeal.
But in April 2020 the Supreme Court decided to consider a case from Georgia that raised some of the same issues. We asked the court of appeals to delay our appeal, and we filed an amicus brief in the Supreme Court case. In June 2021 the Supreme Court ruled in Van Buren v. United States that the law did not apply to a person who had authorized access to a computer system but then used that system in an improper way—for example, by violating its terms of service. The Court mentioned our case as an example. With our victory now confirmed, we dismissed our appeal.
