Sandvig v. Sessions

United States District Court for the District of Columbia · 2018 · Constitutional Law

315 F. Supp. 3d 1

Updated July 9, 2026

conlawFirst Amendmentstandingdue processinternet speechCFAA18 U.S.C. § 1030(a)(2)(C)exceeds authorized access

Facts

Plaintiffs are professors and a media organization that seek to study whether housing, employment, and other websites use algorithms in discriminatory ways. Their planned methods include scraping publicly accessible data, using bots and sock-puppet profiles, and in the case of two plaintiffs, creating fictitious accounts on employment websites, all in ways they allege would violate certain websites' Terms of Service. Plaintiffs alleged that the CFAA criminalizes those ToS violations and chills their research and reporting. They sought declaratory and injunctive relief, claiming violations of the Free Speech, Free Press, Petition, vagueness, and nondelegation doctrines.

Issue

Whether plaintiffs had standing to bring a pre-enforcement challenge to the CFAA's Access Provision, and whether they plausibly stated First or Fifth Amendment claims based on the provision's application to their planned website research. A central interpretive question was whether "exceeds authorized access" covers only access restrictions or also use, purpose, and manner restrictions contained in website Terms of Service.

Rule

For pre-enforcement challenges burdening expressive rights, plaintiffs have standing when they plausibly allege an intent to engage in conduct arguably affected with a constitutional interest, proscribed by statute, and subject to a credible threat of prosecution. The CFAA phrase "exceeds authorized access" is best read narrowly to cover only access restrictions to particular information, not restrictions on use, purpose, or manner; thus the statute reaches obtaining information outside the bounds of approved access, not merely violating Terms of Service rules about how information may be used. When applied to speech-related access restrictions on the public internet, content-neutral regulation is subject to heightened First Amendment scrutiny and must be narrowly tailored to serve a significant governmental interest.

🔒

See the holding & full analysis

Create a free KwikCourt account to unlock the rest of this brief — and practice the case.

The court's holding and reasoning
Doctrine tests, pitfalls & exam hypotheticals
10 practice questions + 4 AI-graded essays on this case

Free sample · practice this case

Test yourself

One of 10 multiple-choice questions for this case. Pick an answer to see why.

In Seattle, Priya Desai, a journalism professor, wants to study whether public restaurant-review sites show different results to users who appear to belong to different ethnic groups. Her plan uses automated scripts and fictitious reviewer profiles in ways the sites' terms forbid, and she wants to publish the results, but she has received no specific threat from prosecutors.

If Priya brings a pre-enforcement constitutional challenge to the federal access statute, which argument best supports standing at the pleading stage?

Explanation. The governing standing rule for a pre-enforcement challenge burdening expressive rights is relatively forgiving. A plaintiff need only plausibly allege an intent to engage in conduct arguably affected with a constitutional interest, arguably proscribed by the statute, and subject to a credible threat of prosecution. A specific threat or certain prosecution is unnecessary where there is a conventional background expectation of enforcement. The injury stems from potential criminal enforcement by the government, not merely from private website rules. (Derived from Sandvig v. Sessions (n.d.).)