Instagram is apparently the teen and tween social network of choice. That means parents who want to do the responsible thing and monitor their children’s Instagram accounts may be tempted to demand that their children “hand over the keys” to their accounts. But accessing your child’s Instagram account is — technically, at least — a violation of federal law.
Violate the terms, violate the CFAA
Instagram’s terms of service contain a “one person, one account” policy:
you agree that you will not create an account for anyone other than yourself
The terms also prohibit any licensing or transfer of your account:
you agree you will not sell, transfer, license or assign your account, followers, username, or any account rights
If your child gives you her username and password, she is giving you a license to access her Instagram account. Maybe you don’t care too much about violating Instagram’s terms of service, but doing so is, unfortunately, also a violation of federal law. Under the the Computer Fraud and Abuse Act (CFAA), you cannot
intentionally access a computer without authorization or exceed authorized access, and thereby obtain
(C) information from any protected computer.
In other words, if you access an Instagram account (which is hosted on Instagram’s computers/servers), in violation of Instagram’s terms of service, you have probably violated the CFAA, which is at least a misdemeanor (a fine plus imprisonment of up to 1 year).
Instagram is (probably) not to blame
Now, Instagram probably does not much care whether your child gives you access to his account. I think what Instagram cares about is (1) preventing people from forcing users to share their login information (as a condition of employment, for example), and (2) not being responsible for figuring out who might have permission to access a particular account. Plus, as a general rule, the point of Instagram and other social networks is to get individuals (or entities, in the case of businesses) to interact with other individuals.
Instagram could potentially make an exception to its rule for parents, but what about estranged parents, abusive parents, or imposters? Not to mention the wholesale flight of teens and tweens if Instagram made it easy for parents to get into their accounts. That also gets into reason number 2. If Instagram were responsibe for figuring out who had a valid license to access a user’s account, they would need rooms of lawyers to sift through the evidence.
But in the end, all Instagram is likely to do if it doesn’t like the way you are using your account is to close it. It is not very likely to hand you over to federal prosecutors, assuming those prosecutors would even be interested.
Nobody thinks the CFAA is supposed to prevent parents from being able to supervise their children’s social media usage. And prosecution — much less, jail time — is a remote possibility, at best. But it is still illegal. Which is stupid and scary.
The CFAA is written far too broadly, which means that lots of things are illegal that should not be, and it is up to law enforcement officers to decide which illegal activities to prosecute. Limited discretion can be a good thing, as long as laws are narrowly tailored to describe only activities that usually ought to be illegal. It allows police and prosecutors to opt not to go after a driver for safely driving 1 mile over the speed limit, and instead to focus on unsafe speeders.
But when a law criminalizes normal conduct, discretion replaces justice. It is silly to criminalize behavior that falls comfortably within the range of good parenting.
The CFAA is nearly 30 years old, and it was last amended in 2008. It is time to revisit the law. The proposed Aaron’s Law amendment that would remove terms of service violations would be a good start.
The only problem I see with the proposed Aaron’s Law is the lack of a provision addressing employers’ demands for access to employees accounts. I think that, at a minimum, there should be some civil liability for employers who force their way into their employees’ accounts. Perhaps that should be its own, separate law, but since it involves computers and abuse, the CFAA seems like an appropriate place to address it.
But parents should definitely not have to engage in illegal activity just to keep a close eye on their children’s social media usage.