How Monitoring Your Kids on Instagram Could Land You in Jail

instagram-icon

Instagram is apparently the teen and tween social network of choice. That means parents who want to do the responsible thing and monitor their children’s Instagram accounts may be tempted to demand that their children “hand over the keys” to their accounts. But accessing your child’s Instagram account is — technically, at least — a violation of federal law.

Violate the terms, violate the CFAA

Instagram’s terms of service contain a “one person, one account” policy:

you agree that you will not create an account for anyone other than yourself

The terms also prohibit any licensing or transfer of your account:

you agree you will not sell, transfer, license or assign your account, followers, username, or any account rights

If your child gives you her username and password, she is giving you a license to access her Instagram account. Maybe you don’t care too much about violating Instagram’s terms of service, but doing so is, unfortunately, also a violation of federal law. Under the the Computer Fraud and Abuse Act (CFAA), you cannot

intentionally access[] a computer without authorization or exceed[] authorized access, and thereby obtain[]

(C) information from any protected computer.

In other words, if you access an Instagram account (which is hosted on Instagram’s computers/servers), in violation of Instagram’s terms of service, you have probably violated the CFAA, which is at least a misdemeanor (a fine plus imprisonment of up to 1 year).

Instagram is (probably) not to blame

Now, Instagram probably does not much care whether your child gives you access to his account. I think what Instagram cares about is (1) preventing people from forcing users to share their login information (as a condition of employment, for example), and (2) not being responsible for figuring out who might have permission to access a particular account. Plus, as a general rule, the point of Instagram and other social networks is to get individuals (or entities, in the case of businesses) to interact with other individuals.

Instagram could potentially make an exception to its rule for parents, but what about estranged parents, abusive parents, or imposters? Not to mention the wholesale flight of teens and tweens if Instagram made it easy for parents to get into their accounts. That also gets into reason number 2. If Instagram were responsibe for figuring out who had a valid license to access a user’s account, they would need rooms of lawyers to sift through the evidence.

But in the end, all Instagram is likely to do if it doesn’t like the way you are using your account is to close it. It is not very likely to hand you over to federal prosecutors, assuming those prosecutors would even be interested.

Blame Congress

Nobody thinks the CFAA is supposed to prevent parents from being able to supervise their children’s social media usage. And prosecution — much less, jail time — is a remote possibility, at best. But it is still illegal. Which is stupid and scary.

The CFAA is written far too broadly, which means that lots of things are illegal that should not be, and it is up to law enforcement officers to decide which illegal activities to prosecute. Limited discretion can be a good thing, as long as laws are narrowly tailored to describe only activities that usually ought to be illegal. It allows police and prosecutors to opt not to go after a driver for safely driving 1 mile over the speed limit, and instead to focus on unsafe speeders.

But when a law criminalizes normal conduct, discretion replaces justice. It is silly to criminalize behavior that falls comfortably within the range of good parenting.

Aaron’s Law

The CFAA is nearly 30 years old, and it was last amended in 2008. It is time to revisit the law. The proposed Aaron’s Law amendment that would remove terms of service violations would be a good start.

The only problem I see with the proposed Aaron’s Law is the lack of a provision addressing employers’ demands for access to employees accounts. I think that, at a minimum, there should be some civil liability for employers who force their way into their employees’ accounts. Perhaps that should be its own, separate law, but since it involves computers and abuse, the CFAA seems like an appropriate place to address it.

But parents should definitely not have to engage in illegal activity just to keep a close eye on their children’s social media usage.

  • PHK Corporation

    The issue is the contract with the child (minor) legal between Instagram and the child. The last time I check, in most states, a child cannot enter into a legally binding contract without parental permission or if they are emanicipated, but I am not an attorney, so best check with proper legal counsel.

    • http://caveatemptorblog.com Sam Glover

      Not quite. Contracts made by minors are generally voidable, but that doesn’t mean they need the approval of a guardian to sign up for a social network — or that guardians are somehow responsible for the contract.

      Also, like most websites, Instagram doesn’t allow anyone under 13 to join (which makes those kids into criminals if they try, of course).

  • Yury

    I have 2 follow up questions:

    1. Where did you come up with the idea that a parent accessing a child’s instagram account is licensing? Instagram would have to determine what qualifies as licensing because that type of assumption is made.

    2. If a child gives his parents the password, then how exactly is the parent violating federal law. The law specifically states “without authorization” or “exceed authorized access.” The parent has explicit permission from the child. I also don’t think exceed authorized access would be meant for violating a websites Terms of Service. If that were the case, every single person using the internet would have violated federal law.

    • http://caveatemptorblog.com Sam Glover

      Licensing is a legal term that applies to exactly this sort of situation. If you give someone else permission to use your account, you are giving (or attempting to give) them a license to use the account.

      “Authorized access” under the CFAA does not just mean authorized by the account holder — although if you tried to access an account without the account holder’s permission, that would surely be unauthorized. It also means without authorization under the terms of use that apply to that computer. Since Instagram says only the user can access their account, any access by someone else would be unauthorized, whether or not the account holder has given that third party permission (a license).

      The CFAA does mean that you can be prosecuted for violating a website’s terms of service. That is how Aaron Swartz was being prosecuted, and the fact that nearly everyone on the Internet has violated terms of service at one time or another — often with the tacit assent of the service provider — is what makes the CFAA an absurd law.