Computer regulation in the United States is not one law but a layered set of federal and state rules that reach hardware manufacturing, unauthorized access, personal data, intellectual property, cybersecurity, exports, accessibility, repair, artificial intelligence, and workplace monitoring. Which rules apply to you depends on what you do: build devices, write software, store customer information, ship products abroad, or deploy automated decision tools. Some carry prison time. Others carry civil fines that reach into the millions.
Unauthorized Access and Computer Fraud
The Computer Fraud and Abuse Act is the central federal criminal law for computer misuse. It reaches unauthorized access to government systems, theft of financial records, transmission of malicious code, and trafficking in stolen passwords. It applies to any “protected computer,” which in practice means any internet-connected device.
Penalties scale with conduct and prior convictions. Basic unauthorized access to obtain information carries up to one year for a first offense, rising to five years if the access was for commercial gain, furthered another crime, or involved information worth more than $5,000. Computer fraud carries up to five years for a first offense and up to ten for repeat offenses. Intentionally causing damage by transmitting malicious code can bring up to ten years, and up to twenty for repeat offenses.1Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
The statute also creates a civil claim. Victims of intrusions can sue for damages and injunctions without waiting for a prosecutor.
Hardware Rules for Devices Sold in the U.S.
Every computing device sold in the country must meet the FCC’s radio frequency emission rules in Title 47 of the Code of Federal Regulations. Manufacturers test for electromagnetic compatibility before market entry, and the FCC can inspect equipment at any time.2eCFR. 47 CFR Part 15 – Radio Frequency Devices Personal computers and consumer electronics fall under the stricter Class B standard because home environments place devices close to radios and televisions.
Devices must also meet radiation exposure limits. The FCC requires evaluation against Specific Absorption Rate limits for whole-body and localized exposure before authorization.3eCFR. 47 CFR 1.1310 – Radiofrequency Radiation Exposure Limits
Energy certification adds another layer. Computers earning ENERGY STAR use roughly 30 to 40 percent less energy than standard models through efficient components and better idle-state power management, and the current specifications took effect in October 2025.4ENERGY STAR. Computers
On hazardous substances, the United States has no equivalent to the European Union’s Restriction of Hazardous Substances directive, which limits ten substances including lead, cadmium, and mercury in electronics.5European Commission. Restriction of Hazardous Substances in Electrical and Electronic Equipment Manufacturers selling into the EU must comply anyway. Many states have their own e-waste recycling mandates and disposal-fee programs that require manufacturers to accept obsolete equipment.
Data Privacy Obligations
There is no comprehensive federal privacy law for the private sector. What exists instead is a mix of sector-specific federal statutes and increasingly aggressive state laws.
State Consumer Privacy Laws
More than a dozen states have adopted broad consumer privacy statutes modeled on California’s Consumer Privacy Act, as amended by the California Privacy Rights Act. They share a core: residents can find out what personal information a business holds, request deletion, and opt out of the sale or sharing of their data. Covered businesses must post conspicuous opt-out links on their websites.
Children’s Online Privacy
The Children’s Online Privacy Protection Act requires operators of sites and services directed at children to get verifiable parental consent before collecting personal information from anyone under 13.6Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With the Collection and Use of Personal Information From and Relating to Children on the Internet The consent method has to be reasonably designed to confirm the person granting it is actually the parent. Narrow exceptions cover one-time responses to a child’s request and information collected only to protect the child’s safety on the site.7eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule The FTC enforces.
Biometric Data
A growing set of states regulates collection of biometric identifiers: fingerprints, facial geometry, iris scans. These statutes generally require notice before capture, written consent, and disclosure of retention periods. Some extend to employment, restricting facial recognition in job interviews without applicant consent. The strongest laws create private lawsuits with statutory damages, and settlements against major technology companies have been substantial.
Cross-Border Reach
U.S. companies that handle data of individuals in the European Union must comply with the General Data Protection Regulation, regardless of where the company sits.8GDPR.eu. General Data Protection Regulation Art. 3 GDPR – Territorial Scope Individuals get rights including data portability and permanent erasure. Fines for severe violations reach 4 percent of global turnover or €20 million, whichever is higher.9GDPR.eu. Fines and Penalties – General Data Protection Regulation
Content Hosting and Copyright
Platform Liability
Section 230 of the Communications Decency Act says no provider or user of an interactive computer service can be treated as the publisher of information provided by another.10Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material That is what allows platforms to host user content without defamation exposure for every post. The immunity does not cover federal criminal violations or intellectual property claims, and platforms keep broad discretion to moderate objectionable content.
Digital Copyright and Anti-Circumvention
The Digital Millennium Copyright Act makes it unlawful to bypass technological measures that control access to copyrighted works. Breaking encryption, cracking passwords, or disabling digital rights management is itself an offense, separate from any underlying infringement.11Office of the Law Revision Counsel. 17 USC 1201 – Circumvention of Copyright Protection Systems
The DMCA also created the notice-and-takedown system. Copyright holders send takedown notices; online service providers remove infringing material to keep their safe harbor.12U.S. Copyright Office. The Digital Millennium Copyright Act Rights holders who sue can elect statutory damages instead of proving actual loss: $750 to $30,000 per infringed work, and up to $150,000 per work for willful infringement.13Office of the Law Revision Counsel. 17 USC 504 – Remedies for Infringement: Damages and Profits
Every three years the Librarian of Congress grants exemptions to the anti-circumvention ban. The rulemaking finalized in late 2024 preserved and expanded several exemptions relevant to computing. You can lawfully bypass software locks on consumer devices, vehicles, marine vessels, medical devices, and commercial food-preparation equipment when circumvention is necessary for diagnosis, maintenance, or repair. Security researchers can also circumvent access controls on lawfully acquired devices for good-faith vulnerability testing.14Federal Register. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies
Cybersecurity Duties for Businesses
Companies that store personal data face security obligations from several directions at once. The rules depend on your industry, whether you are publicly traded, and what data you handle.
FTC Enforcement
The Federal Trade Commission polices data security across most industries. Section 5 of the FTC Act makes unfair or deceptive acts or practices in commerce unlawful.15Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful; Prevention by Commission When a company promises strong data security and fails to deliver basic safeguards, the FTC treats the gap as deceptive. Consent orders have required decades of third-party audits and substantial penalties.16Federal Trade Commission. Privacy and Security Enforcement
Health Care and Financial Services
Health care organizations face the HIPAA Security Rule, which requires covered entities to implement administrative, physical, and technical safeguards for electronic health information and to guard against reasonably anticipated threats.17U.S. Department of Health and Human Services. The Security Rule
Financial institutions face parallel duties under the Gramm-Leach-Bliley Act. The statute directs regulators to set standards for administrative, technical, and physical safeguards that protect customer records, guard against anticipated threats, and prevent unauthorized access that could cause substantial harm.18Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information Under the FTC’s Safeguards Rule, covered companies must maintain a written information security program and regularly test their systems.19Federal Trade Commission. Gramm-Leach-Bliley Act
Public Company and Critical Infrastructure Reporting
Publicly traded companies disclose material cybersecurity incidents on Form 8-K within four business days of determining an incident is material. The clock starts on the materiality determination, not on detection, and the SEC expects the determination without unreasonable delay.20U.S. Securities and Exchange Commission. Form 8-K
Critical infrastructure operators face additional federal reporting under the Cyber Incident Reporting for Critical Infrastructure Act. Covered entities report significant cyber incidents to CISA within 72 hours of reasonably believing an incident has occurred, and report ransomware payments within 24 hours.21CISA. Cyber Incident Reporting for Critical Infrastructure Act of 2022
State Breach Notification
When a security failure exposes personal information, nearly every state requires notice to affected individuals. Roughly 20 states set numeric deadlines, typically 30 to 60 days from discovery; the rest use qualitative language like “without unreasonable delay.” Late notice can trigger state attorney general enforcement and class-action lawsuits.
Exporting Hardware and Software
Shipping computing hardware or software abroad is tightly regulated, and misclassification carries criminal exposure. Two regimes control what leaves the country and who can receive it.
The Export Administration Regulations, run by the Commerce Department’s Bureau of Industry and Security, govern dual-use items with both commercial and military applications. Encryption software is a prominent example. Items get Export Control Classification Numbers, and a license may be required before shipment to certain countries or end users. The Commerce Control List, with a category devoted to computers, sets out controlled items and their technical thresholds.22Bureau of Industry and Security. Interactive Commerce Control List
Items designed specifically for military use instead fall under the International Traffic in Arms Regulations at the State Department, which imposes stricter controls and requires State Department authorization rather than a Commerce license.
Both regimes maintain restricted-party lists. The Entity List identifies foreign organizations that U.S. companies cannot export to without a specific license, generally for national security or foreign policy reasons. Others include the Specially Designated Nationals list and the Denied Persons list.23Bureau of Industry and Security. Part 744 – Control Policy: End-User and End-Use Based Shipping without screening these lists risks severe penalties.
Accessibility of Software and Websites
Section 508 of the Rehabilitation Act requires that software developed, maintained, or procured by federal agencies conform to WCAG 2.0 Level A and Level AA success criteria. The standard covers screen-reader compatibility, keyboard navigation, and color contrast, and software must respect assistive technologies and user accessibility settings at the operating system level.24Section508.gov. Software Overview
State and local government websites and mobile apps face a similar rule under a 2024 Department of Justice regulation implementing Title II of the Americans with Disabilities Act. That rule adopts WCAG 2.1 Level AA.25ADA.gov. Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments
Private business sits in a murkier place. Title III of the ADA applies to public accommodations, and courts have increasingly held that websites qualify. The DOJ has not yet issued a technical standard for private-sector websites, so companies navigate the requirement through litigation risk. Many that take accessibility seriously target WCAG 2.1 or 2.2 Level AA as a practical benchmark, though no regulation formally requires it of them.
Right to Repair
A growing number of states have passed right-to-repair laws affecting computing hardware. They require manufacturers to provide consumers and independent repair shops with diagnostic tools, replacement parts, and repair documentation on fair and reasonable terms, generally meaning comparable cost and conditions to what the manufacturer provides its authorized repair network.
Some go further and prohibit “parts pairing,” the use of software to disable or degrade a device when a component is replaced with a non-manufacturer part. Violation penalties in states with active enforcement can reach thousands of dollars per day.
Artificial Intelligence
AI regulation is in an early stage, and the federal picture shifted recently. A 2023 executive order directing federal agencies to evaluate AI safety was revoked in January 2025,26Federal Register. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence leaving federal AI governance largely voluntary. The main federal reference is the NIST AI Risk Management Framework, a non-binding guide organized around Govern, Map, Measure, and Manage. Compliance is optional.27NIST. AI Risk Management Framework
States have moved faster. Beginning in early 2026, some require developers and deployers of high-risk AI systems to exercise reasonable care against algorithmic discrimination. “High-risk” generally covers consequential decisions in hiring, lending, housing, and similar areas where biased outputs implicate civil rights law. Deployers must conduct impact assessments and keep documentation showing how the system was tested for discriminatory outcomes.
Workplace Monitoring
Employers have broad authority to monitor activity on company-owned computers and networks, but not to reach into employees’ personal accounts. More than half the states prohibit employers from demanding access to an employee’s or applicant’s personal social media accounts, whether through requests for usernames and passwords or through friend requests, and bar retaliation against those who refuse. Most of these laws expressly allow monitoring on company-issued devices. Log in to a personal account from a work laptop, and your employer may be able to see it even in states with strong social media protections.