Digital law is the body of federal and state rules governing how people create, share, store, and protect information in electronic form. It covers online contracts and electronic signatures, platform liability for user content, copyright in digital works, privacy and data security, computer crime, cybersecurity reporting, digital assets, web accessibility, and the question of which court has authority when an online dispute crosses state lines. Because so much daily activity now runs through screens and networks, these rules reach nearly every business and nearly every person who uses the internet.
The field keeps expanding as new technologies arrive faster than the statutes written to regulate them. What follows is a working map of the main areas, what each one requires, and where the current lines are drawn.
Electronic Contracts and Signatures
Clicking “I Agree” on a website can create a binding contract. The federal Electronic Signatures in Global and National Commerce Act says a signature or contract cannot be denied legal effect simply because it exists in electronic form.1Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity An electronic signature carries the same weight as ink on paper for transactions in interstate or foreign commerce.
At the state level, the Uniform Electronic Transactions Act reinforces the same principle. Forty-nine states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have adopted it. For an electronic signature to hold up, the signer generally needs to have intended to sign, both parties need to have agreed to do business electronically, the signature must be linked to the specific record, and the signed document must be retained in a form both sides can access later.
These requirements apply every time you accept terms of service, sign a lease through an online portal, or approve a purchase order by email. When the basic elements are met, the other party can enforce the agreement the same way they would enforce a paper contract.
Platform Liability and Section 230
Section 230 of the Communications Decency Act states that no provider of an interactive computer service shall be treated as the publisher of information provided by another person.2Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material If a user posts something harmful on a social media site, the platform itself generally cannot be sued as though it wrote the post.
The statute also protects platforms that voluntarily remove content they consider objectionable, even when the content is technically legal. It does not cover federal criminal law, intellectual property claims, or certain other narrow exceptions, so Section 230 is not the blanket shield it is sometimes described as.
Copyright Online: The DMCA Notice-and-Takedown System
The Digital Millennium Copyright Act lets copyright holders fight online infringement without immediately going to court. Under 17 U.S.C. ยง 512, online service providers get safe harbor from monetary liability for hosting infringing material posted by users, provided they follow the statute’s rules.3Office of the Law Revision Counsel. 17 USC 512 – Limitations on Liability Relating to Material Online
A copyright holder sends a written notice to the service provider identifying the infringing material, including a statement of good-faith belief that the use is unauthorized, made under penalty of perjury.3Office of the Law Revision Counsel. 17 USC 512 – Limitations on Liability Relating to Material Online The provider must then remove the material promptly. The person who posted it can file a counter-notification, and the material goes back up unless the copyright holder files a lawsuit. The system handles millions of requests every year and works best for clear-cut piracy; fair use, parody, and commentary disputes are messier, which is what the counter-notification process is for.
Computer Crime Under the CFAA
The Computer Fraud and Abuse Act is the main federal statute criminalizing unauthorized access to computers. It prohibits accessing a computer without authorization or exceeding the level of access you were given, and it covers conduct from stealing data off a protected system to intentionally transmitting code that causes damage.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Penalties scale with severity:
- Up to one year for basic unauthorized access to obtain information, or recklessly causing damage, when there is no prior conviction.
- Up to five years for unauthorized access committed for commercial gain or in furtherance of another crime, or for intentionally causing damage to a protected computer.
- Up to ten years for accessing national security information without authorization or intentionally causing serious damage, and as the enhanced penalty for repeat offenders in the lower categories.
- Up to twenty years for a second or subsequent offense involving national security information.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The Supreme Court narrowed the statute somewhat in its 2021 decision in Van Buren v. United States, ruling that someone with legitimate access to a system who uses it for an improper purpose does not automatically violate the CFAA.
Privacy and Data Protection
Children’s Online Privacy
The Children’s Online Privacy Protection Act requires operators of websites and online services directed at children under 13 to obtain verifiable parental consent before collecting personal information from those children.5Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With the Collection and Use of Personal Information From and About Children on the Internet Operators must also post a clear privacy policy explaining what data they collect, how they use it, and whether they share it with third parties.6Office of the Law Revision Counsel. 15 USC Ch. 91 – Children’s Online Privacy Protection The FTC enforces COPPA and has imposed multimillion-dollar civil penalties, with enforcement targeting gaming platforms, social media apps, and educational technology companies that collect data from young users.
Government Access to Stored Communications
The Stored Communications Act governs when the government can reach into your emails, texts, and other stored electronic communications. For messages stored 180 days or less, the government needs a warrant. For older messages or records held by remote computing services, access is available through a warrant, a subpoena with prior notice to the subscriber, or a court order.7Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Non-content records such as subscriber names, billing records, and IP addresses can be obtained through lower thresholds like administrative subpoenas.
State Consumer Privacy Laws
No comprehensive federal consumer privacy law exists as of 2026. Several states have filled the gap with legislation granting residents the right to know what personal data businesses collect about them, to request deletion, and to opt out of the sale of their personal information. These laws vary in scope, and an online business often needs to comply with several frameworks at once depending on where its users live.
Online Consumer Protection and the FTC
The Federal Trade Commission Act prohibits unfair or deceptive acts or practices in commerce.8Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful; Prevention by Commission That language, written long before the internet, applies with full force to online businesses. The FTC uses it against companies that make misleading claims in digital advertising, bury material terms in fine print, or use deceptive design patterns to push users into purchases or subscriptions.
FTC guidance requires that disclosures needed to prevent an ad from being misleading be clear and conspicuous: placed near the triggering claim, sized and colored to be noticeable, and shown before the consumer commits to a purchase. Burying a disclosure behind a hyperlink at the bottom of a page generally does not meet the standard. The same principles apply to social media endorsements, where paid partnerships and sponsored content must be disclosed in a way the audience can actually see.
AI-Generated Content and Copyright
The U.S. Copyright Office has stated that copyright protects only material produced by human creativity. If an AI system autonomously generates a creative work, that output is not copyrightable.9Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence
The line is not absolute. If a human selects, arranges, or meaningfully edits AI-generated material, the human-authored portions may qualify for protection. The Office evaluates these situations case by case, looking at whether the human’s involvement went beyond typing a prompt. Entering even a detailed, creative prompt is not enough on its own, because the AI, not the person, determines how the creative elements are executed.9Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence Anyone registering a work that includes AI-generated content must disclose that fact and specify which parts a human authored.
Cybersecurity Incident Reporting
The Cyber Incident Reporting for Critical Infrastructure Act requires covered entities to report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency within 72 hours of reasonably believing one has occurred. Ransomware payments must be reported within 24 hours of being made.10Federal Register. Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements The reporting clock starts when the entity reasonably believes an incident occurred, not when an internal investigation confirms it.
CIRCIA targets critical infrastructure sectors such as energy, healthcare, financial services, and telecommunications. CISA has authority to compel disclosure and to take administrative enforcement action against entities that fail to report.
Digital Assets and Commercial Law
Traditional commercial law was written for physical goods and paper documents. As cryptocurrencies, non-fungible tokens, and other digital assets became economically significant, a gap opened: how do you prove ownership or transfer rights in something that exists only as data? The Uniform Law Commission addressed this through Article 12 of the Uniform Commercial Code, which creates rules for “controllable electronic records,” meaning records stored electronically that a person can control.
Under Article 12, a person controls a digital asset if they can receive the benefit from it, have the exclusive power to prevent others from doing the same, and can transfer that control to someone else. A buyer who acquires a controllable electronic record in good faith, for value, and without notice of competing claims takes it free of those claims. As of early 2025, roughly half the states plus the District of Columbia had enacted Article 12, with more considering adoption.
Web Accessibility Under the ADA
A 2024 rulemaking under Title II of the Americans with Disabilities Act established that state and local government websites and mobile apps must meet the Web Content Accessibility Guidelines version 2.1, Level AA.11ADA.gov. Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments The compliance deadline for entities serving populations of 50,000 or more was extended to April 2027, with smaller entities given until April 2028.12Federal Register. Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Content and Mobile Applications
The rule directly binds government entities, but private businesses face accessibility lawsuits under Title III of the ADA as well, and courts increasingly look to the WCAG standards when evaluating those claims.
Jurisdiction Over Online Disputes
When a website based in one state causes harm to someone in another, the threshold question is which court can hear the case. The constitutional standard comes from the minimum contacts doctrine: a court can exercise authority over an out-of-state party only if that party has enough of a connection with the state to make a lawsuit there fundamentally fair.13Constitution Annotated. Amdt14.S1.7.1.4 Minimum Contact Requirements for Personal Jurisdiction
Courts have adapted the doctrine to the internet with what is sometimes called a sliding scale. A website that actively conducts business with residents of a state, processes transactions, and enters into contracts with people there is more likely to be subject to that state’s courts. A site that merely posts information available to anyone, without targeting a specific audience, generally does not create enough of a connection. Most real websites sit between those extremes, and courts look at the totality of the site’s interaction with the forum state. The same website can be subject to one state’s courts and immune from another’s, which means geographic boundaries still matter for online businesses even when the audience is everywhere.