Is It Illegal to Hack? Laws and Penalties in 2026

Yes, hacking is illegal in the United States. The core answer is that simple. Whether you access someone’s phone, email, social media, or company server without permission, federal law treats that as a criminal act with serious consequences.

The law that governs most hacking cases is the Computer Fraud and Abuse Act, a federal statute that has been on the books since 1986 and has been updated several times since. What surprises most people is just how broad its reach is.

See also: Is It Illegal to Secretly Record a Conversation? 2026

A single unauthorized login to someone else’s account can trigger federal criminal charges. And in 2021, the Supreme Court’s ruling in Van Buren v. United States actually narrowed one part of the CFAA, but the core prohibition on unauthorized access remains firmly intact.

This article covers every major angle: phone hacking, social media hacking, spyware, ethical hacking, state laws, and exactly what penalties someone faces if convicted.

Is It Illegal to Hack

Yes, hacking is illegal under both federal and state law in the United States. The legal definition of hacking centers on one word: authorization. If you access a computer system, device, or account without permission, that access is a crime under the Computer Fraud and Abuse Act.

The word “hacking” doesn’t appear in the statute itself. The law uses the phrase “unauthorized access” or “exceeds authorized access.” But the practical result is the same: getting into a system you’re not supposed to be in is a federal crime.

This applies to far more than you might expect. Accessing a former employer’s server with an old password, logging into your ex-partner’s email account, or even using someone else’s Netflix login without their knowledge can all fall under the CFAA’s scope depending on the circumstances.

What counts as illegal hacking under U.S. law:

• Accessing any computer, phone, or networked device without authorization
• Exceeding authorized access, such as going beyond what your account permissions allow
• Intercepting electronic communications in transit without consent
• Installing software on a device to capture data without the owner’s knowledge
• Using stolen credentials to access accounts, even if you obtained the credentials elsewhere

The authorization question is the legal dividing line. Consent transforms an illegal act into a legal one. Without it, nearly every form of unauthorized digital access is criminal.

Key Takeaway: Hacking is illegal under U.S. federal law whenever it involves accessing a computer, device, or account without authorization. Consent is the single most important factor in determining legality.

Is Hacking Illegal in the US

Hacking is illegal in the US under federal law and under the individual cybercrime statutes of all 50 states. No state in the country permits unauthorized computer access. The only legal question is which statute applies and how severe the punishment will be.

Federal law handles the largest cases, particularly those involving financial fraud, national security, or attacks on critical infrastructure. State law handles a significant portion of smaller cases, including unauthorized access to private accounts, hacking between individuals, and local computer crime incidents.

The Supreme Court’s 2021 decision in Van Buren v. United States added some clarity to the CFAA by ruling that a person with legitimate access to a system doesn’t violate the law simply by using that access for an improper purpose. But accessing a system you have no right to enter at all remains clearly illegal.

Quick Facts:

• All 50 states have their own computer crime statutes in addition to the federal CFAA
• Federal cases are prosecuted by the Department of Justice with FBI involvement
• State cases are handled by state attorneys general and local prosecutors
• The FBI’s Cyber Division is the primary federal agency investigating hacking crimes
• Both civil and criminal liability can arise from the same hacking incident

Think of federal and state hacking law like layers of authority stacked on top of each other. Federal law sets the floor. State laws can and do add penalties and address scenarios the CFAA doesn’t explicitly cover.

What Law Makes Hacking Illegal

The primary federal law that makes hacking illegal is the Computer Fraud and Abuse Act, codified at 18 U.S.C. 1030. Congress passed it in 1986 and has amended it multiple times to keep pace with evolving technology.

The CFAA contains seven main prohibited acts under 18 U.S.C. 1030(a)(1) through (a)(7). These range from obtaining national defense information through unauthorized computer access, all the way to trafficking in computer passwords. Most everyday hacking cases fall under 18 U.S.C. 1030(a)(2), which covers unauthorized access to obtain information.

A second critical law is the Electronic Communications Privacy Act (ECPA), found at 18 U.S.C. 2511. The ECPA makes it illegal to intentionally intercept wire, oral, or electronic communications without authorization. This is the statute most often applied when someone hacks into private messages, emails, or phone calls in real time.

Most hacking prosecutions stack multiple charges from across these statutes. A single phone hacking incident can trigger CFAA charges, ECPA violations, and identity theft charges simultaneously.

Is It Illegal to Hack Someone’s Phone

Yes, hacking someone’s phone without their consent is illegal under both the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act. Phones are protected devices under 18 U.S.C. 1030, and accessing one without authorization carries the same federal criminal exposure as hacking a computer.

Smartphones contain a more sensitive category of information than most computers. Contacts, banking apps, text messages, location data, private photos, and health information all sit on a person’s phone. Courts have recognized this heightened sensitivity. In Riley v. California (2014), the Supreme Court ruled that law enforcement needs a warrant to search a phone, which reflects how seriously the law treats phone privacy.

When a private individual accesses someone else’s phone without permission, the legal analysis is even more straightforward. There’s no warrant exception for individuals. No authorization means criminal liability, period.

Why phone hacking prosecutions are increasing in 2026:

• Phones hold more personal and financial data than ever before
• Stalkerware and spyware tools are increasingly accessible and actively prosecuted
• State laws in California, Illinois, and New York specifically address unauthorized phone access
• Federal prosecutors have made phone privacy cases a stated priority since 2022

The emotional context of why someone hacks a phone, jealousy, suspicion, concern for a child, doesn’t change the legal outcome. The act itself is the crime.

Key Takeaway: Hacking someone’s phone is a federal crime under the CFAA and the ECPA. Phones receive some of the strongest privacy protections in U.S. law, and unauthorized access carries serious criminal consequences.

Is It Illegal to Hack a Phone

Hacking a phone is illegal in the United States regardless of whose phone it is, with one narrow exception covered later in this article. The CFAA defines a “protected computer” broadly enough to include smartphones, tablets, and any internet-connected device.

The phrase “hack a phone” covers a wide range of specific acts. It includes remotely accessing someone’s iCloud or Google account to read their texts, installing spyware on their device, intercepting their calls through a signal exploit, and breaking into their voicemail by guessing a PIN.

Each of these acts implicates a different statute. Accessing stored messages without authorization violates the Stored Communications Act (18 U.S.C. 2701). Intercepting calls in real time violates the ECPA Wiretap Act (18 U.S.C. 2511). Gaining unauthorized access to the device itself violates the CFAA (18 U.S.C. 1030(a)(2)).

Types of phone hacking and which law applies:

The News of the World phone hacking scandal in the UK and the subsequent criminal convictions there demonstrated internationally that phone hacking is not treated as a minor offense. U.S. law reflects the same seriousness.

Penalty for Hacking Someone’s Phone

The penalty for hacking someone’s phone under federal law ranges from 1 year in prison for basic unauthorized access up to 10 years or more for offenses involving financial fraud, national security, or damage to critical systems. State penalties stack on top of federal sentences.

Under 18 U.S.C. 1030(c), the penalty structure scales with the severity of the offense. A first-time basic CFAA violation involving unauthorized access with no financial gain is typically a misdemeanor carrying up to 1 year in prison. Add financial damage, identity theft, or repeat offenses and the charge escalates to a felony.

If the phone hacking results in financial fraud or theft, the Identity Theft Enforcement Act (18 U.S.C. 1028A) adds a mandatory 2-year consecutive sentence on top of whatever the base CFAA sentence is.

Fines can reach $250,000 per count under 18 U.S.C. 3571 for federal offenses. Civil lawsuits from the victim add financial exposure beyond criminal penalties.

Is It Illegal to Hack Your Own Phone

Hacking your own phone is generally not illegal because you own the device and have authorization to access it. Authorization is the legal dividing line under the CFAA, and you can’t commit unauthorized access on a device you own and control.

There are, however, situations where even accessing your own phone creates legal problems. If your phone is subject to a court order, evidence hold, or active legal proceeding, tampering with data on it can constitute obstruction of justice or spoliation of evidence.

Jailbreaking your own iPhone or rooting your own Android device occupies a different legal category. The CFAA’s authorization doctrine generally protects the device owner who modifies their own hardware and software. The Digital Millennium Copyright Act (DMCA) adds some complexity around software locks, but the Copyright Office has repeatedly issued exemptions allowing personal device jailbreaking for non-commercial purposes.

What is and isn’t legal with your own phone:

You may want to read Is It Illegal to Record a Meeting Without Consent? 2026

• Legal: Unlocking your own phone, jailbreaking for personal use, accessing your own accounts
• Legal: Monitoring your minor child’s phone activity with appropriate parental tools
• Gray area: Factory resetting a phone that has been issued by your employer
• Illegal: Accessing a phone you jointly own but the other person has exclusive custody of under a court order
• Illegal: Using your own phone to facilitate unauthorized access to another person’s system

The “it’s my phone” defense falls apart the moment another person’s data or accounts are involved.

Key Takeaway: You cannot be charged with hacking your own phone under normal circumstances because you have authorization by definition. The legal exposure begins when your actions affect another person’s data, accounts, or systems.

Is It Illegal to Install Tracking Software on Someone’s Phone

Installing tracking software on someone’s phone without their knowledge or consent is illegal under the Computer Fraud and Abuse Act and potentially the Electronic Communications Privacy Act. This practice is sometimes called stalkerware, and federal prosecutors have treated it as a serious criminal offense.

The FTC took a landmark enforcement action against SpyFone in 2021, banning the company from the surveillance industry after it marketed software designed to hide from device owners. This signaled that both the companies selling these tools and the individuals using them face legal risk.

There is one important exception. Parents installing monitoring software on a minor child’s phone, with or without the child’s knowledge, generally fall within legal parental rights. The child must be a minor, the parent must own or control the device, and the purpose must be parental supervision rather than harassment or stalking.

Legal vs illegal phone tracking:

State stalking and domestic violence statutes add additional criminal exposure for spyware installation in intimate partner contexts. California, Illinois, and Texas all have specific provisions addressing electronic surveillance in these situations.

Is It Illegal to Hack Someone’s Social Media

Hacking someone’s social media account without their consent is illegal under the Computer Fraud and Abuse Act. Social media accounts are protected electronic communications systems, and unauthorized access to them triggers CFAA liability under 18 U.S.C. 1030(a)(2).

People frequently underestimate this. Logging into a friend’s Instagram to post something funny, accessing an ex-partner’s Facebook to read their messages, or guessing someone’s Twitter password to check their DMs are all acts that can result in federal criminal charges. The informality of the act doesn’t change the legality.

Courts have consistently held that social media accounts are protected computers under the CFAA because they operate through internet-connected servers. The fact that the “computer” you’re accessing isn’t a physical machine in front of you doesn’t matter under the statute.

Real prosecution examples of social media hacking:

• Multiple individuals have been federally charged for accessing ex-partners’ accounts to read private messages
• A Wisconsin man received 18 months in federal prison for hacking a woman’s social media accounts and downloading private photos
• Employees who access colleagues’ accounts to gather workplace information have faced both criminal charges and civil suits

The ECPA’s Stored Communications Act (18 U.S.C. 2701) also applies when someone accesses stored private messages on a social media platform without authorization, adding a second layer of federal criminal exposure.

Is It Illegal to Hack a Company’s Website

Hacking a company’s website without authorization is a federal crime under the CFAA and one of the most actively prosecuted categories of cybercrime in the United States. Companies are among the most protected entities under 18 U.S.C. 1030 because their systems typically meet the statute’s “protected computer” threshold easily.

A company’s website sits on servers connected to the internet, which makes it a protected computer under CFAA regardless of its size. A small business’s website carries the same federal legal protection as a Fortune 500 corporation’s server. Unauthorized access is unauthorized access.

The damage threshold matters significantly here. If a hacker’s unauthorized access causes $5,000 or more in damages, the offense becomes a felony under 18 U.S.C. 1030(c)(4)(B). Damages can include the cost of investigating the breach, restoring systems, notifying customers, and lost revenue during downtime.

Quick Facts on corporate hacking charges:

• The DOJ prosecutes corporate hacking cases regardless of whether the company reports the breach
• Defacing a company’s website (changing its appearance) is treated as intentional damage under 18 U.S.C. 1030(a)(5)
• DDoS attacks (flooding a site with traffic to take it down) are explicitly covered under the CFAA
• Civil suits from companies can reach into the millions in damages beyond criminal penalties
• Companies can also sue under state computer crime statutes in addition to filing federal complaints

Key Takeaway: Hacking a company’s website is a federal felony when damages exceed $5,000, and the DOJ actively pursues these cases. Civil liability from the company itself adds significant financial exposure beyond criminal penalties.

Is Spyware Illegal

Spyware is illegal when installed on a device without the owner’s knowledge and consent. The Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, and state-level surveillance laws all potentially apply to spyware depending on how it operates and what data it collects.

Spyware is software designed to collect information from a device covertly, often capturing keystrokes, screenshots, location data, messages, and browsing history. The installation itself is the first crime: placing software on someone’s device without authorization violates the CFAA. The ongoing data collection is the second crime: intercepting electronic communications without consent violates the ECPA.

Commercial spyware companies have faced increasing federal scrutiny since 2021. The FTC has taken enforcement action against multiple companies marketing spyware tools to the general public, particularly those advertising “catch a cheating spouse” use cases.

Types of surveillance software and their legal status:

State laws go further in several jurisdictions. California’s Comprehensive Computer Data Access and Fraud Act and Illinois’s Electronic Privacy Act both add state-level penalties for spyware installation that run parallel to federal charges.

Federal Hacking Penalties

Federal hacking penalties under the CFAA range from 1 year in prison for a basic first-time unauthorized access misdemeanor up to 20 years for offenses involving critical infrastructure or national security. Fines can reach $250,000 per count.

The CFAA’s penalty structure under 18 U.S.C. 1030(c) scales based on several factors: whether the offense was committed for financial gain, whether the damage exceeded $5,000, whether the offense involved a government computer, and whether the defendant has prior CFAA convictions.

For context, the Aaron Swartz case demonstrated how aggressively federal prosecutors can apply the CFAA. Swartz faced up to 35 years in prison and $1 million in fines for allegedly downloading academic articles from JSTOR without authorization, a case that sparked significant debate about CFAA overreach.

Civil penalties add another layer. Under 18 U.S.C. 1030(g), victims can sue hackers for compensatory damages, injunctive relief, and other equitable relief. Corporate victims have won multi-million dollar civil judgments in CFAA cases.

State Hacking Laws

Every state has its own computer crime law that operates alongside the CFAA, and state penalties often mirror or exceed federal ones for certain offenses. Prosecutors can choose to charge under state law, federal law, or both simultaneously.

California’s computer crime statute, Penal Code Section 502, is one of the most detailed in the country. It covers unauthorized access, data theft, disruption of computer services, and introducing contaminants (malware) into systems. Violations can be charged as misdemeanors or felonies depending on the circumstances, with felony convictions carrying up to 3 years in state prison.

Explore this too: Audio Cameras in the Workplace: Is It Illegal in 2026?

Texas handles hacking under Penal Code Chapter 33 (Breach of Computer Security). Texas classifies offenses based on the value of any data or damage involved, ranging from a Class B misdemeanor for minor incidents up to a first-degree felony for offenses involving $300,000 or more in damages.

State charges frequently accompany federal charges in significant hacking cases. A defendant convicted under both the CFAA and a state statute can receive consecutive sentences.

Hacking Charges: Felony or Misdemeanor

Hacking charges can be either a felony or a misdemeanor, and the line between them depends on the damage caused, the intent, and whether the defendant has prior convictions. Most people assume any hacking charge is automatically a felony. That’s not correct.

Under 18 U.S.C. 1030(c)(2)(A), a first-time unauthorized access offense that doesn’t involve financial gain, national security, or significant damage is a misdemeanor carrying up to 1 year in prison. The offense escalates to a felony when aggravating factors are present.

The practical reality is that most cases prosecutors choose to pursue federally involve at least one felony-level aggravating factor, because the FBI and DOJ tend to focus investigative resources on higher-stakes matters. But state-level prosecutions regularly involve misdemeanor hacking charges for lower-level incidents.

Factors that turn a misdemeanor hack into a felony:

• Financial gain or intent to defraud
• Damage exceeding $5,000 in any 12-month period
• Obtaining information for financial gain or to harm another person
• Accessing a computer used by the federal government
• Prior CFAA conviction
• Hacking that affects critical infrastructure such as hospitals or power grids

Being convicted of even a misdemeanor hacking charge creates a criminal record that shows up in background checks, affects employment, and can impact professional licensing in fields like finance, law, and healthcare.

Key Takeaway: Hacking charges range from misdemeanor to serious felony depending on damage, intent, and criminal history. A first offense with no financial gain can result in just 1 year in prison, but aggravating factors can push that to 20 years under federal law.

Is Ethical Hacking Legal

Ethical hacking is legal when it is performed with explicit written authorization from the system owner. The single most important word in cybersecurity law is authorization, and ethical hacking is defined entirely by whether that authorization exists and how specifically it is documented.

Ethical hackers, also called white hat hackers or penetration testers, are hired by companies to find security vulnerabilities before criminal hackers do. They perform the same technical acts as malicious hackers, scanning networks, attempting to bypass authentication, and probing for weaknesses. The difference is that they have written permission to do so.

Without that written authorization, even well-intentioned security testing is a federal crime. Cybersecurity professionals who probe systems without a signed penetration testing agreement face CFAA liability even if they never intended to cause harm and reported their findings publicly.

What makes ethical hacking legal:

• A signed penetration testing agreement or bug bounty program enrollment
• Clear scope definition specifying exactly which systems can be tested
• Time limits defining when testing is authorized
• Written confirmation from an authorized representative of the target organization
• Non-disclosure agreements covering any vulnerabilities discovered

The 2021 Van Buren ruling helped clarify some boundaries for authorized users, but it did not create a blanket “good faith” exception to the CFAA. Authorization must be real, specific, and documented.

Bug Bounty Programs and Legality

Bug bounty programs are legal frameworks that companies use to authorize independent researchers to find and report security vulnerabilities in exchange for payment or recognition. Participation in a legitimate bug bounty program is legal because it satisfies the CFAA’s authorization requirement.

Major technology companies including Google, Microsoft, Apple, and Meta operate formal bug bounty programs. Google’s Vulnerability Reward Program has paid out over $50 million to researchers since its inception. These programs explicitly authorize testing within defined boundaries, and that authorization is what keeps participants on the right side of the CFAA.

The critical issue is scope. Bug bounty programs specify exactly which systems, domains, and types of testing are permitted. A researcher who goes outside that defined scope, accessing systems not listed in the program, is no longer covered by the authorization and is potentially committing a federal crime.

Key rules for staying legal in bug bounty work:

• Only test systems explicitly listed in the program scope
• Follow the testing rules specified in the program’s terms
• Never access, exfiltrate, or retain user data beyond what is minimally necessary to demonstrate the vulnerability
• Report findings through the company’s designated reporting channel
• Do not disclose vulnerabilities publicly before the company has had reasonable time to respond
• Do not perform denial-of-service testing unless explicitly authorized

The line between celebrated security researcher and federal defendant is thinner than most people realize. Scope discipline is what keeps ethical hackers out of court.

Frequently Asked Questions

Is it illegal to hack someone’s phone in the United States?

Yes, hacking someone’s phone without their consent is illegal under federal law.
The Computer Fraud and Abuse Act (18 U.S.C. 1030) and the Electronic Communications Privacy Act (18 U.S.C. 2511) both apply to unauthorized phone access.
Penalties range from 1 year in prison for a basic first offense up to 10 years or more when financial fraud or damage is involved.
State laws add additional criminal exposure on top of federal charges.

What federal law makes hacking illegal?

The primary federal law that makes hacking illegal is the Computer Fraud and Abuse Act, 18 U.S.C. 1030.
The Electronic Communications Privacy Act, 18 U.S.C. 2511, covers the interception of electronic communications.
The Stored Communications Act, 18 U.S.C. 2701, applies to unauthorized access to stored messages and emails.
Most federal hacking prosecutions involve charges under more than one of these statutes simultaneously.

Can you go to jail for hacking someone’s social media account?

Yes, accessing someone’s social media account without their permission is a federal crime under 18 U.S.C. 1030(a)(2).
Multiple people have received federal prison sentences for hacking ex-partners’ or colleagues’ social media accounts.
A first-time offense with no financial gain can result in up to 1 year in prison.
When the hack involves financial fraud, damage, or prior convictions, prison terms can reach 5 to 10 years.

Is ethical hacking legal in the US?

Ethical hacking is legal in the US when it is performed with written authorization from the system owner.
Without a signed penetration testing agreement or formal bug bounty program enrollment, even well-intentioned hacking is a federal crime.
The Computer Fraud and Abuse Act does not contain a “good faith” exception for unauthorized testing.
Authorization must be specific, documented, and obtained from someone with the legal authority to grant it.

What is the penalty for hacking under the Computer Fraud and Abuse Act?

Penalties under the CFAA range from 1 year in prison for a basic first-time misdemeanor up to 20 years for repeat or high-damage offenses.
Fines can reach $250,000 per count under 18 U.S.C. 3571.
Offenses involving financial fraud add a mandatory 2-year consecutive sentence under the Identity Theft Enforcement Act.
Civil liability from victims can add millions in damages beyond criminal penalties.

Closing

Hacking law in 2026 is clear on the fundamentals: unauthorized access is a crime, phones get some of the strongest protections in U.S. law, and authorization is the line that separates a cybersecurity career from a federal prison sentence. The severity of the consequences scales fast, and most people genuinely don’t know how far the CFAA’s reach extends.

Share this article with anyone asking whether a specific digital action crosses a legal line. The laws covered here affect more people than most realize, and knowing the framework is the first step to staying on the right side of it.

A related guide: Is It Legal to Download YouTube Videos for Personal Use? 2026