California Penal Code 502: Penalties, Defenses, and Civil Suits

California Penal Code 502, formally the Comprehensive Computer Data Access and Fraud Act, makes it a crime to knowingly access a computer, system, network, or data without permission, and to tamper with, copy, disrupt, or infect what you find there. Penalties range from a misdemeanor fine of up to $5,000 and a year in county jail to a felony sentence of 16 months, two years, or three years in state prison with a fine of up to $10,000, depending on whether the conduct caused injury and how much the victim spent cleaning it up. The same conduct can also draw federal charges under the Computer Fraud and Abuse Act, so a single incident sometimes produces parallel prosecutions.

What the Statute Makes Illegal

The law reaches a wider range of conduct than most people assume. You do not have to break into a stranger’s system. Logging back into an employer’s network after your access was revoked can be enough, and so can helping someone else do it.

The prohibited acts fall into several categories:

Knowingly accessing a computer, system, or network without permission and then altering, damaging, deleting, or destroying data or programs.
Accessing a system without permission to carry out a fraud, extortion, or scheme to wrongfully obtain money, property, or data.
Taking, copying, or using data, or copying supporting documentation like manuals and technical files, without authorization.
Using processing time, storage, or other computing resources without authorization, even if nothing is copied or damaged.
Knowingly disrupting computer services or denying access to legitimate users. Distributed denial-of-service attacks are a textbook example.
Knowingly introducing a contaminant such as a virus, worm, ransomware, or keylogger into any computer or network.
Using another person’s or entity’s internet domain name without permission to send damaging email.
Providing or assisting in providing a way for someone else to gain unauthorized access, which covers sharing stolen credentials and selling hacking tools with knowledge of how they will be used.

Two words run through every one of these offenses: “knowingly” and “without permission.” Both have to be proven, and both are where many defenses live.

How the Penalties Are Tiered

PC 502 is not a flat wobbler. It has three distinct tiers, and which one applies turns on injury, dollar loss, and whether you have a prior.

Misdemeanor-Only

A first-time violation that does not cause injury to a computer system, network, or data is a straight misdemeanor. The maximum is a $5,000 fine, up to one year in county jail, or both.¹ Many low-level cases land here: someone who logged into an ex-employer’s system and looked around but did not break anything or take data of significant value.

In this context “injury” is a technical term. It means alteration, deletion, damage, or destruction of a system, network, program, or data, or denial of access to legitimate users. It is about harm to the system itself, not the dollar value of the loss.

Wobbler

The charge becomes a wobbler, meaning the prosecutor can file it as a misdemeanor or a felony, when any of the following is true:

The violation caused injury to a computer system, network, program, or data.
The victim’s expenditures to investigate and repair the damage exceeded $5,000.
The value of unauthorized computer services used exceeded $950.
The defendant has a prior conviction under PC 502.

Filed as a misdemeanor, the exposure matches the first tier: up to $5,000 and up to a year in county jail. Filed as a felony, the penalties jump to 16 months, two years, or three years in state prison and a fine of up to $10,000.¹

Prosecutors weigh the total dollar loss, the sophistication of the intrusion, the number of victims, the defendant’s criminal history, and whether the access was part of a broader fraud scheme when deciding which way to charge a wobbler.

Equipment Forfeiture

Under Penal Code 502.01, the court may order forfeiture of computers, networks, software, and stored data used to commit or facilitate a PC 502(c) violation. The prosecution must prove by a preponderance of the evidence that the property was used in the offense. Third parties with a legitimate interest, such as an employer whose company laptop was misused by an employee, can file a motion to reclaim equipment before the forfeiture hearing.²

Civil Lawsuits by Victims

PC 502 is not only a criminal statute. The owner or lessee of a compromised computer, system, network, program, or data can sue anyone who violated it, even if criminal charges were never filed or ended in acquittal.¹

Available remedies include compensatory damages and injunctive relief. Compensatory damages specifically cover what the victim reasonably spent to verify whether their system or data was altered, damaged, or deleted. The court can award reasonable attorney’s fees to the prevailing plaintiff. For willful violations involving oppression, fraud, or malice, proven by clear and convincing evidence, the court may add punitive damages on top.¹

The civil track matters more than many defendants expect. A criminal case requires proof beyond a reasonable doubt; a civil suit only requires a preponderance of the evidence. Corporate victims that spent six figures on forensic investigators and remediation have strong incentives to pursue those costs through litigation.

Defenses That Can Defeat the Charge

Because every PC 502 offense requires that the defendant acted “knowingly” and “without permission,” several defenses open up.

You had authorization. If you had permission to access the system, there is no violation. The hard question is who had authority to grant that permission. An IT coworker letting you borrow a login is not the same as the system owner authorizing your access. Courts look at whether the consent came from someone actually empowered to give it.

You did not act knowingly. The statute requires knowledge that your access was unauthorized. If you genuinely believed you were still authorized, for instance because your credentials kept working after you were fired and no one told you access had been revoked, the knowledge element may fail. This defense is fact-intensive and hinges on what you knew and when.

No intent to defraud. Several subsections require intent to defraud, deceive, or extort. For those charges, unauthorized access alone is not enough; the prosecution must show you accessed the system with that specific goal. Curiosity is not fraud. Other subsections that do not require fraudulent intent may still apply.

No injury or damage. If the wobbler trigger is alleged injury but the system was never actually altered, damaged, or disrupted, you can challenge that element. Digital forensics is where this is won or lost. Showing that no files changed and no services went down can drop a potential felony back to a first-offense misdemeanor.

When Federal Charges Also Apply

The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, overlaps significantly with PC 502. Federal prosecutors can charge the same conduct separately when it involves a computer used in interstate or foreign commerce, which in practice means any device connected to the internet. One act of hacking can produce charges in both state and federal court.

Federal penalties are generally steeper. The basic CFAA tiers include:³

Simple unauthorized access, first offense with no aggravating factors: up to one year in federal prison.
Unauthorized access for commercial gain, to further another crime, or when the value of information exceeds $5,000: up to five years.
Knowingly causing damage to a protected computer, first offense: up to five years for reckless damage, up to ten years for intentional damage.
Obtaining restricted government or financial information: up to ten years for a first offense.
Repeat offenders: maximum sentences roughly double across the board, reaching up to twenty years for the most serious violations.

Federal prosecutors tend to pick up cases involving large-scale data breaches, attacks on financial institutions or government systems, and conduct that crosses state lines. If the loss is small and confined to a single California business, the case usually stays in state court. There is no bright-line rule; the decision rests with the prosecuting agencies.

Consequences That Outlast the Sentence

A felony PC 502 conviction creates collateral damage well beyond the prison term or fine. A computer-crime felony on your record makes passing a background check for technology, finance, or government work extremely difficult. Professional licenses that require disclosure of felony convictions, from engineering to real estate, can be denied or revoked. Because the offense is fraud-adjacent, immigration consequences for non-citizens can be severe, including potential deportation for crimes involving moral turpitude.

Even a misdemeanor conviction can trigger civil lawsuits from victims seeking compensatory damages and attorney’s fees under PC 502(e), stacking a financial judgment on top of the criminal penalties. Anyone facing a PC 502 investigation has reason to take the civil exposure seriously from the earliest stage.

1
California Legislative Information. California Penal Code 502 – Computer Crimes and Penalties
2
California Legislative Information. California Penal Code 502.01
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers