downloadCord cutters rejoiced this past Super Bowl Sunday. Not only is CBS creating its own streaming option, but the broadcaster went out of its way to make streaming the annual spectacle incredibly easy. Now, could streaming services make it even simpler: What about the legality of password sharing?

Cord cutting is the practice, relatively new and especially popular among millennial media consumers, to “cut” the cable cord, canceling pricey, bundled cable broadcast service. That’s because customers can access and consume media (including television shows, movies, video games, and music videos) cheaper and via other online services, typically streaming services like Netflix, Hulu, and Amazon Prime. Cord cutting also fosters password sharing: providing services’ access information with friends, family, or significant others. It got a lot of attention when Emmy host Andy Samberg last fall gave out a working HBO password on air. calls the practice “a telling step in contemporary coupling – a contemporary version of leaving an extra toothbrush in your partner’s bathroom.”

Although some estimates put the economic losses of this practice as high as a half-billion dollars annually, HBO and Netflix’s respective CEOs don’t see password sharing as a problem, even going so far as to say it helps create new subscribers. What are the legal implications? Does it violate the terms of service? Can I be arrested?!

A federal act

Who might be subject to legal action under the Computer Fraud and Abuse Act (CFAA)? It states that bad actors include: “Whoever having knowingly accessed a computer without authorization or exceeding authorized access … or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it,” 18 USC §1030 (a)(1).

Some scholars speculate that this statute could be applied to anyone who exceeds the authorization they have been given. In other words, if the terms of use of your given service (HBO, Netflix, Hulu) say you can’t share your password and you do so, then you have violated the terms of service, exceeded your authorized access and thus violated the CFAA. The act provides for stiff fines and possible jail time, certainly nothing to ignore.

Of course the act has been widely criticized by both the EFF and internet commentators as “over broad,” “making totally mundane online behavior illegal” and written “so poorly that creative prosecutors have been abusing it ever since.” The major criticism of the act is that it acts as a “catch-all.” If there isn’t enough to get you on one charge, federal prosecutors can get you on this one. My favorite fact is that this law was written in response to perceived computer threats stemming from 1983 Matthew Broderick classic film, WarGames. (I mean, as a character, actor Broderick did go on later to scam older women out of their savings, right?)

Terms of service

So what do some of the services say about password sharing? Reading Netflix’s Terms of Use, only one section actually deals with password sharing. It merely states that to “maintain exclusive control” of one’s account the “Account Owner should not reveal the password to anyone.” Should, not shall. Of course the terms of use also state that you cannot use Netflix to publicly perform the works, you agree to use Netflix “in accordance with all applicable laws,” and the End User Software License is only granted to you and members of your immediate family.

As for HBO, it warns customers in its terms of use that they “will not permit the disclosure of any Username and Password to any person.” The service specifies that registered households may “set up subaccounts for members of your household, each with a separate Password, tied to your Registered Account. …  Subaccounts should be limited to members of your immediate household only.” Further, “Each household member will be required to read and accept these Terms and the Privacy Policy. If you are a parent or legal guardian and wish to establish a household member account for your minor child, you must click to accept the Terms and Privacy Policy on behalf of such minor child.”

Practically speaking, be careful

What does all this mean in practical terms? Password sharing probably won’t land you in a jail cell. If there have been prosecutions of streaming service customers for password sharing, these cases likely would get media attention – and online searches don’t pick up any. The issue of password sharing has gotten ample online attention, including from analysts who note that state statutes – specifically in Tennessee – could create challenges for those involved in the practice.

And while password sharing may be legally problematic but pragmatically low in risk for now, it wasn’t that long ago that other Entertainment industry sectors went to war against those acknowledged to be consumers but also potential threats to the intellectual property of artists and companies. This blog has many posts about the recording industry’s crackdown, sometimes draconian, against downloaders; Hollywood has vigorously pursued via internet service providers information about those it accuses of those improperly or illegally sharing and storing its works.

When dealing with the outdated CFAA, there has been disturbing precedent that makes online behaviors illegal. So password sharers, keep your eyes on any changes in attitude and practice by the streaming services, and govern yourselves accordingly.