It can be. California’s computer crime law makes it an offense to knowingly access a computer, computer system, or computer network without permission, and the statute has no exception for spouses or partners. How serious it is depends on what you did once inside the account, whether anything was altered or anyone was locked out, whether it cost the owner money to check for damage, and whether you have done it before.

Logging in without permission is its own offense

Penal Code section 502(c)(7) makes it a public offense to “knowingly and without permission” access, or cause to be accessed, “any computer, computer system, or computer network.” The statute defines access broadly, as gaining entry to, instructing, or communicating with the resources of a computer, system, or network (section 502(b)(1)), so logging into someone else’s email or social media account without permission can fall within this offense even if nothing is taken.

The penalty depends on the facts:

  • A first violation that does not result in “injury” is an infraction, punishable by a fine of up to $1,000 (section 502(d)(3)(A)). The statute defines injury as altering, deleting, damaging, or destroying data or a system, or denying access to its legitimate users (section 502(b)(10)).
  • A violation that causes a “victim expenditure” of $5,000 or less, or any second or later violation, is punishable by a fine as high as $5,000, county jail for up to a year, or both (section 502(d)(3)(B)).
  • A victim expenditure over $5,000 makes it a wobbler. As a felony it carries 16 months, 2, or 3 years under Penal Code section 1170(h), a fine as high as $10,000, or both; as a misdemeanor, county jail for up to a year, a fine as high as $5,000, or both (section 502(d)(3)(C)).

A victim expenditure is what the owner reasonably and necessarily spends to verify whether the account’s system or data was altered, deleted, damaged, or destroyed by the access (section 502(b)(11)).

Taking or using what is inside raises the stakes

A separate subdivision covers knowingly accessing and, without permission, taking, copying, or making use of any data from a computer, computer system, or computer network (section 502(c)(2)). Messages, photos, and contacts are data (section 502(b)(8)). This version is a wobbler from the first violation. As a felony it carries 16 months, 2, or 3 years under section 1170(h) plus a fine as high as $10,000; as a misdemeanor, county jail for up to a year, a fine as high as $5,000, or both (section 502(d)(1)). Forwarding or screenshotting messages, or using what you found, for example in a family court filing, can raise this more serious charge.

There is no partner or spouse exception

Section 502 has no exception for spouses, partners, or people who share a home or a device; the exceptions it does contain concern employment and labor activity (section 502(f), (h)). The statute turns on whether you had permission for the access, not on your relationship. Whether a password shared earlier in the relationship amounted to permission for what you did, or whether that permission had been withdrawn, is a fact question to take to a lawyer. The statute does not answer it for you either way.

Posing as your partner online is a separate crime

Penal Code section 528.5 makes it a crime to knowingly and without consent credibly impersonate another actual person online or by other electronic means to harm, intimidate, threaten, or defraud someone. An impersonation is credible if another person would reasonably believe, or did reasonably believe, that you were the person impersonated, and electronic means include opening an email account or a social media account or profile in the other person’s name. The penalty is county jail for up to a year, a fine as high as $1,000, or both (section 528.5(a)-(d)). Reading messages while logged in does not impersonate anyone by itself. Sending messages or posting as the account owner can, if others would reasonably believe it was the owner and it is done to harm, intimidate, threaten, or defraud someone.

It can matter in family court too

In a domestic violence restraining order case, “disturbing the peace” includes coercive control, and one listed example is unreasonably controlling, regulating, or monitoring the other person’s communications (Family Code section 6320(c)(3)). A restraining order can also prohibit credibly impersonating the other person as described in section 528.5 (Family Code section 6320(a)).

A civil lawsuit is also possible

Apart from any criminal case, the owner of the data who suffers damage or loss can sue for compensatory damages and injunctive or other equitable relief, and the court may award attorney’s fees (Penal Code section 502(e)(1), (e)(2)). The suit must be filed within three years of the act or of the discovery of the damage, whichever is later (section 502(e)(5)).

What this means for you

  • If you already accessed a partner’s account, stop. Do not log in again, and do not copy, forward, or use anything from it. Talk to a lawyer before you do anything with what you already have.
  • If you believe your own account was accessed, write down what you noticed (dates, unfamiliar activity, changed settings) and secure your account, but do not access anyone else’s account to investigate.
  • Do not assume that being married, living together, or once knowing the password settles whether you had permission.
  • If this is connected to a domestic violence case or a protective order, get advice on how it fits into that case; see domestic violence defense.

Next steps

Whether you are worried about something you already did or something done to you, the facts of access, permission, and what happened to the data all matter. The Law Offices of David S. Chesley can review the specifics of your situation and explain your exposure or your options. Call (800) 755-5174 to discuss your case.