Is It Illegal to Use Someone’s WiFi Without Permission?

Yes, it is illegal to use someone’s Wi-Fi without permission. The federal Computer Fraud and Abuse Act treats connecting to a private network without the owner’s consent as unauthorized access to a protected computer, and most states have their own computer trespass laws that reach the same conduct. Penalties start at up to a year in jail for a bare first offense and climb to ten years for repeat offenders or anyone who uses the connection to commit another crime. In practice, prosecutors rarely pursue casual piggybacking on its own, but the law gives them a powerful hook when something worse happens on the borrowed connection.¹

The Federal Law That Applies

No federal statute uses the phrase “Wi-Fi theft.” The relevant law is 18 U.S.C. § 1030, which makes it a crime to intentionally access a computer without authorization or to exceed the authorization you have. A home or business router counts as a “protected computer” because the statute defines that term to include any computer used in or affecting interstate commerce or communication. Virtually every internet-connected device qualifies.¹

States layer their own computer crime statutes on top. The labels vary — “computer trespass,” “unauthorized access to a computer network” — but the core prohibition is consistent across jurisdictions: connecting to a private network without the owner’s consent can trigger criminal liability.

Does It Matter Whether the Network Has a Password

It matters, but less than people assume.

Bypassing a password is clear-cut. You defeated a security measure to get in, so the access was unauthorized by any reading of the statute. An open network is harder. Some argue that broadcasting a signal without a password is an implicit invitation. Courts and legislatures in most jurisdictions have not accepted that view. The prevailing treatment is that a Wi-Fi network remains private property whether or not the owner locked the gate. An unlocked front door does not give a stranger permission to walk in.

Context changes the analysis. A coffee shop broadcasting a network named “FreeCoffeeShopWiFi” is clearly offering access. A neighbor’s unsecured “NETGEAR-5G” is not.

One boundary worth naming: accidental connections. Most phones and laptops will latch onto available open networks with no deliberate action by the user. The CFAA requires that access be intentional, and drifting onto a signal while walking past a house is a long way from choosing to use that network. Prosecutors would need to show you knowingly connected and stayed on, which is why accidental connections almost never produce charges.

Criminal Penalties

The CFAA uses a tiered penalty structure. The severity depends on what you did after connecting, whether you profited, and whether you have a prior conviction under the same statute.

Misdemeanor Level

A first-time offense of simply accessing a network without authorization and obtaining information falls under subsection (a)(2). The maximum is one year of imprisonment and a fine.¹ The statute says “a fine under this title” without naming a figure, so the general federal fine statute controls. For a Class A misdemeanor, the maximum fine for an individual is $100,000.²

Felony Level

The same unauthorized access becomes a felony carrying up to five years in prison when any of these aggravating factors apply under 18 U.S.C. § 1030(c)(2)(B):

The access was for commercial advantage or private financial gain.
The access was in furtherance of any other federal or state crime, such as fraud or identity theft.
The information obtained was worth more than $5,000.

Felony fines for individuals reach $250,000 under the general federal fine statute.²

A separate track under subsection (a)(5) covers damage to a protected computer caused through reckless or intentional conduct, with up to five years of imprisonment when the aggregate loss to victims reaches at least $5,000 in a one-year period.¹

Repeat Offenders

A second CFAA conviction doubles the maximum imprisonment for several categories. An offense under subsection (a)(2) that would normally cap at one year jumps to ten years on a second conviction. Offenses under subsections (a)(4) and (a)(7) climb from five years to ten.¹

What Prosecutors Have to Prove

For an unauthorized access charge under subsection (a)(2), the government must show that the defendant intentionally accessed a protected computer without authorization and obtained information by doing so.¹ Two elements carry the weight.

Intent means the access was deliberate. Prosecutors typically rely on digital records: router logs capture every device that connects along with timestamps and MAC addresses, and internet providers keep their own connection records. These automated logs are generally admissible as computer-generated records.

Authorization is the contested element. With a password-protected network, the absence of authorization is obvious. With an open network, the question is whether you had any reason to believe the owner consented.

Can the Network Owner Sue You

Yes. The CFAA lets anyone who suffers damage or loss from a violation bring a civil action for compensatory damages and injunctive relief.¹ Two limits apply. The conduct must involve one of five specific harm factors in the statute, one of which is aggregate loss of at least $5,000 in a one-year period. And the suit must be filed within two years of the act or within two years of when the victim discovered the damage, whichever is later.

Civil suits over Wi-Fi piggybacking are rare in practice. The damages from casual use are usually too small to justify the cost of litigation. When these cases do appear, something more than mooching happened on the connection — data interception, bandwidth consumption severe enough to disrupt service, or similar.

How Often This Actually Gets Prosecuted

The statute is one thing. Enforcement is another.

Prosecutions for simple Wi-Fi piggybacking are extremely rare. Federal prosecutors have limited resources and little incentive to pursue someone who briefly connected to a neighbor’s open network and scrolled social media. The CFAA’s criminal provisions are almost exclusively used against people who accessed networks to steal data, commit fraud, or cause damage. The handful of reported state arrests over the past two decades made the news precisely because they were unusual, and most involved someone repeatedly parking outside a business or home to use the connection.

The practical risk is lopsided. If unauthorized access is the only thing that happened, federal charges are unlikely. If the access was a stepping stone to something worse, the CFAA gives prosecutors a powerful add-on charge. Your ISP can also act outside the legal system entirely — most service agreements prohibit allowing unauthorized users on your connection and reserve the right to throttle speeds, suspend service, or terminate accounts tied to abuse or repeated copyright complaints.

If Someone Else Is Using Your Wi-Fi

The exposure runs both ways. If a stranger piggybacks on your network and does something illegal, the trail leads to your IP address first. Law enforcement traces activity to the subscriber, not to the specific device. The knock on the door comes to the account holder.

Owners are generally not criminally liable for a stranger’s illegal activity on their network, especially where the access was unauthorized. That is not the same as being unaffected. Investigations involve search warrants, device seizures, and forensic examination of your computers before anyone sorts out that you were not the person downloading illegal material. Reported cases include homeowners having their doors broken down by federal agents over activity that turned out to originate from a neighbor using the unsecured network.

No federal law requires you to password-protect your Wi-Fi. Securing the network with WPA3 or WPA2 encryption and a strong password is still the single most effective step you can take. It will not make you immune to legal complications, but it sharply reduces the chance that someone else’s activity gets attributed to you.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine