Wasn't that the very basis of the Aaron Schwartz case? That, by violating the terms of use of the MIT site, he was violating the CFAA thus charged with multiple felonies?

The linked case dealt with employees but I don't see why there should be a distinction. I would consider the general public to have even greater protections.

This is a little different as it has to do with exceeding authorized access as an employee.

The CFAA doesn't allow TOS writers to "invent" felonies, but it does allow for a basis of prosecution against someone who breaks it.

Someone who siphons off data, breaking a TOS, will get treated the same as someone who lies on their dating profile. This is why the CFAA is too vague in its current form.

We're expected to trust that only the "big guys" will be prosecuted under the CFAA, skirting the point of having the rule of law in the first place as no interpretation of a law should be left up to the discretion of a few men.

As well, most people break at least 3 laws a day without knowing it, and they're likely breaking many more throughout the day online, just not getting prosecuted for it, but they could.