Cyberbullying laws come from several layers at once: federal criminal statutes on stalking, threats, and non-consensual intimate images; state criminal codes that cover electronic harassment; school anti-bullying policies required in all fifty states; and civil remedies including lawsuits and protective orders. Which law applies depends on who the harasser is, what they did, and who they targeted.
Federal Criminal Laws
Three federal statutes do most of the work in cyberbullying cases.
Cyberstalking
18 U.S.C. § 2261A, the federal stalking statute, covers anyone who uses the internet or other electronic communications to engage in a pattern of conduct intended to harass or intimidate another person, if the conduct places the target in reasonable fear of death or serious bodily injury or causes substantial emotional distress to the target or close family members.1Office of the Law Revision Counsel. 18 U.S. Code 2261A – Stalking
Penalties scale with harm. A conviction with no physical injury carries up to five years. Serious bodily injury raises the ceiling to ten years. Permanent disfigurement or life-threatening injury raises it to twenty, and if the victim dies, a life sentence is possible. Stalking in violation of an existing restraining order carries a one-year mandatory minimum.2Office of the Law Revision Counsel. 18 U.S.C. 2261 – Interstate Domestic Violence Courts must also order full restitution for medical care, therapy, lost income, attorney’s fees, and related losses.3Office of the Law Revision Counsel. 18 U.S.C. 2264 – Restitution
Interstate Threats
18 U.S.C. § 875 reaches anyone who transmits a threat to kidnap or injure another person through interstate communication. Because social media and email cross state lines by default, most online threats meet the jurisdictional requirement automatically. The maximum sentence is five years and a $250,000 fine, rising to twenty years if the threat is paired with an attempt to extort money or something of value.4Office of the Law Revision Counsel. 18 U.S. Code 875 – Interstate Communications5Office of the Law Revision Counsel. 18 U.S.C. 3571 – Sentence of Fine
The TAKE IT DOWN Act
Signed on May 19, 2025, the TAKE IT DOWN Act criminalizes publishing non-consensual intimate images online, including AI-generated deepfakes. For images of adults, the government must show the defendant knowingly published the material with intent to cause harm, or that the publication caused psychological, financial, or reputational harm, and that the victim had a reasonable expectation of privacy. For images of minors, liability attaches when the defendant intended to harass, humiliate, or gratify sexual desire.6Congress.gov. S.146 – TAKE IT DOWN Act 119th Congress (2025-2026)
Penalties depend on who was depicted and whether the images were published or threatened:
- Publishing images of an adult: up to two years in prison, a fine, or both.
- Publishing images of a minor: up to three years in prison.
- Threatening to publish authentic images: the same penalties as the corresponding publication offense.
- Threatening to publish deepfake images: up to 18 months for adults, 30 months for minors.
The law also requires platforms to build a notice-and-removal system by May 19, 2026. Once a victim notifies a platform that non-consensual intimate content is posted, the platform must remove it within 48 hours.7Congress.gov. The TAKE IT DOWN Act – A Federal Law Prohibiting Nonconsensual Intimate Visual Depictions Convicted defendants face mandatory restitution.
Hacking and Account Impersonation
When cyberbullying involves breaking into someone’s accounts or impersonating them, the federal Computer Fraud and Abuse Act (18 U.S.C. § 1030) adds another layer. Penalties range from one year for basic unauthorized access to twenty years for repeat offenders or offenses causing significant damage.8Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers Most states have parallel computer-crime statutes, so a classmate who hacks into a social media account to post humiliating content can face charges under both harassment and computer-fraud laws.
State Laws and School Discipline
State criminal codes are the most common avenue for prosecuting cyberbullying. Roughly 45 states have provisions specifically addressing cyberbullying or electronic harassment. A first offense is typically a misdemeanor punishable by up to a year in jail and a fine. When conduct includes credible threats of violence or a persistent pattern designed to create fear, prosecutors can upgrade the charge to stalking, which many states treat as a felony. Repeat offenders and those targeting minors face significantly harsher penalties.
Every state also requires schools to have anti-bullying policies, and the vast majority include cyberbullying in those mandates. Common elements include definitions of prohibited conduct, lists of commonly targeted characteristics, reporting procedures, and investigation obligations.9StopBullying.gov. Laws, Policies and Regulations Most require investigations to begin within a few business days of a report.
Schools can discipline students for off-campus online conduct in some situations. In Mahanoy Area School District v. B.L. (2021), the Supreme Court held that schools have a diminished interest in regulating speech that happens outside school hours and off school grounds, but their authority does not vanish entirely. Severe bullying or harassment targeting specific students, and threats against teachers or students, still justify school intervention.10Supreme Court of the United States. Mahanoy Area School District v. B. L. The practical test is whether the speech causes or is likely to cause a substantial disruption to the school. A student’s angry rant about a coach is likely protected; a sustained campaign targeting a classmate with threats or severe harassment is not, even if every message was sent from a bedroom.11Justia U.S. Supreme Court. Mahanoy Area School District v. B. L., 594 U.S. (2021)
Civil Lawsuits
Victims do not have to wait on a prosecutor. Civil suits can recover compensation and, in some cases, punitive damages.
Intentional infliction of emotional distress. This claim requires intentional conduct that is extreme and outrageous, directly causing severe distress. Courts set a high bar for “extreme and outrageous,” but sustained targeted harassment, especially campaigns involving threats, doxxing, or sexual content, can meet it. Recoverable damages include therapy costs and lost wages, and courts may add punitive damages.
Defamation. When cyberbullying includes false statements of fact that damage reputation, such as a false accusation of a crime, the target can sue. Opinions and insults are generally protected; false factual claims are not. Plaintiffs can recover actual damages such as lost job opportunities, and sometimes punitive damages.
Parental liability. When the harasser is a minor, most states let victims hold parents financially responsible for a child’s intentional or malicious acts. Statutory caps vary widely, from a few thousand dollars to over $50,000. This is often the only practical way to recover damages when the bully has no assets.
Protective Orders
A victim can petition a court for a protective order, sometimes called a restraining order, requiring the harasser to stop all contact. A judge typically reviews the petition and may issue a temporary order right away based on sworn statements, then holds a hearing where both sides present evidence before deciding on a longer-term order. Civil harassment orders can last up to five years in many jurisdictions. Violating one is a separate criminal offense, which gives victims an enforcement tool even when the underlying conduct would be hard to prosecute on its own.
Can You Sue the Platform?
Usually not. Section 230 of the Communications Decency Act bars treating a platform as the publisher of content posted by its users, which generally shields platforms from civil liability for user-posted harassment even when they know it is happening.12Office of the Law Revision Counsel. 47 U.S.C. 230 – Protection for Private Blocking and Screening of Offensive Material The immunity has exceptions: federal criminal prosecution, intellectual property claims, sex trafficking laws, and the new TAKE IT DOWN Act obligation to remove non-consensual intimate images within 48 hours of notification.6Congress.gov. S.146 – TAKE IT DOWN Act 119th Congress (2025-2026) For most other cyberbullying content, the real remedy against the platform is to report the material through its own policies.
Workplace Cyberbullying
When digital harassment between coworkers targets a protected characteristic such as race, sex, religion, disability, or age, it can create a hostile work environment under federal anti-discrimination law. The EEOC has identified forwarding offensive emails and sharing derogatory content, including AI-generated deepfakes, as conduct that can violate federal equal employment opportunity laws.13U.S. Equal Employment Opportunity Commission. Small Business Fact Sheet – Harassment in the Workplace Employers can be liable even when the harassment happens off-duty and off company devices; knowing about harassing social media posts directed at an employee and failing to act can support a hostile work environment claim.14U.S. Equal Employment Opportunity Commission. Social Media Is Part of Today’s Workplace but Its Use May Raise Employment Discrimination Concerns
Preserve Evidence Immediately
Whatever path a victim ultimately takes, the first step is the same: save proof before it disappears. Harassers delete posts, deactivate accounts, and scrub comment histories as soon as they sense consequences, and without that record cases become much harder to prove.
- Screenshots of every message, post, and comment, including visible timestamps, the harasser’s username, and the URL in the address bar when possible.
- Direct URLs for each piece of content. On mobile apps, use the share function to copy the link.
- A written log noting the date, time, platform, and a brief description of each incident as it happens.
- Reports through the platform’s built-in tools, which create a record that the platform was put on notice.
One hard rule: never save intimate images of anyone under 18, even for evidence. Possessing that material is illegal regardless of intent. If the harassment involves images of a minor, report to law enforcement and let investigators collect the content. In any case where legal action is likely, bringing in an attorney early helps ensure the evidence will hold up in court.