Cyberbullying laws reach online harassment through a mix of state statutes, federal stalking and threat laws, school discipline rules, and civil lawsuits, with consequences that range from a misdemeanor fine to life in federal prison when the worst outcomes occur. There is no single statute labeled “cyberbullying.” Instead, the behavior gets prosecuted under whichever harassment, stalking, or threat law fits the facts, and the reach of each depends on where the people involved live, how severe the conduct is, and whether it crossed state lines.
What Conduct the Law Actually Reaches
A rude comment online is almost never a crime. What turns online cruelty into a legal matter is some combination of intent, repetition, and the severity of harm caused or threatened. Statutes typically require a pattern of conduct aimed at a specific person, not a single outburst, and prosecutors have to show the sender acted with some awareness that the conduct was harmful.
The Supreme Court set the current floor for threat prosecutions in 2023. In Counterman v. Colorado, the Court held that charging someone with making a criminal threat requires at least recklessness, meaning the person consciously disregarded a substantial risk that the messages would be understood as threatening violence.1Supreme Court of the United States. Counterman v. Colorado Prosecutors don’t have to prove the sender specifically wanted to terrify the recipient, but they need more than proof that the messages looked frightening on their face.
Courts also weigh whether the conduct serves any purpose beyond causing harm. A harsh opinion about a public figure is treated differently than nightly threats sent to a classmate’s inbox for weeks. The legal line sits at the intersection of intent, pattern, and impact.
State Cyberbullying Laws
Every state and the District of Columbia has laws addressing bullying, and the vast majority include language covering electronic forms of harassment.2StopBullying.gov. Laws, Policies and Regulations Roughly 48 states specifically reference cyberbullying or electronic harassment in their statutes, and about 45 attach criminal penalties to the behavior. The details vary enormously. Conduct that triggers a misdemeanor in one state may be a felony next door.
Many states classify a first offense as a misdemeanor, particularly when the parties are minors or the conduct is on the lower end of severity. Penalties escalate when the behavior involves direct threats of violence, targets a vulnerable person, or results in physical harm. Some states focus the inquiry on impact, asking whether the conduct interfered with the victim’s ability to attend school, hold a job, or function in daily life.
The legislative approach differs too. Some states fold cyberbullying into existing stalking or harassment codes by expanding the definitions to cover electronic communication. Others create standalone cyberbullying offenses. A few address the behavior only through school-discipline frameworks rather than criminal law. Misdemeanor convictions commonly carry up to a year in jail; felony convictions can reach five to ten years depending on the jurisdiction, plus fines, mandatory counseling, community service, or probation.
Federal Laws That Cover Online Harassment
Federal law applies when cyberbullying crosses state lines or uses interstate communication systems, which in practice includes most internet activity. Three statutes carry most cyberbullying prosecutions.
Federal Stalking (18 U.S.C. § 2261A)
The federal stalking statute makes it a crime to use the internet, email, or any electronic communication service to engage in a pattern of conduct that places someone in reasonable fear of death or serious injury, or that causes or would reasonably be expected to cause substantial emotional distress.3Office of the Law Revision Counsel. 18 U.S. Code 2261A – Stalking It also covers threats aimed at the target’s family, intimate partners, pets, or service animals.
Penalties are tiered. A baseline conviction carries up to five years in federal prison. Serious bodily injury raises the maximum to 10 years. Permanent disfigurement or life-threatening injury pushes it to 20 years. If the victim dies as a result of the stalking conduct, the sentence can be life imprisonment.4Office of the Law Revision Counsel. 18 U.S. Code 2261 – Interstate Domestic Violence Stalking in violation of an existing restraining order carries a mandatory minimum of one year.
Harassing Telecommunications (47 U.S.C. § 223)
This statute targets the use of telecommunications devices to threaten, abuse, or harass. Originally written for telephone harassment, it reaches any communication initiated through a telecommunications device, which now includes internet-connected devices. Violations carry up to two years in prison.5Office of the Law Revision Counsel. 47 U.S. Code 223 – Obscene or Harassing Telephone Calls in the District of Columbia or in Interstate or Foreign Communications
False Emergency Reports (18 U.S.C. § 1038)
This law criminalizes conveying false information about emergencies or threats under circumstances where the information would reasonably be believed. Baseline penalties start at five years, climb to 20 if someone is seriously injured during the response, and reach life imprisonment if someone dies.6Office of the Law Revision Counsel. 18 U.S. Code 1038 – False Information and Hoaxes
Doxing, Swatting, and Cyberstalking
Three specific categories of online abuse have their own legal profile.
Doxing is the collection and publication of someone’s personal information to expose them to harassment, stalking, or identity theft, often including home addresses, workplace details, financial records, or Social Security numbers.7Department of Homeland Security. Resources for Individuals on the Threat of Doxing Most states don’t use the word “doxing,” but a growing number have statutes targeting the nonconsensual disclosure of personal identifying information when done with intent to harass or endanger.8The Council of State Governments. Doxing: State Protections Against Digital Threats
Swatting is a hoax emergency call, usually to 911, intended to trigger an armed law enforcement response at someone’s home or workplace.9Federal Bureau of Investigation. The Crime of Swatting: Fake 9-1-1 Calls Have Real Consequences Beyond state criminal charges, it can draw federal prosecution under 18 U.S.C. § 1038, with the tiered penalties described above.
Cyberstalking is the use of digital tools to repeatedly monitor, contact, or threaten someone in ways that cause fear for their safety. It involves sustained conduct: surveillance, location tracking through apps or social media, or coordinating others into a harassment campaign. Both state stalking statutes and the federal stalking law in § 2261A apply.
Why You Usually Can’t Sue the Platform
One of the most misunderstood pieces of this area is whether social media companies can be sued when their platforms are used to harass someone. The short answer is almost never. Section 230 of the Communications Act states that no provider of an interactive computer service can be treated as the publisher or speaker of information posted by someone else.10Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material You generally cannot sue a platform for hosting harassing posts even if it ignored your complaints. The same statute shields platforms that moderate content in good faith, so removing some harassing posts doesn’t make the company liable for the ones it misses.
Section 230 does not protect the person who posted the content, and it doesn’t block federal criminal prosecution of the platform. Most cyberbullying cases end up focused on the individual bully, not the service that hosted the messages.
What Schools Can and Can’t Do
Schools have to protect students from bullying, but the Constitution limits how far they reach into off-campus digital life. Two Supreme Court decisions set the current boundaries.
Under Tinker v. Des Moines, schools can restrict student speech when it materially and substantially interferes with school discipline or the rights of other students.11Justia. Tinker v. Des Moines Independent Community School District If a student’s posts cause real disruption inside the building, including fights, absenteeism, or widespread fear, the school can discipline the student even when the posts were created off campus.
Mahanoy Area School District v. B.L., decided in 2021, narrowed that authority. The Court held that schools have a diminished interest in regulating off-campus speech and recognized a short list of situations where they can still act: severe bullying or harassment targeting particular students, threats aimed at teachers or students, and failures to follow rules for online school activities.12Justia. Mahanoy Area School District v. B. L. Outside those categories, school authority over what students post on their own time with their own devices is significantly weaker.
Schools are required to maintain anti-bullying policies and most have acceptable use policies that cover school networks, school-issued devices, and personal devices used on campus. Administrators must investigate reports of electronic harassment, keep incident records, and provide procedures for victims to come forward. A school that ignores credible reports of cyberbullying risks administrative review, loss of funding, and civil liability.
Civil Lawsuits and Restraining Orders
Victims can sue their harassers directly, whether or not criminal charges get filed. The most common claim is intentional infliction of emotional distress, which requires proving the harasser acted intentionally or with reckless disregard, that the conduct was extreme and outrageous, and that it caused severe distress. The “extreme and outrageous” bar is deliberately high. Sustained harassment campaigns, coordinated attacks by multiple people, or nonconsensual distribution of intimate images tend to clear it.
Defamation is another route when the harassment involves spreading false statements that damage the victim’s reputation. Courts can award compensatory damages for actual losses and punitive damages for particularly egregious behavior. Civil judgments in serious cases can reach six figures.
Victims can also seek protective orders. Most jurisdictions allow these orders to issue based on digital conduct alone, without in-person threats, and many courts waive filing fees for harassment protective orders. Once an order is in place, any violation is a separate criminal offense, and under federal law stalking in violation of a protective order carries a mandatory minimum of one year.4Office of the Law Revision Counsel. 18 U.S. Code 2261 – Interstate Domestic Violence
Preserving Evidence Before It Disappears
This is where many cyberbullying cases quietly fall apart. The harassment happened, but by the time an attorney or law enforcement gets involved, the posts have been deleted and the accounts deactivated. Save everything early: messages, comments, profile pages, and friend lists that show connections between coordinated accounts.
Screenshots are the minimum, not the gold standard. A screenshot captures what appeared on screen but doesn’t prove who sent the message, when it was actually posted, or whether the image was altered. Capture visible sender names, timestamps, platform identifiers, and the URL of the post where possible. For serious cases heading toward litigation, forensic preservation captures underlying metadata (creation time, device, sometimes location) along with cryptographic hash values and chain-of-custody documentation that make the evidence much harder to challenge. If a platform might remove content you’ve reported, capture it first; if an account could be deleted, ask your attorney about sending a preservation letter to the platform.
Where to Report
Local police handle most cyberbullying cases. Harassment, threats, and stalking are crimes in every state, and your local department can take a report and investigate. Bring your preserved evidence, including timestamped screenshots and saved messages, when you file.
When the conduct originates from another state or runs through interstate services, federal jurisdiction may apply. The FBI’s Internet Crime Complaint Center accepts reports of online harassment and can coordinate with local law enforcement when federal statutes are implicated.13Internet Crime Complaint Center. Threat Actors Use Swatting to Target Victims Nationwide An IC3 report doesn’t guarantee a federal investigation, but it creates a record if the behavior escalates or if a pattern emerges involving multiple victims.
Students experiencing cyberbullying should use school reporting channels even if they also report to police. Schools are obligated to investigate, and a documented school complaint strengthens any later legal action. Platforms also accept user reports, but platform enforcement is inconsistent and shouldn’t substitute for involving law enforcement when the conduct is serious enough to be criminal.