Doxxing is a federal crime when publishing someone’s private information online is paired with intent to harass, threaten, or incite violence against them. No single federal statute uses the word “doxxing,” but at least four federal laws reach the conduct: the cyberstalking statute, a targeted law protecting federal officials and court participants, the interstate threats statute, and the Computer Fraud and Abuse Act. Which one applies depends on who was targeted, how the information was obtained, and what the person who posted it intended to happen next.
The Federal Laws That Reach Doxxing
Cyberstalking Under 18 U.S.C. § 2261A
This is the statute prosecutors reach for most often. It covers anyone who uses the internet, email, or another electronic communication tool with intent to harass or intimidate another person, when the conduct either puts the victim in reasonable fear of death or serious bodily injury, or causes (or would reasonably be expected to cause) substantial emotional distress.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking It also protects immediate family members, spouses, and intimate partners of the person being targeted.
The statute does not require that the defendant personally threaten the victim. Posting someone’s home address on a hostile forum, knowing that others will use it to intimidate, can qualify. The key phrase is “course of conduct,” which usually means the government has to show a pattern of behavior rather than a single isolated post. A single act of publishing highly sensitive information in a context practically guaranteed to provoke violence could still satisfy the statute, but prosecutors generally build these cases on repeated conduct.
Publishing Personal Information of Federal Officials Under 18 U.S.C. § 119
This statute comes closer to directly criminalizing doxxing than any other federal law. It is a crime to knowingly publish the restricted personal information of a “covered person” with intent to threaten, intimidate, or incite violence against them or their immediate family. A second prong covers anyone who publishes such information knowing it will be used to threaten or facilitate violence.2Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
“Restricted personal information” means a Social Security number, home address, home or mobile phone number, personal email, or home fax number identifiable to the individual. Covered people include:
- Federal officers and employees designated in 18 U.S.C. § 1114
- Grand and petit jurors, witnesses, and other officers of any federal court
- Informants and witnesses cooperating with a federal criminal investigation or prosecution
- State and local officers whose information is published because of their participation in a federal investigation
A conviction carries up to five years in prison and a fine. Unlike the cyberstalking statute, § 119 does not require proof of stalking-level conduct or an explicit threat. Publishing the information itself is the crime, as long as the intent behind it is to threaten or incite violence. Congress built on this framework in late 2022 with the Daniel Anderl Judicial Security and Privacy Act, named after the son of a federal judge who was murdered at his family’s home by a litigant who had found their address online. The Act gives federal judges additional tools to force data brokers and websites to remove their personal information.3United States Courts. Congress Passes the Daniel Anderl Judicial Security and Privacy Act
Interstate Threats Under 18 U.S.C. § 875(c)
When doxxing is accompanied by an explicit or implied threat of physical harm, this statute comes into play. Anyone who transmits a communication containing a threat to injure another person across state lines faces up to five years in prison.4Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications If the threat is tied to an extortion attempt, the penalty jumps to twenty years under subsection (b). Posting “here’s where she lives” alongside violent rhetoric, for example, can convert what looks like information-sharing into a federal threat charge.
Hacking Under the Computer Fraud and Abuse Act
When a doxxer breaks into an account or system to steal the information they later publish, 18 U.S.C. § 1030 adds another layer of exposure. The CFAA prohibits accessing a protected computer without authorization to obtain information, and a “protected computer” includes any computer connected to the internet.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
A first-time offense with no aggravating factors carries up to one year in prison. The maximum rises to five years if the offense was committed for financial gain, if the value of the stolen information exceeds $5,000, or if the hacking was done to further another crime. A repeat offender faces up to ten years. The CFAA only applies when information was illegally obtained. Compiling data from publicly available sources does not trigger it.
Federal Penalties for Doxxing
Punishments vary dramatically depending on which statute applies and what happened to the victim. Cyberstalking carries the broadest range because its penalties are tied to outcome under 18 U.S.C. § 2261(b):6Office of the Law Revision Counsel. 18 US Code 2261 – Interstate Domestic Violence
- No physical injury: up to five years in prison
- Serious bodily injury or use of a dangerous weapon: up to ten years
- Permanent disfigurement or life-threatening injury: up to twenty years
- Death of the victim: life imprisonment
- Violation of a restraining or no-contact order: a mandatory minimum of one year
When the victim is under 18, 18 U.S.C. § 2261B adds five years to whatever the otherwise applicable maximum would be.7Office of the Law Revision Counsel. 18 US Code 2261B – Enhanced Penalty for Stalkers of Children For the official-protection statute under § 119, the maximum is five years regardless of outcome. For interstate threats under § 875(c), the ceiling is also five years. Fines for federal felonies can reach $250,000 under the general federal fine statute.
What Prosecutors Have to Prove
Intent is where most doxxing cases are won or lost. Posting information alone is not a federal crime. Prosecutors must prove that the defendant acted with a specific mental state: intent to harass, intimidate, threaten, or incite violence, depending on which statute applies. Someone who inadvertently shares another person’s address in a public discussion is not committing a federal crime, even if the person whose address was shared feels endangered.
The Supreme Court’s 2023 decision in Counterman v. Colorado raised the bar for threat prosecutions. The Court held that for a communication to qualify as a “true threat” unprotected by the First Amendment, the government must prove at least recklessness: the defendant consciously disregarded a substantial risk that the communications would be viewed as threatening violence.8Supreme Court of the United States. Counterman v. Colorado, No. 22-138 A purely objective standard, where only a reasonable observer’s perception matters, is not enough.
For interstate threats charges, this means prosecutors can no longer just show that a reasonable person would have found the communication threatening. They must also show the defendant was aware of the risk that the words or actions would be perceived that way. For cyberstalking, which already requires intent to harass or intimidate, the practical impact is smaller.
When Sharing Information Is Protected Speech
The First Amendment protects a significant amount of information-sharing, even when the subject finds it unwelcome. Publishing the name of a public official, sharing the address of a government building, or reporting on where a political candidate actually lives are all constitutionally protected activities. Courts have held that disclosing the names or workplaces of government agents in the context of political criticism is protected speech.
Context draws the line. Information relevant to a matter of public concern gets strong First Amendment protection. A journalist investigating whether a mayoral candidate actually lives in the city he wants to govern can publish the candidate’s address without criminal liability. Posting that same address on a forum alongside a call for violence strips the constitutional shield away. The First Amendment does not protect true threats, incitement to imminent lawless action, or harassment that rises to the level covered by federal stalking law.
Why Internet Use Makes Doxxing Federal
Federal jurisdiction over doxxing runs through the Commerce Clause, which gives Congress authority over activities that cross state lines. Courts have long recognized that internet communications inherently involve interstate transmission, even when sender and recipient are in the same state, because data passes through servers and infrastructure spanning multiple states. The cyberstalking statute specifically covers anyone who “uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce” to engage in prohibited conduct.
If the internet was used to post the information, federal jurisdiction exists. It does not matter whether the parties live in the same city or on opposite coasts. Social media posts, emails, forum uploads, and direct messages through any online platform all qualify as using a facility of interstate commerce. This jurisdictional hook is what allows the FBI and federal prosecutors to pursue doxxing cases that might otherwise look like local matters.
How to Report Doxxing to Federal Authorities
Victims of doxxing involving threats, harassment, or stalking can file a complaint with the FBI’s Internet Crime Complaint Center (IC3), the federal government’s central clearinghouse for internet-related criminal complaints. When filing, you will need to provide your name and contact information, the subject’s identifying details (name, email, IP address, or website if known), and a specific description of what happened.9Internet Crime Complaint Center. Frequently Asked Questions
Preserve everything. Take screenshots of the doxxing posts with timestamps and URLs visible, keep copies of any threatening messages, save email headers if applicable, and document any financial losses. If the doxxing led to physical threats or in-person harassment, contact your local FBI field office directly in addition to filing with IC3. Notify local law enforcement too, since state charges can proceed alongside a federal investigation.
State Laws Also Apply
Federal statutes are not the only avenue. A growing number of states have passed laws that specifically criminalize doxxing, and others have expanded existing stalking and harassment statutes to cover electronic communications. These state laws often fill gaps federal law leaves open. Some state doxxing statutes do not require proof of a threat or intent to incite violence; publishing personal information with intent to harass may be enough.
State penalties span a wide range, from misdemeanors carrying fines and a short jail sentence to felonies with multiple years in prison. Some states have also created civil remedies that let victims sue for damages, and a handful set statutory damage floors so victims can recover a minimum amount even if actual financial losses are hard to quantify. Because the state picture is changing quickly, victims and defendants should consult an attorney familiar with the laws in their specific state.