Doxxing is illegal when the person publishing someone’s private information does so to harass, threaten, intimidate, or incite harm. No single federal statute bans the practice by name, but federal stalking and threat laws reach the most serious cases, at least fourteen states have passed laws aimed specifically at this conduct, and victims can also sue in civil court for damages. The dividing line is intent and consequence: sharing information that is already public is not automatically a crime, but weaponizing personal details to put someone in fear or in danger is.
When Doxxing Crosses Into Criminal Conduct
Intent is what turns a privacy violation into a prosecutable offense. Posting a coworker’s home address on a forum is qualitatively different from posting it alongside a message urging strangers to show up and intimidate them. The second scenario triggers stalking, harassment, and threat statutes because the information is being used as a tool.
Prosecutors and courts look at the full picture: what was posted, what was said around it, who the audience was, and what happened next. If the release of private details leads directly to stalking, threats, or real-world violence, the person who posted the information can be charged for setting those events in motion.
Federal Laws That Apply to Doxxing
No federal law uses the word “doxxing,” but several statutes reach the behavior because it travels over the internet, which qualifies as interstate commerce.
The Federal Stalking Statute
The most commonly applied law is 18 USC 2261A. It makes it a crime to use a computer or other electronic communication tool, with the intent to harass, intimidate, or injure, to engage in a course of conduct that places someone in reasonable fear of death or serious bodily injury or that causes or would reasonably be expected to cause substantial emotional distress.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Penalties start at up to five years in prison. If the victim suffers serious bodily injury, the ceiling rises to ten years. Permanent disfigurement can bring up to twenty years, and if the victim dies, the sentence can be life. When the victim is under eighteen, the maximum goes up by another five years.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Interstate Threats and Extortion
When doxxing is paired with explicit threats or extortion, 18 USC 875 applies. A threat to injure someone, transmitted online or by other electronic means, carries up to five years. The same threat made with the intent to extort money or something of value carries up to twenty years. Threatening to harm someone’s property or reputation to extort carries up to two years.2Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications
Protection for Officials, Jurors, and Witnesses
A narrower federal statute, 18 USC 119, specifically criminalizes publishing certain personal information about people performing official duties. It covers federal employees, grand and petit jurors, witnesses in federal proceedings, and state or local officers assisting in federal criminal investigations. Protected details include Social Security numbers, home addresses, phone numbers, and personal email addresses. Posting that information with intent to threaten, intimidate, or incite violence is punishable by up to five years in prison and a fine.3Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties It is the closest thing federal law has to a dedicated anti-doxxing statute, but it only covers that specific class of people.
State Doxxing and Harassment Laws
Every state and the District of Columbia has stalking and harassment laws that can reach online conduct, and prosecutors regularly apply them to doxxing when the behavior meets the threshold of repeated, intentional harassment. Many of these statutes have been amended to cover electronic communications explicitly.
At least fourteen states have gone further and passed laws aimed specifically at the unauthorized disclosure of personal identifying information online. Some use the word “doxxing” directly; others describe the same conduct under a different name. States in this group include Alabama, Arkansas, California, Illinois, Kentucky, Missouri, Nevada, Oregon, Texas, Utah, Virginia, Washington, and West Virginia, with additional states considering similar legislation. These laws typically focus on whether the person posting the information intended to cause fear, harassment, or physical harm to the victim or their family.
Penalties vary. Many states treat a first offense as a misdemeanor carrying up to a year in jail and fines ranging from a few hundred to several thousand dollars. When doxxing leads to bodily injury or involves repeated violations, states may enhance the charge or increase the penalty.
Civil Lawsuits for Doxxing
Criminal prosecution is not the only route. A victim can sue the person who posted their information for money damages, whether or not any criminal charges are filed. One practical limit worth knowing: Section 230 of the Communications Decency Act generally bars suing the platform that hosted the post, so civil claims run against the individual poster.4Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material
Traditional Tort Claims
Two theories come up most often. Intentional infliction of emotional distress requires showing that the doxxer’s conduct was extreme and outrageous and that it directly caused severe emotional harm. Courts set a high bar; routine unpleasantness does not qualify.
Invasion of privacy through public disclosure of private facts applies when someone publicizes genuinely private information that is not a matter of legitimate public concern and that a reasonable person would find highly offensive to see exposed. The word “private” is doing real work here. If the information was already publicly available and easy to find, this claim weakens considerably. Either theory can support compensatory damages for emotional harm, reputational damage, and financial losses, plus punitive damages in egregious cases.
State Statutory Claims
A growing number of states have created dedicated civil causes of action for doxxing. These statutes define the prohibited conduct specifically and often build in damage awards, which makes recovery more direct than traditional torts. Statutory damages range from $1,500 to $30,000 per violation depending on the state. Several states also let prevailing plaintiffs recover attorney’s fees and costs, removing a major barrier that keeps many victims from suing. Courts can also issue injunctions ordering the content taken down.
First Amendment Limits
The First Amendment complicates doxxing cases because it protects speech on matters of public concern, even when the speech is harsh. Courts have been reluctant to punish speech tied to public figures or public issues. In at least one early case applying a state anti-doxxing law, a court dismissed claims brought by elected officials whose personal information was shared on social media after they supported a controversial policy, finding the speech was connected to a matter of public interest.
Political context does not grant blanket permission to expose private details with the goal of frightening or endangering someone. Courts can distinguish vigorous public debate from a targeted campaign designed to put a specific person at risk. When a post amounts to a serious expression of intent to commit violence, what courts call a “true threat,” the First Amendment offers no protection.
What To Do If You’ve Been Doxxed
Acting quickly limits the damage and preserves your options. The steps below are roughly in order of urgency.
- Document everything before anything is deleted. Screenshot every post, comment, and message, and capture URLs, usernames, and timestamps. This evidence is essential for both law enforcement reports and civil suits.
- Lock down your accounts. Change passwords, turn on two-factor authentication (preferably through an authenticator app), and ask your cell carrier to add a PIN to your account to prevent SIM-swapping.
- Report the content to the platform. Most major sites have policies against sharing private information without consent and will remove posts that violate them.
- Request removal from search results. Google’s “Results about you” tool lets you find matching results and request removal, and a separate detailed removal form handles content that includes personal information alongside threats.5Google. Find and Remove Personal Info in Google Search Results
- File a police report, especially if the doxxing includes threats or has led to real-world contact. For cybercrimes involving interstate communication, you can also file through the FBI’s Internet Crime Complaint Center.6Federal Bureau of Investigation. Cyber
- Consider a restraining order if the harassment is ongoing. Courts can issue a temporary order quickly, and some jurisdictions allow filing against a “John Doe” and then using subpoenas to identify the person behind the posts.
- Submit opt-out requests to data broker sites that aggregate public records. Some states now offer centralized tools that send a single deletion request to many brokers at once.
If the doxxing is severe or ongoing, an attorney who handles internet harassment or privacy law can evaluate your civil claims, help you obtain a court order for content removal, and guide the criminal reporting process in a way that preserves your strongest evidence.