Doxxing is illegal when someone publishes another person’s private information with intent to threaten, harass, intimidate, or facilitate harm. There is no single federal statute labeled “anti-doxxing,” but prosecutors use interstate threat laws, the federal stalking statute, and a specific law protecting government officials to bring charges that can carry up to five years in prison, or life if a death results. At least nineteen states have also enacted laws that directly address the practice.
When Sharing Information Crosses Into a Crime
Posting someone’s home address or phone number is not automatically illegal. Public records are public, and journalists, researchers, and ordinary citizens use them every day. What turns a disclosure into a crime is the intent behind it and the foreseeable consequences. Publishing personal details to threaten a person, to encourage others to harass them, or to put them in physical danger moves the act out of information sharing and into conduct that multiple laws prohibit.
Two First Amendment exceptions do most of the work in doxxing cases. The first is the “true threats” doctrine, covering serious expressions of intent to commit violence against a specific person. Explicit violent language is not required. Publishing a target’s home address in a context where prior violence has occurred, or alongside commentary that makes the threat clear, can be enough. The Supreme Court held in 2023 that prosecutors need only show the speaker acted with subjective recklessness about whether the statements would be perceived as threats. The second exception is incitement, which requires speech directed at producing imminent lawless action and likely to succeed. That standard is harder to meet online because of the time gap between a post and any resulting conduct, which is why most prosecutions proceed under the threat framework.
The practical line: sharing already-public information in a neutral context is protected speech. Packaging the same information with language meant to put a target in fear, or posting it to a community with a known pattern of harassment, is where criminal liability begins.
Federal Laws Used to Prosecute Doxxing
Interstate Threats
Under 18 U.S.C. § 875, transmitting a threat to injure someone across state lines is a federal crime. If a doxxing post includes or implies a threat of physical harm and the communication crosses a state boundary, which virtually all internet activity does, the penalty is up to five years in federal prison. When the threat is paired with an attempt to extort money or anything of value, the maximum rises to twenty years.1Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications
Federal Stalking
The federal stalking statute, 18 U.S.C. § 2261A, covers anyone who uses the internet or another interstate communication tool to harass or intimidate a person in a way that places them in reasonable fear of death or serious injury, or that would reasonably be expected to cause substantial emotional distress. Doxxing often sits at the center of a broader stalking campaign: the release of personal details followed by repeated contact, monitoring, or escalation.2Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Penalties under the statute scale with harm:
- No physical injury: up to 5 years in prison
- Serious bodily injury: up to 10 years
- Permanent disfigurement or life-threatening injury: up to 20 years
- Death of the victim: up to life in prison
- Violation of an existing restraining order: minimum of 1 year
Those tiers matter because doxxing cases can escalate quickly. A post that begins as online harassment can lead to physical confrontations at the target’s home, and the sentencing exposure rises with each step.
Protection for Officials, Judges, and Others
One federal law comes closer to a true anti-doxxing statute than any other. Under 18 U.S.C. § 119, it is a federal crime to knowingly publish the restricted personal information of a covered government official or their immediate family with intent to threaten, intimidate, or facilitate a violent crime. Restricted information includes a Social Security number, home address, personal phone number, personal email, or home fax number. The maximum sentence is five years.3Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
The protected group includes federal law enforcement officers, federal judges, jurors, grand jury witnesses, informants in federal criminal investigations, and state or local officers involved in federal cases. It is narrower than “all government employees,” but it covers the officials most frequently targeted after controversial decisions or high-profile cases. The Daniel Anderl Judicial Security and Privacy Act, signed into law in late 2022, extended related protections by prohibiting data brokers from selling or trading the personal identifying information of federal judges and their families, and requiring removal on written request.
Swatting
Swatting, the practice of placing a fake emergency call to send armed police to a target’s address, is one of the most dangerous outcomes of a doxxing. Federal prosecutors charge it under 18 U.S.C. § 1038, which criminalizes conveying false information about emergencies such as bombings, hijackings, or attacks. The base penalty is up to five years. If someone is seriously injured during the response, the maximum rises to twenty years. If the swatting results in a death, the caller faces up to life in prison.4Office of the Law Revision Counsel. 18 USC 1038 – False Information and Hoaxes
The person who originally doxxed the target can face charges alongside the swatter when prosecutors can show the doxxer intended or knew the information would be used to facilitate violence.
State Doxxing Laws
State legislatures have been catching up to the fact that doxxing rarely stays within one state’s borders but causes harm at the local level. As of mid-2025, three states — Alabama, California, and Illinois — have created standalone doxxing crimes with explicit statutory definitions. Fourteen additional states have enacted laws that criminalize the same conduct under other labels, such as improper disclosure of private information, dissemination of personal information on the internet, or cyberintimidation by publication. At least two more states have amended existing harassment or stalking laws to cover doxxing-style behavior.
Penalties vary. States that treat the basic offense as a misdemeanor set fines and up to a year in jail. Several elevate the charge to a felony when the doxxing causes physical harm or when the offender has a prior conviction. This is one of the fastest-moving areas of state legislation, so checking your own state’s current statute is worth the effort.
Civil Lawsuits for Doxxing
Criminal charges are not the only route. A doxxing victim can sue the person who published the information whether or not law enforcement acts. A civil case will not send anyone to jail, but it can produce money damages and deter repeat conduct.
The common legal theories are:
- Public disclosure of private facts, where the information shared is highly personal, offensive to a reasonable person, and not a matter of legitimate public concern.
- Intentional infliction of emotional distress, which requires conduct extreme and outrageous enough to cause severe emotional trauma. Courts set a high bar.
- False light invasion of privacy, which applies when the way the information is presented creates a misleading and highly offensive impression of the target.
Watch the statute of limitations. For privacy torts, most states give one to three years from the date of publication. A few states set the window as short as six months for certain defamation claims. Waiting can permanently forfeit the right to sue, so talking to an attorney early matters even before deciding whether to file.
Can You Sue the Platform?
Generally, no. Section 230 of the Communications Decency Act bars treating an online platform as the publisher of content a user posted, so legal claims run against the person who wrote the post, not the site that hosted it.5Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material Major platforms still prohibit doxxing in their terms of service and will remove reported content, often within hours, but that removal is a policy decision rather than a legal obligation.
What to Do If You’ve Been Doxxed
Speed matters in the first hours. The information spreads fast, and the response should too.
Start by documenting everything. Screenshot every post, save every URL, and record usernames and timestamps. If posts have comment threads, capture those too, because they may show coordinated harassment or threats that strengthen a case later. Keep this evidence somewhere other than your phone, such as a cloud folder or a USB drive, in case your accounts are compromised.
Report the content to the platform hosting it. Most sites have specific reporting categories for doxxing or exposure of personal information. If the doxxer posted photos you took, a copyright takedown request under the Digital Millennium Copyright Act may force removal regardless of the platform’s doxxing policy.
Contact local law enforcement and file a police report if the post contains any threat of violence, encourages others to harm you, or gives you reason to believe someone may show up at your home. The report creates an official record and may be needed later for a restraining order or criminal charges. For threats that cross state lines or travel over the internet, you can also file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.6Internet Crime Complaint Center. IC3 Home Page
While handling the immediate crisis, lock down your accounts. Change passwords, turn on two-factor authentication, and review privacy settings on every platform. Search your name on major data broker sites and submit removal requests. Some states offer centralized tools that send a single deletion request to all registered brokers; commercial privacy services offer similar options. Cutting off the supply of personal information gives any future doxxing attempt less raw material to work with.