Yes, it is illegal to dox someone in a wide range of circumstances. No single federal statute uses the word “doxxing,” but federal stalking, threat, and harassment laws routinely reach the conduct, and at least 19 states have passed laws that address it directly. Penalties run from misdemeanor fines to life in prison when a victim dies, and victims who never see criminal charges filed can still sue the doxxer for money damages.
Whether a specific act of doxxing is criminal depends on what information was shared, how it was obtained, what the doxxer intended, and what happened as a result. Those four factors do most of the work in sorting protected speech from prosecutable conduct.
Federal Laws That Make Doxxing a Crime
The broadest federal tool is the stalking statute, 18 U.S.C. § 2261A. It makes it a crime to use the internet or any electronic communication service to engage in a course of conduct that places someone in reasonable fear of serious bodily injury or causes them substantial emotional distress. Posting a target’s home address alongside calls for others to “visit” them fits this statute cleanly.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
The penalties escalate with the harm. A baseline conviction carries up to five years. That rises to ten years if the victim suffers serious bodily injury or the offender uses a dangerous weapon, twenty years for permanent disfigurement or life-threatening injury, and life in prison if the victim dies.2Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
When the doxxing comes bundled with an explicit threat of violence, prosecutors can also charge under 18 U.S.C. § 875, which criminalizes transmitting a threat to injure someone across state lines. That charge alone carries up to five years in prison.3Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications
One narrower statute reads almost like a pure anti-doxxing law. 18 U.S.C. § 119 makes it a federal crime to publish the home address, phone number, Social Security number, or personal email of a federal employee, witness, informant, or juror with intent to threaten or intimidate them. Conviction carries up to five years.4Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties It only protects specific categories of people, but within that circle it is one of the sharpest tools federal prosecutors have.
When Doxxing Leads to Swatting
Swatting — using a leaked address to call in a fake emergency and draw an armed police response — is where doxxing cases often turn into long prison sentences. The federal hoax statute, 18 U.S.C. § 1038, punishes conveying false information about emergencies with up to five years in prison, and more if someone is injured or killed.5Congress.gov. School Swatting – Overview of Federal Criminal Law A person who publishes an address knowing it will be used for a swatting call can also be charged as an aider and abettor and faces the same penalties as the person who made the call.
State Doxxing Laws
State legislatures have moved faster than Congress on this. As of mid-2025, 19 states had enacted laws addressing doxxing in some form. Some created standalone doxxing offenses, and others amended existing stalking or harassment statutes to cover the electronic publication of private information.6The Council of State Governments. Doxing – State Protections Against Digital Threats
Penalties vary. A first-offense misdemeanor in a lower-penalty state might mean up to six months in jail and roughly a $1,000 fine. Many statutes use graduated penalties, so a misdemeanor becomes a felony if the victim is physically injured. The required mental state differs too: some states demand proof that the doxxer intended to cause fear or harassment, while others reach reckless conduct.
Nine states — California, Connecticut, Delaware, Kentucky, Minnesota, Nevada, New Jersey, Utah, and Washington — attach a civil cause of action to their doxxing laws, so a victim can sue for damages whether or not the state ever files charges.6The Council of State Governments. Doxing – State Protections Against Digital Threats
When the First Amendment Protects Doxxing, and When It Doesn’t
Free speech is the defense doxxers reach for first, and it is not frivolous. Much of what gets called doxxing involves publishing truthful information, and the Supreme Court has held in cases going back to Smith v. Daily Mail Publishing Co. (1979) that punishing the publication of truthful, lawfully obtained information rarely survives constitutional scrutiny. Sharing a name, employer, or neighborhood from public sources is generally protected.
The protection ends at several familiar lines:
- True threats. If the publication is accompanied by a genuine threat of violence, or functions as one, it loses First Amendment protection.
- Incitement to imminent lawless action. Posting an address with language designed to provoke an immediate attack is not protected.
- Harassment and stalking. When doxxing is part of a sustained course of conduct aimed at a specific person, courts have upheld harassment and stalking statutes against First Amendment challenges.
- Illegally obtained information. If the data came from hacking, fraud, or other unlawful means, the method of acquisition strips protection from the publication itself.
Context and intent carry most of the weight. A journalist publishing a public official’s business address in a news report is doing something different from an anonymous poster sharing that official’s home address with a hostile audience. The information can be identical. The legal analysis is not.
Suing a Doxxer in Civil Court
Victims don’t have to wait on prosecutors. Three civil paths carry most doxxing cases.
Public Disclosure of Private Facts
This privacy tort requires proof that the information was genuinely private, that a reasonable person would find the disclosure highly offensive, and that the information was not of legitimate public concern. Doxxers often argue the data was already public, and courts have pushed back: compiling scattered details into a single targeted package and broadcasting it to a hostile audience can turn technically available information into an actionable privacy violation.
Intentional Infliction of Emotional Distress
An IIED claim requires extreme and outrageous conduct that caused severe emotional harm. The bar is deliberately high, and ordinary insults don’t clear it. Doxxing that produces a flood of threats, forces a family to relocate, or triggers a swatting call often does. Successful claims can recover therapy costs, lost income, relocation expenses, and damages for the distress itself.
Statutory Civil Claims
In states with dedicated doxxing statutes that include a civil remedy, victims can sue directly under the law rather than squeezing the facts into a traditional tort. These statutes typically allow recovery of actual damages — including relocation and security costs and lost income — plus attorney fees. Some provide statutory damages that don’t require proof of a specific dollar harm.
Can You Sue the Platform?
Usually not. Section 230 of the Communications Decency Act says no provider of an interactive computer service may be treated as the publisher of information posted by another user.7Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material Facebook, X, Reddit, and comparable services are generally immune from suit over doxxing content their users publish.
Platforms can still remove content voluntarily, and most have policies prohibiting the posting of another person’s private information. Google Search has a dedicated removal request path for pages that pair your contact information with threats or calls to harass you. The Department of Homeland Security advises submitting takedown requests to the platform or site administrator as an early step.
Restraining Orders
A civil restraining order can require a doxxer to stop contacting you and to remove published information. You generally need to show an intentional pattern of conduct that put you in reasonable fear for your safety or caused serious emotional distress. Courts can issue a temporary order on an emergency basis, sometimes without the doxxer present, and extend it after a hearing. If the doxxer is anonymous, you can file against a “John Doe” and subpoena platforms or internet providers to identify them. Violating the order is itself a criminal offense.
What to Do If You’ve Been Doxxed
Speed matters. The first hours often determine how far the information spreads.
- Preserve evidence. Screenshot the posts, usernames, timestamps, comments, and engagement counts. Save threatening emails as PDFs with sender information intact. Doxxers frequently delete content after the damage is done.
- Report to the platform. Use the site’s harassment or privacy reporting tools to request removal, and submit a separate request through Google’s legal reporting page if the content appears in search results.
- File a police report. Even if you’re unsure a crime occurred, a formal record establishes a timeline for any later charges or lawsuit.
- Freeze your credit. Contact Equifax, Experian, and TransUnion. A freeze blocks new accounts from being opened in your name, is free, does not affect your credit score, and lasts until you lift it.8Consumer Advice (FTC). Credit Freezes and Fraud Alerts
- Secure your accounts. Change passwords, enable two-factor authentication, and review privacy settings. If your phone number was leaked, ask your carrier for a SIM lock to prevent SIM-swapping.
- Talk to a lawyer. An attorney who handles cyber-harassment can tell you whether your facts support criminal charges, a civil suit, or a restraining order, and a cease-and-desist letter sometimes resolves the situation without litigation.
Why “It Was Already Public” Doesn’t End the Analysis
The most persistent myth about doxxing is that sharing information available somewhere in public records can’t get you in trouble. Courts don’t see it that way. An address can sit in a property database, an employer can be listed on LinkedIn, and a phone number can appear in an old directory, and none of that lets someone aggregate the pieces, publish them in a hostile context, and walk away clean.
What turns the act into a crime or civil violation is the combination of context and intent. Posting an address in a forum where people have expressed a desire to harm the target is not the same as listing that address on a real estate transaction. The information did not change; the purpose and foreseeable consequences did. Prosecutors and civil courts focus on why the information was compiled and shared, what the doxxer expected to happen, and what did happen.