Leaking someone’s address can be illegal, but it isn’t automatically a crime. Whether sharing a person’s home address breaks the law comes down to three things: how the address was obtained, the intent behind sharing it, and what happens afterward. Federal law already makes it a felony to publish the home addresses of certain officials with intent to threaten or incite violence, and as of mid-2025 at least 19 states have enacted laws specifically targeting doxing.1Office of the Law Revision Counsel. 18 U.S.C. 119 – Protection of Individuals Performing Certain Official Duties Even where no criminal statute fits, the person whose address was leaked can often sue for invasion of privacy or emotional distress.
When Sharing an Address Is Legal
The First Amendment generally protects publishing truthful information that was lawfully obtained, especially when it comes from public records. The Supreme Court has held across several cases that a state cannot punish a publisher for accurately reporting information pulled from records open to the public unless the restriction serves a government interest “of the highest order.” Property deeds, voter registration files, and certain business filings make addresses publicly accessible in most jurisdictions, and compiling or republishing what already sits in a public database is rarely illegal on its own.
Intent and context are what change the analysis. Taking a publicly available address and posting it with a message telling people to “pay this person a visit,” or pairing it with threats, strips away the public-records defense. The question stops being whether the information was available and starts being what the person sharing it was trying to accomplish.
When Leaking an Address Is a Federal Crime
No single federal statute makes it a crime to share any person’s address under all circumstances. Several federal laws cover the most dangerous scenarios, though, and the penalties are serious.
Publishing an Official’s or Witness’s Address
Under 18 U.S.C. § 119, knowingly publishing the home address of a federal judge, law enforcement officer, witness, or informant with intent to threaten, intimidate, or incite violence is a federal felony punishable by up to five years in prison.1Office of the Law Revision Counsel. 18 U.S.C. 119 – Protection of Individuals Performing Certain Official Duties The statute also reaches people who share the address knowing it will be used to facilitate a violent crime, even if they don’t make the threat themselves. “Restricted personal information” under this law includes home addresses, phone numbers, personal email addresses, and Social Security numbers.
Congress expanded these protections in late 2022 with the Daniel Anderl Judicial Security and Privacy Act, which requires data brokers to remove federal judges’ personal information on request and restricts government agencies from making judges’ addresses publicly available.2United States Courts. Congress Passes the Daniel Anderl Judicial Security and Privacy Act
Federal Stalking
Leaking someone’s address as part of a broader harassment pattern can trigger the federal stalking statute, 18 U.S.C. § 2261A. The law makes it a crime to use the internet or other electronic communications to engage in conduct that causes or would reasonably be expected to cause substantial emotional distress to the victim, their spouse, or their immediate family.3Office of the Law Revision Counsel. 18 U.S.C. 2261A – Stalking Posting an address on a forum known for harassment can qualify. Basic violations carry up to five years in prison, and the ceiling rises with the severity of any resulting harm, up to life if the victim dies.4Office of the Law Revision Counsel. 18 U.S. Code 2261A – Stalking
Swatting
One of the most dangerous consequences of leaking an address is swatting, where someone calls in a fake emergency to send armed police to the victim’s home. The caller faces federal charges under 18 U.S.C. § 1038 for conveying false information about violent attacks, with penalties starting at up to five years and reaching life imprisonment if someone dies.5Office of the Law Revision Counsel. 18 U.S. Code 1038 – False Information and Hoaxes The person who originally leaked the address can also face charges if prosecutors show the disclosure was meant to facilitate the swatting or that the leaker knew it would likely cause one. Conspiracy or aiding-and-abetting liability can attach even when someone else made the call.
State Doxing and Harassment Laws
State legislatures have moved aggressively on doxing. As of mid-2025, at least 19 states have enacted laws that either create a standalone doxing offense or amend existing harassment and stalking statutes to cover the publication of someone’s personal information online.6The Council of State Governments. Doxing: State Protections Against Digital Threats Alabama, California, and Illinois have defined doxing explicitly as its own crime. Another 14 states have created standalone offenses under different names, and Arizona and Connecticut expanded their stalking statutes to cover electronic disclosure of identifying information.
The common thread is intent. These laws target the publication of personal identifying information without consent, with intent to cause harm or harassment. Penalties range from misdemeanors to felonies, with fines and jail time. Even in states without a specific doxing statute, leaking an address can still fall under general criminal harassment, cyberstalking, or threatening-communications laws, many of which define harassment broadly enough to cover posting an address with intent to alarm, annoy, or threaten.
Several states also provide extra protection for public officials and first responders, making it a separate offense to publish the home address of a judge, police officer, prosecutor, or firefighter, sometimes regardless of intent.7National Conference of State Legislatures. Address Protections for Public Officials and Employees
When the Leaker Had a Duty to Keep It Private
Several federal laws restrict how specific institutions handle your address. These don’t apply to a random person on social media, but they create liability when the leak comes from an organization that held your information under a legal duty of confidentiality.
Motor Vehicle Records
The Driver’s Privacy Protection Act (DPPA) prohibits state motor vehicle departments and their employees from disclosing personal information from driving records except for a limited set of permitted purposes, such as law enforcement, court proceedings, or vehicle recalls.8Office of the Law Revision Counsel. 18 U.S. Code 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records Anyone who obtains or discloses an address from motor vehicle records for an unauthorized purpose can be sued in federal court. The DPPA guarantees a minimum of $2,500 in liquidated damages per violation even without proof of financial loss, plus punitive damages for willful violations and reasonable attorney fees.9Office of the Law Revision Counsel. 18 U.S.C. 2724 – Civil Action This is one of the few privacy statutes that doesn’t require proof of actual harm to recover.
Medical Records
Under HIPAA, your address is protected health information when held by a covered entity like a hospital, doctor’s office, or health insurer. The privacy rule treats identifiers including name, address, birth date, and Social Security number as individually identifiable health information that cannot be disclosed without authorization except in limited circumstances.10U.S. Department of Health and Human Services (HHS). Summary of the HIPAA Privacy Rule A healthcare provider who leaks an address outside the treatment, payment, or operations context faces enforcement action and civil penalties. HIPAA doesn’t reach most private individuals or businesses outside healthcare.
School Records
Schools that receive federal funding are bound by the Family Educational Rights and Privacy Act. Addresses fall into a category called “directory information” that schools can disclose, but only after notifying parents or eligible students and giving them a chance to opt out.11eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information If a student or parent has opted out and the school discloses the address anyway, that’s a FERPA violation. The opt-out continues to apply to former students unless they later rescind it.
Suing the Person Who Leaked Your Address
Even when prosecutors won’t bring charges, you may have a civil case. These claims let you seek money damages from the person who leaked your address, and the standards are generally lower than for a criminal conviction.
Invasion of Privacy
The most common claim is invasion of privacy under the theory of “public disclosure of private facts.” You generally need to show that the disclosure would be highly offensive to a reasonable person and that the information wasn’t a matter of legitimate public concern. A related theory, “intrusion upon seclusion,” applies when someone deliberately invades your private affairs in a way a reasonable person would find offensive, though courts have debated whether merely publishing information qualifies.12Legal Information Institute. Intrusion on Seclusion Damages can include compensation for emotional distress, financial losses, and harm to your sense of personal security.
Intentional Infliction of Emotional Distress
If the leak was part of especially egregious conduct, you may have a claim for intentional infliction of emotional distress. This requires outrageous conduct, intent or reckless disregard, and severe emotional harm.13Cornell Law School. Intentional Infliction of Emotional Distress It’s a high bar. Posting an address alone might not clear it, but pairing it with threats, calls for people to show up at the home, or publishing it alongside other private details to maximize fear strengthens the claim considerably.
Breach of Confidentiality or Contract
When the person who leaked your address had a legal or contractual duty to keep it private, you may have a claim for breach of contract or fiduciary duty. This covers an attorney sharing a client’s address, a healthcare provider disclosing it outside permitted HIPAA uses, or a former business partner violating a non-disclosure agreement. Damages focus on losses that flowed from the breach, including the cost of relocating, security upgrades, or lost business.
What to Do If Your Address Has Been Leaked
Speed matters. The longer your address stays visible, the greater the risk that someone acts on it.
- Preserve evidence first. Screenshot every page where your address appears, including the URL, timestamps, and the identity of whoever posted it. Save copies outside the platform in case the post is deleted.
- Report the content to the platform. Most major platforms prohibit sharing private information without consent and will remove the post through their privacy or safety tools. Be specific and attach your screenshots.
- File a police report, especially if the leak involves threats, harassment, or any sign someone might show up at your home. A report also creates an official record that supports later legal action.
- Consult an attorney. A lawyer experienced in privacy or harassment cases can evaluate whether you have grounds for a civil lawsuit, a restraining order, or both. Many offer free initial consultations and can seek emergency injunctive relief when danger is imminent.
- Opt out of data brokers. Your address likely appears on people-search sites like Whitepages, Spokeo, and BeenVerified. Submit opt-out requests to each one, and check back every few months because these sites repopulate from public records.
- Tighten your physical security. Consider a P.O. box or commercial mail-receiving service for future correspondence, cameras or a video doorbell, and changes to any predictable routine if the threat is credible.
If the person who leaked your address keeps escalating, a protective or restraining order can impose legal consequences for further contact. Courts in most jurisdictions can issue these on an emergency basis, sometimes within 24 hours.
Address Confidentiality Programs for Survivors
If you’re a survivor of domestic violence, stalking, sexual assault, or human trafficking, your state likely offers an Address Confidentiality Program designed to keep your actual address out of public records. Roughly 45 states and the District of Columbia run these programs.14Arizona Secretary of State. Address Confidentiality Programs by State When you enroll, the state assigns you a substitute address, usually a P.O. box maintained by the secretary of state’s office, that becomes the one on your driver’s license, voter registration, school records, and other government documents.
Participating agencies must accept the substitute address in place of your real one. The program forwards your first-class and certified mail and accepts legal service of process on your behalf. Applications are typically free or involve a nominal fee. Eligibility generally requires that you’ve experienced or fear domestic violence, stalking, or sexual assault, and some states extend coverage to household members and guardians acting on behalf of minor or incapacitated victims. Leaking the confidential address of an ACP participant can carry additional legal consequences depending on the state.