Stalkerware laws make it a federal crime, and in most states a separate state crime, to install hidden monitoring software on another adult’s phone, tablet, or computer. A first offense can bring up to five years in federal prison, and the person being watched can sue for statutory damages that start at $10,000 plus attorney’s fees. Both the people who install these programs and the companies that sell them are exposed.
The Federal Laws That Apply
Four federal statutes do most of the work.
The Wiretap Act is the broadest. It makes it a crime to intentionally intercept any electronic communication, which covers text messages, emails, and app-based conversations captured on a monitored device. Federal law uses a one-party consent rule, meaning at least one participant in the conversation must agree to the recording. Stalkerware fails that test by design: the person running the software is not a party to the conversations being captured, and no participant has consented. A first violation carries up to five years in prison.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
A companion statute targets the supply side. It is separately illegal to manufacture, sell, or advertise any device or software whose primary purpose is the secret interception of communications. Companies marketing stalkerware as a way to “catch a cheating spouse” or “monitor your partner” face federal liability just for selling the product, regardless of whether a particular buyer installs it.2Office of the Law Revision Counsel. 18 USC 2512 – Manufacture, Distribution, Possession, and Advertising of Wire, Oral, or Electronic Communication Intercepting Devices Prohibited The ceiling is again five years.
The Computer Fraud and Abuse Act covers another angle by criminalizing access to a “protected computer” without authorization. Any internet-connected device qualifies, so smartphones and laptops are fully covered.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers Installing stalkerware on someone’s phone without permission is textbook unauthorized access. A first offense draws one to five years depending on the purpose behind the intrusion and the value of the information taken. Repeat offenders can face up to ten.
The Stored Communications Act fills a gap the Wiretap Act leaves. While the Wiretap Act addresses communications in transit, the Stored Communications Act makes it illegal to access stored messages, emails, and files sitting on a server or cloud account without authorization. Many stalkerware programs harvest data already stored on the device rather than intercepting it live, which puts this statute squarely in play. A first offense committed for commercial gain or to further another crime carries up to five years, with subsequent offenses up to ten.4Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
Federal Cyberstalking Charges
Beyond the surveillance-specific statutes, federal law directly criminalizes stalking carried out by electronic means. The federal cyberstalking statute makes it a crime to use any interactive computer service or electronic communication system to engage in conduct that places another person in reasonable fear of serious bodily injury or causes substantial emotional distress. It specifically covers placing someone “under surveillance” with intent to harass or intimidate, which describes exactly how stalkerware tends to be used.5Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Penalties escalate with the harm. The baseline is up to five years. Serious bodily injury raises the ceiling to ten years. Permanent disfigurement or life-threatening injury pushes it to twenty, and if the victim dies, the offender faces life imprisonment. There is also a mandatory minimum of one year when the stalking violates an existing protective order.6Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence That last point matters because stalkerware and domestic violence overlap heavily, and many perpetrators are already under a restraining order when they install the software.
How State Laws Add to the Picture
States layer on their own criminal liability, and the stack typically runs deeper than people expect.
Most states have anti-stalking statutes defining stalking as a course of conduct toward a specific person that would make a reasonable person fear for their safety or suffer significant emotional distress. Software that tracks location or reads messages fits that definition, and prosecutors in states without dedicated digital privacy statutes routinely use these frameworks against stalkerware users. A growing number of states have also enacted laws aimed specifically at tracking software and GPS monitoring, some targeting vehicle trackers, others banning any electronic tracking of a person’s movements or communications without consent.
Consent law matters here too. Federal law requires only one party to consent to recording a conversation, but roughly a dozen states require every participant to agree. In those states, stalkerware that captures phone calls or picks up in-person conversations through the microphone violates state wiretapping law on top of federal law. Even in a one-party state, the person running the software is almost never a party to the conversations being recorded, so the exception rarely helps them.
State computer trespass laws add another path. These statutes prohibit accessing someone else’s computer or phone with intent to view, copy, or alter private data. Software that harvests information or changes how the device functions without the owner’s knowledge qualifies. Courts often look at how the software got onto the device: using a shared password for a purpose the owner never agreed to, for instance, can turn apparent access into unauthorized access.
Criminal Penalties for Installing Stalkerware
The federal sentencing picture is consistent. A first-time Wiretap Act or surveillance-device violation carries up to five years and a fine.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Computer fraud charges add one to five years for a first offense, depending on whether the intrusion was for financial gain or to further another crime.7Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers Repeat offenders face up to ten years under either the CFAA or the Stored Communications Act.4Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications Federal cyberstalking starts at five years and can reach life if the victim dies.6Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
State penalties vary. Initial or less invasive offenses are often charged as misdemeanors carrying up to a year in local jail, fines, probation, and sometimes mandatory counseling. Felony charges become likely when the surveillance involves distributing private images, a history of repeated violations, or using the information gathered to commit further crimes like identity theft or physical assault. Courts may also order forfeiture of the computers, phones, and storage devices used to run the surveillance.
Aggravating factors push sentences higher in both systems. Violating a protective order while using stalkerware triggers the one-year federal mandatory minimum. Judges frequently order restitution covering the victim’s cost of securing devices, replacing compromised technology, and paying for forensic audits to confirm the surveillance has been fully removed. Every conviction stays on a permanent criminal record and reaches into future employment, housing, and professional licensing.
What Victims Can Recover in a Civil Lawsuit
Victims don’t have to wait for prosecutors. Federal law creates a private right of action for anyone whose communications were illegally intercepted. A court can award the greater of actual damages plus any profits the violator earned, or statutory damages of $100 per day of surveillance or $10,000, whichever is larger. If stalkerware ran for six months, the statutory floor alone works out to roughly $18,000. The same statute allows punitive damages in appropriate cases and requires courts to award reasonable attorney’s fees to a successful plaintiff.8Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized Fee-shifting matters because it keeps victims from being priced out of court.
The Computer Fraud and Abuse Act carries a separate civil action for anyone who suffers damage or loss from unauthorized computer access. It allows compensatory damages and injunctive relief, though damages are limited to economic losses when the only qualifying factor is financial harm above $5,000 in a one-year period. The suit must be brought within two years of the violation or two years from when the victim discovered the damage.9Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Common-law tort claims add another layer. Invasion of privacy through intrusion upon seclusion is the most common theory, requiring proof that the perpetrator intentionally intruded on private affairs in a way a reasonable person would find highly offensive. Successful plaintiffs can recover compensatory damages for mental health treatment, lost wages, and the cost of replacing compromised devices. Where the surveillance was especially malicious, intentional infliction of emotional distress is also available, though it carries a higher bar: the conduct must be extreme and the psychological harm verifiable, usually through medical records or therapist testimony. Punitive damages are available in many of these actions. The civil case runs independently of any criminal prosecution, so a victim can sue whether or not the government files charges.
Regulatory Action Against the Companies That Sell It
The FTC has started going after stalkerware vendors directly. In 2021, the agency moved against Support King, the company behind the SpyFone app, banning both the company and its CEO from the surveillance business entirely and ordering it to delete the data it had secretly collected from monitored devices.10Federal Trade Commission. Support King, LLC (SpyFone.com), In the Matter of In December 2025, the FTC denied the CEO’s petition to vacate or modify that ban, making clear the agency treats these orders as permanent.11Federal Trade Commission. FTC Denies Petition From SpyFone App CEO to Vacate 2021 Order The signal to other vendors is that the FTC is willing to shut their businesses down rather than fine them and move on.
When Monitoring Is Legal
Not all monitoring software is illegal, and the line matters. The difference between lawful monitoring and stalkerware is consent, disclosure, and context.
Employers can monitor electronic communications on company-owned devices and networks under a business-use exception to the federal wiretap laws, but within limits. The monitoring must serve a legitimate business purpose, and courts have consistently held that employers need to tell employees their communications may be monitored. An employer who secretly installs monitoring software on an employee’s personal phone crosses the same lines as any other stalkerware user.
Parental monitoring of minor children leans toward permissible but still has edges. Parents generally have authority to monitor their children’s devices and online activity, and many legitimate parental control apps operate openly with the child’s knowledge. The legal problem starts when one parent secretly installs monitoring software on the other parent’s phone during a custody dispute. That is spousal surveillance, not parental monitoring, and it violates the same federal statutes described above. Courts take the distinction seriously in divorce proceedings, where illegally obtained evidence can be excluded and the offending parent’s credibility destroyed.
What To Do if You Think Stalkerware Is on Your Device
If you suspect monitoring software on your phone or computer, the most important thing to know is that removing it immediately can be dangerous. In domestic violence situations, an abuser who realizes their surveillance has been cut off may escalate to physical violence. The FTC specifically warns that investigating or removing stalkerware on the monitored phone can tip off the person watching you.12Federal Trade Commission. Stalkerware – What To Know
Before doing anything with the suspected device, reach out from a different one. Use a friend’s phone, a family member’s computer, or a library terminal. The National Domestic Violence Hotline (1-800-799-7233) can help you develop a safety plan and recognize signs of technology-facilitated abuse. An advocate can also walk you through preserving evidence of the surveillance before you change anything on the device, which is critical if you plan to pursue criminal charges or a civil suit.12Federal Trade Commission. Stalkerware – What To Know
Evidence matters because courts require electronic evidence to be authenticated. Screenshots of suspicious apps or notifications may not be enough on their own; they lack the metadata courts use to verify authenticity. What holds up is a forensic image of the device, a bit-for-bit copy that preserves deleted files, installation records, and system logs showing when the stalkerware was active. Chain of custody is central to this. If the evidence passes through hands without documentation, a defense attorney will argue it could have been altered. The practical takeaway: do not factory-reset your phone or delete the software before talking to a digital forensic professional or law enforcement. The instinct to scrub your device clean destroys the evidence you need.
Document what you can before any reset. Note unfamiliar apps, unusual battery drain, and unexpected data usage, all common signs of stalkerware. If law enforcement is involved, they may want to perform a forensic examination before any data is lost. Both criminal and civil paths remain open to hold the person responsible accountable, and your safety comes first.