If someone is harassing you online, you have more options than it probably feels like right now. Within the next hour you can lock down your accounts, block and report the person, and start saving evidence. Depending on what the harasser is doing, you may also have grounds for a police report, a protective order, a civil lawsuit for damages, or a federal criminal case that carries up to five years in prison. The right combination depends on how severe the behavior is and whether you know who’s behind it.
Lock Down Your Accounts First
Before you block anyone or call anyone, spend ten minutes securing your own digital life. A harasser with any foothold in your accounts can escalate quickly: impersonating you, reading your messages, or tracking your location through your devices.
Change the passwords on your email, social media, and financial accounts, using a unique password for each. Then turn on multi-factor authentication wherever it’s offered. That means the account requires a second step beyond your password, like a code texted to your phone or generated by an app. The Cybersecurity and Infrastructure Security Agency recommends enabling it on every account holding sensitive information, noting that usernames and passwords alone no longer protect those accounts.1CISA. A How-To Guide for Multi-Factor Authentication
Check your email settings for forwarding rules you didn’t create, since harassers sometimes set up silent forwarding to keep reading your mail after you change the password. If you share any cloud storage, streaming, or phone plans with the person, disconnect those links.
Block and Report on the Platform
Blocking stops the harasser from seeing your profile or messaging you. Muting silences them without a notification, which can be the better choice when you worry a block will provoke retaliation. Use whichever fits your situation.
Report the behavior to the platform too. Every major service has an anti-harassment policy and a confidential reporting process, and this is usually the fastest way to get content removed or accounts suspended. Tighten your settings on who can comment, message, or tag you while things are active.
One limit worth knowing: platforms are generally not legally required to remove harassing content. A federal law called Section 230 provides that no internet service can be treated as the publisher of what its users post.2Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material Platforms remove content because their own rules say they will, not because the law forces them to. The notable exception is nonconsensual intimate images, which platforms must take down under the TAKE IT DOWN Act, a federal law passed in 2025.
Save Evidence Before You Do Anything Else
Documentation decides whether any later legal step actually goes anywhere. Online content disappears the moment a harasser realizes they’re in trouble, so capture it now.
Screenshot everything: posts, comments, direct messages, the harasser’s profile, and any new accounts they create to evade a block. Make sure the date, time, and URL are visible in the image. Browser extensions that capture a full webpage preserve the URL and metadata better than phone screenshots do. Save the URLs in a separate list as well.
Keep a running incident log with the date, time, and a short description of each event. The log is what turns a pile of screenshots into evidence of a pattern. Store the whole set in two places, like a cloud drive plus an external drive, so one lost device doesn’t erase your case.
When to Call the Police
Not every rude message is a crime, but targeted, repeated, or threatening behavior often is. Contact police when the harassment involves credible threats of violence, extortion, stalking behavior, or the sharing of intimate images without your consent.
Go to your local department in person with your evidence: printed screenshots, your incident log, and URLs. Walk through the timeline, explain how the conduct made you fear for your safety, and give a formal written statement. The resulting report creates an official record that strengthens every later legal step.
Most online harassment also crosses state lines, which brings in federal jurisdiction. The FBI’s Internet Crime Complaint Center takes reports online and describes itself as the central hub for reporting cyber-enabled crime.3Internet Crime Complaint Center (IC3). Home Page An IC3 filing doesn’t replace the local report, but it puts the behavior into a federal database and can trigger an FBI investigation in serious cases. The Bureau recommends filing with IC3 as soon as possible after an internet-enabled crime.4Federal Bureau of Investigation. On the Internet: Be Cautious When Connected
Federal Crimes That Cover Online Harassment
State laws vary, but three federal statutes apply nationwide and carry real penalties.
Interstate Threats
Sending a threat to kidnap or injure someone through any electronic communication that crosses state lines is a federal crime under 18 U.S.C. § 875, punishable by up to five years in prison and a fine.5Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications Because essentially all internet traffic crosses state lines, this statute reaches most online threats. A separate subsection covers threats to damage property or reputation made with intent to extort money.
Federal Cyberstalking
The federal stalking statute, 18 U.S.C. § 2261A, makes it a crime to use any interactive computer service or electronic communication system to engage in a course of conduct that places someone in reasonable fear of serious bodily injury or causes substantial emotional distress.6Office of the Law Revision Counsel. 18 USC 2261A – Stalking “Course of conduct” is the key phrase: prosecutors need a pattern, not a single message. A baseline offense carries up to five years, with higher ceilings when the victim is injured, and a one-year mandatory minimum when the stalking violates an existing protective order.7Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
Nonconsensual Intimate Images
Sharing someone’s intimate images without consent is now a federal crime. Congress passed the TAKE IT DOWN Act in April 2025, criminalizing the nonconsensual publication of intimate images, including AI-generated deepfakes.8Congress.gov. The TAKE IT DOWN Act: A Federal Law Prohibiting Nonconsensual Intimate Images Most states have their own laws on this conduct too, so both state and federal charges may be available.
Getting a Protective Order
A protective order, sometimes called a restraining order, is a court order barring the harasser from contacting you. It covers online and offline contact: messaging, posting about you, approaching your home or workplace, and reaching you through third parties. Violating one is itself a crime that can lead to arrest.
To get one, you file paperwork at your local courthouse describing the harassment in detail, identifying the person, and explaining why you fear for your safety. You generally need to show a pattern of behavior causing substantial emotional distress or reasonable fear of physical harm. Requirements and order types vary by state.
Many courts issue a temporary emergency order the same day you file, sometimes without the harasser present. Temporary orders typically last around two weeks, giving the court time to schedule a full hearing where both sides appear. A judge then decides whether to issue a longer-term order. Filing fees vary, and many states waive them entirely for stalking or domestic violence cases. Ask the clerk about waivers.
A protective order only works against someone whose identity you know. If your harasser is anonymous, that comes first.
Identifying an Anonymous Harasser
Anonymity online is not impenetrable, but unmasking someone takes time and money. The established route is a “John Doe” lawsuit: you file a civil complaint naming the unknown person as John Doe, then ask the court to issue a subpoena ordering the platform or internet service provider to produce the account holder’s identifying information.
Courts don’t grant these subpoenas automatically. Most apply a balancing test that weighs your need to identify the person against their right to speak anonymously. The dominant standard asks you to identify the specific harmful statements, show your claim has enough merit to survive initial scrutiny, and demonstrate that the identity is essential to your case.
If police are involved, they can request subscriber information from platforms through warrants and other legal process, which often moves faster than a civil subpoena. That’s one more reason to file a report early.
Suing for Money Damages
A civil lawsuit is a separate track from criminal charges and protective orders. It seeks compensation for what the harassment cost you: therapy, lost wages, emotional suffering.
Two claims come up most often. Defamation requires a false statement of fact about you, published to others, that damaged your reputation. Truth is an absolute defense, so a statement that was embarrassing but accurate won’t support the claim. Intentional infliction of emotional distress requires conduct so extreme and outrageous that it goes beyond all bounds of decency. Courts set that bar high on purpose, and ordinary insults don’t clear it. Some states also have specific cyberharassment or cyberbullying statutes with their own standards; a lawyer in your state can tell you if any fit.
Every state sets a deadline for filing, called a statute of limitations. Defamation deadlines typically run one to three years from publication; emotional distress claims often get around two years, though this varies. Miss the deadline and the right to sue is gone no matter how strong the case was.
One path is almost always a dead end: suing the platform. Section 230 shields services from liability for what users post.2Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material Your lawsuit runs against the person who posted, not the service that hosted it.
If the Harasser Is a Coworker
Online harassment from a coworker or supervisor can trigger your employer’s legal obligations, even when the messages are sent outside work hours. Courts have treated online platforms as extensions of the workplace when the content ties back to the employment relationship. Under federal employment discrimination law, if the harassment targets your race, sex, religion, or another protected characteristic, your employer can be held liable for failing to stop it.
Employers are automatically liable when a supervisor’s harassment leads to a negative employment action like firing or demotion. For hostile work environment claims, the employer can avoid liability only by proving it took reasonable steps to prevent and correct the behavior and that the employee did not use the complaint procedures available.9U.S. Equal Employment Opportunity Commission. Harassment Put your complaint in writing and send it through whatever grievance channel your employer uses. That written record is what protects your ability to hold them accountable later.
Where to Get Help Right Now
If you’re dealing with nonconsensual intimate images, the Cyber Civil Rights Initiative runs a free 24/7 helpline at 844-878-2274 that can walk you through removal and legal options. For harassment tied to sexual assault or abuse, RAINN’s National Sexual Assault Hotline is available at 800-656-4673, or by texting HOPE to 64673. If you are in immediate physical danger, call 911.