Doxing means publishing someone’s private information online — typically a home address, phone number, workplace, family members, or financial details — without their consent and usually to harass, intimidate, or endanger them. The word is short for “dropping documents.” No single federal statute uses the term, but doxing can still be a crime: prosecutors charge it under existing stalking, threat, and computer-fraud laws, and a growing number of states have passed statutes aimed at the practice directly. Victims can also sue in civil court.
What Information Doxers Expose
The data released in a doxing attack usually falls into a few categories. Contact details come first: residential addresses, personal phone numbers, and private email accounts. Financial records follow, including bank information, tax documents, and employment history. Doxers also target identifying numbers like Social Security numbers and login credentials, which turn a privacy violation into an identity-theft risk overnight.
Family members are frequent collateral damage. Releasing the names and locations of a target’s spouse, children, or parents raises the stakes from online embarrassment to physical danger. The goal is almost always to strip away the anonymity someone relies on for safety and invite others to pile on, whether through cyberbullying, physical stalking, or the filing of false emergency reports known as “swatting.”
Where Doxers Get the Information
Most doxing doesn’t require sophisticated hacking. A surprising amount of personal data is freely available if someone is willing to spend a few hours looking. Social media scraping is the starting point: automated tools or manual searches pull location data from photo metadata, identify family members through friend lists, and piece together a daily routine from check-ins and posts.
Government-maintained databases are another rich source. Property tax records, voter registration files, court filings, and professional license registries are public in most jurisdictions. Commercial people-search sites aggregate these records alongside address history, phone numbers, and even driving records into a single profile that anyone can access. Domain registration records (WHOIS lookups) can reveal the name and address of a website owner, and basic IP tracking narrows down a user’s general geographic area.
When public data isn’t enough, doxers turn to deception. Phishing emails trick targets into handing over passwords, which gives the attacker access to cloud storage, email accounts, and anything else protected by those credentials. That crossover from public-records research into unauthorized access is where federal computer-fraud laws start to apply.
When Doxing Is a Federal Crime
Because no federal statute specifically says “doxing,” prosecutors build cases under laws covering stalking, threats, and computer fraud. Which statute applies depends on what the doxer did and what happened to the victim afterward.
Cyberstalking
The federal cyberstalking law, 18 U.S.C. § 2261A, covers anyone who uses electronic communication to engage in conduct that causes substantial emotional distress or places someone in reasonable fear of death or serious bodily injury. Prosecutors must show the person acted with intent to harass, intimidate, or injure the target. Penalties are tiered by consequence: up to five years in prison when no serious physical harm occurs, up to ten years if serious bodily injury results, up to twenty years for permanent disfigurement or life-threatening injury, and up to life in prison if the victim dies.1Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence When the victim is under 18, a separate enhancement adds up to five additional years.2Office of the Law Revision Counsel. 18 USC 2261B – Enhanced Penalty for Stalkers of Children
Threats Against Government Officials
A separate federal law, 18 U.S.C. § 119, targets anyone who publishes restricted personal information about federal judges, law enforcement officers, jurors, witnesses, or certain state and local officials involved in federal investigations. To trigger the statute, the person must have intended to threaten or intimidate the official, or known the information would be used to facilitate a violent crime. A conviction carries up to five years in federal prison, a fine, or both.3Office of the Law Revision Counsel. 18 US Code 119 – Protection of Individuals Performing Certain Official Duties
Hacking Behind the Doxing
When doxing involves breaking into accounts or accessing systems without authorization, the Computer Fraud and Abuse Act (18 U.S.C. § 1030) applies. Intentionally accessing a computer without permission and obtaining information from it is a federal crime even if the doxer never publishes what they find. A first offense carries up to one year in prison, but the ceiling jumps to five years if the access was done to further another crime or for financial gain, and to ten years for repeat offenders.4Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers
Swatting
No federal law mentions “swatting” by name, but the practice of calling in a fake emergency to send armed police to a target’s home gets prosecuted under several overlapping statutes, including laws against interstate threats, false information about explosives, and federal hoax crimes. Each can carry five or more years in prison, with higher penalties if someone is injured or killed.5Congress.gov. School Swatting: Overview of Federal Criminal Law
What the First Amendment Protects
Publishing information about someone is not automatically illegal. The First Amendment protects truthful speech about matters of public concern, which is why journalists can report on public figures using tax filings, campaign-finance records, or court documents. The protection extends even to material originally obtained through illegal means, as long as the publisher was not involved in the illegal act itself.
That protection disappears when the speech crosses into “true threats” or incitement. A true threat exists when the speaker knowingly causes someone to fear for their safety. In 2023, the Supreme Court held in Counterman v. Colorado that the government only needs to show the speaker acted recklessly, meaning they consciously disregarded a substantial risk that the target would perceive the communication as threatening.6Library of Congress. True Threats – Constitution Annotated Speech designed to incite imminent lawless action also loses protection. In practice, publishing a political donor’s campaign contributions to inform the public is protected; publishing that same person’s home address alongside a call for harassment is not.
Courts have drawn similar lines in civil cases. Publishing private facts that are “highly offensive” and serve no legitimate public interest can support a privacy-invasion claim, especially when the target is a private individual and the disclosure does nothing to inform the public.
State Laws and Civil Lawsuits
As of mid-2025, at least 19 states had enacted some form of anti-doxing legislation. The scope varies widely: some statutes protect only public officials, while others cover any individual. Penalties range from misdemeanor charges carrying jail time and fines to felony-level offenses when the doxing leads to physical harm. Because the details differ significantly by jurisdiction, victims should check their own state’s law or consult a local attorney.
Separately from criminal charges, victims can sue in civil court. Common claims include invasion of privacy and intentional infliction of emotional distress. A successful suit can produce damages covering therapy costs, lost wages, property damage, and punitive damages for especially egregious conduct. Civil court filing fees generally run from roughly $55 to $500, and a cease-and-desist letter from a lawyer typically costs between $50 and $1,500.
One procedural wrinkle: many states have anti-SLAPP laws (strategic lawsuits against public participation) designed to quickly dismiss meritless suits targeting protected speech. If a doxer argues their publication involved a matter of public concern, they may file an anti-SLAPP motion, shifting the burden to the victim to show enough evidence to win. If the victim can’t meet that burden, the case is dismissed and the victim may owe the defendant’s attorney fees. Courts have consistently found that weaponizing private information for harassment is not protected speech, but the motion is a hurdle that can slow a case down.
What to Do If You’ve Been Doxed
Speed matters. The longer the information stays accessible, the more damage it causes.
- Screenshot every post, message, or page containing your information before it gets taken down or edited. Save URLs, timestamps, and usernames. This evidence is critical for any later legal action or law enforcement report.
- File reports with the platforms hosting the content. Most social media sites and forums have dedicated reporting tools for doxing or harassment.
- Ask Google to remove personal contact information, login credentials, and financial data from search results through its content removal form. Removal from search doesn’t delete the underlying content, but it dramatically reduces who sees it.7Google. Remove My Private Info From Google Search
- Freeze your credit at all three bureaus (Equifax, Experian, and TransUnion) if any financial data or identifying numbers were exposed. Freezes are free by federal law and prevent anyone from opening new accounts in your name. You’ll need to contact each bureau separately.8Equifax. Security Freeze
- Contact local police if you feel physically threatened. For federal crimes involving interstate electronic communication, file a complaint with the FBI’s Internet Crime Complaint Center, the central intake point for cyber-enabled crime reports.9Internet Crime Complaint Center. Internet Crime Complaint Center (IC3)
- Change passwords on any account associated with the exposed information and enable multi-factor authentication using an authenticator app or hardware security key rather than SMS codes, which are vulnerable to SIM-swapping attacks.
Once the immediate exposure is contained, audit what else is out there. Search your name, phone number, and address on Google and on major people-search sites, and use the opt-out processes those sites provide. California residents can submit a single deletion request covering all registered data brokers through the state’s Delete Request and Opt-Out Platform.