Doxxing someone means publishing their private identifying information online without consent, usually to intimidate, harass, or expose them to real-world danger. The word comes from 1990s hacker slang for “dropping docs” on a rival, and the conduct it describes can be a crime: federal stalking, threat, and official-protection statutes reach many doxxing cases, and at least 17 states have passed laws that name doxxing directly.1The Council of State Governments. Doxing – State Protections Against Digital Threats
What Counts as Doxxing
The point of doxxing is to tie an anonymous online identity to a real person, or to broadcast private details about someone whose name is already known. The information shared tends to fall into a few recognizable categories.
The first is basic identifying data: full legal name, home address, personal phone number, private email. Once those details are visible on a public forum or social thread, the target is exposed to unwanted contact, stalking, and in-person confrontation.
The second is workplace information. Doxxers post an employer’s name, an office location, or the direct lines of supervisors and coworkers, hoping to trigger a wave of calls and complaints. Coordinated campaigns of this kind have cost people their jobs even when the accusations driving them were false.
The third is financial and government-issued data. Bank account numbers, credit card details, Social Security numbers, tax identification numbers, and payroll records sometimes surface alongside the rest. When they do, identity theft and fraud become immediate problems on top of the harassment itself.
Why Doxxing Is Treated So Seriously: Swatting
The clearest example of why doxxing is not treated as a harmless prank is swatting. Once a home address is public, anyone with a grudge can place a fake emergency call reporting an active shooter or hostage situation at that location. Armed law enforcement arrives expecting a violent crisis. Victims have been detained at gunpoint, injured, and in some cases killed during these responses. The FBI has warned that AI-generated voices are making the fraudulent calls harder to trace and prosecute.2National Association of Attorneys General. The Escalating Threats of Doxxing and Swatting
Is Doxxing a Crime Under Federal Law
No single federal statute uses the word “doxxing,” but several laws cover the conduct in practice. Which one applies depends on what was shared, who was targeted, and what happened next.
Federal Stalking (18 U.S.C. 2261A)
The federal stalking statute is the one that reaches the broadest range of doxxing cases. It covers anyone who uses electronic communications to engage in a course of conduct that places another person in reasonable fear of death or serious bodily injury, or that causes substantial emotional distress.3Office of the Law Revision Counsel. 18 USC 2261A – Stalking Publishing someone’s private information online with intent to harass or intimidate them can fit squarely within that language.
Penalties scale with the harm. If the victim dies, the sentence can reach life imprisonment. Permanent disfigurement or life-threatening injury carries up to 20 years. Serious bodily injury or use of a dangerous weapon brings up to 10 years. Where there is no physical injury, the maximum is five years. Each tier also carries potential fines up to $250,000.4Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence5Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
Interstate Threats (18 U.S.C. 875)
When doxxing is paired with explicit threats sent across state lines, the interstate communications statute applies. Transmitting a threat to kidnap or injure someone carries up to five years in prison. If the threat is part of an extortion scheme, the maximum rises to 20 years.6Office of the Law Revision Counsel. 18 US Code 875 – Interstate Communications Fines can reach $250,000.5Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
Doxxing Federal Officials (18 U.S.C. 119)
A separate statute targets the publication of restricted personal information about people involved in federal government operations. Protected individuals include federal judges, law enforcement officers, prosecutors, jurors, witnesses, and other government employees. Knowingly publishing their home addresses, personal phone numbers, Social Security numbers, or similar restricted data with intent to threaten or facilitate violence against them is a felony carrying up to five years in prison.7Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
The federal statutes have limits worth knowing. Stalking and interstate threats generally require conduct that crosses state lines or uses interstate communications, and the official-protection law applies only to a defined category of federal personnel. Doxxing a private person inside a single state, with no explicit threats, often falls outside these laws and has to be addressed under state statutes instead.
State Anti-Doxxing Laws
A growing number of states have passed laws that name doxxing directly, closing gaps where federal law requires interstate conduct or threats of violence. As of mid-2025, at least 17 states had enacted dedicated anti-doxxing statutes. Eight of them treat doxxing exclusively as a criminal offense. The other nine give victims both a criminal complaint path and the ability to sue the doxxer for civil damages.1The Council of State Governments. Doxing – State Protections Against Digital Threats
The specifics vary. Some statutes require proof that the doxxer intended to cause harassment or fear. Others reach conduct where the doxxer knew, or should have known, that publishing the information would lead to harm. In states that allow civil lawsuits, victims may be able to recover compensation for emotional distress, security costs, and lost income, though the available remedies depend on the statute and the facts.
What to Do if You Have Been Doxxed
Speed matters. The longer the information stays visible, the more people see it and the harder it becomes to contain the damage.
Lock down accounts first. Change the password on every account that shares the exposed email or phone number, use a unique password for each service, and turn on two-factor authentication. If financial account numbers or your Social Security number were part of the leak, freeze your credit immediately. The freeze is free at all three major bureaus (Equifax, Experian, and TransUnion) and can be requested online, by phone, or by mail.8USAGov. How to Place or Lift a Security Freeze on Your Credit Report
Document everything before it disappears. Screenshot every post, message, or page that contains your leaked information, with timestamps and URLs visible, and save the copies somewhere separate from any account that may have been compromised. That record is what a police report or civil claim will rely on later.
Report the posts to the platforms that host them. Major social sites and forums have reporting tools for shared private information and harassment; attach your screenshots and direct links.
Then report to law enforcement. File a report with your local police, especially if you feel physically threatened or if swatting is a plausible risk. For doxxing that crosses state lines or involves threats, contact the FBI’s Internet Crime Complaint Center. If your Social Security number or financial data was exposed, report the identity theft at IdentityTheft.gov, which generates a personalized recovery plan and pre-filled letters to send to creditors and agencies.9Federal Trade Commission. Report Identity Theft