Cyber harassment is a pattern of online conduct aimed at a specific person that is meant to intimidate, threaten, or cause serious emotional distress, and yes, it can be a crime. Federal law treats the worst cases as felonies carrying up to five years in prison, states have their own stalking and harassment statutes that reach online conduct, and victims can separately sue for money damages or ask a court for a restraining order. Whether a particular situation crosses the legal line depends on what was said, how often, to whom, and with what intent.
What Pushes Online Behavior Into Harassment
A single rude comment or a heated argument usually isn’t harassment in the legal sense. The conduct that courts and statutes care about is repeated, targeted, and unwanted: messages that keep coming after the recipient has made clear they want no contact, coordinated campaigns to humiliate or threaten someone, or surveillance-style monitoring of a person’s online life.
Intent matters as much as the pattern. The question is whether the person meant to frighten, coerce, or inflict emotional harm, rather than engage in ordinary (if unpleasant) communication. That distinction is what separates a prosecutable case from protected speech, and it is where most close calls get decided.
Common Forms of Cyber Harassment
Several recognizable patterns show up in these cases, and more than one often appears in the same situation:
- Cyberstalking: repeatedly tracking someone’s online activity, sending unwanted messages, or monitoring their location through digital tools. This is the most legally serious form because it mirrors physical stalking and tends to escalate.
- Doxing: publishing someone’s private information, such as a home address, phone number, or employer, to encourage others to harass or threaten them.
- Impersonation: creating fake accounts with another person’s name or photos to post offensive content or send abusive messages in their name.
- Nonconsensual intimate images: sharing explicit photos or videos without permission, including AI-generated deepfakes.
- Online threats: messages threatening physical violence, sexual assault, or other serious harm, which can be charged on their own even without a broader stalking pattern.
- Coordinated pile-ons: encouraging others to flood a person’s accounts with abusive messages, false reviews, or mass reports designed to get them suspended.
Deliberate campaigns of false statements can also qualify as harassment, though isolated false statements usually fall under defamation law instead.
When Cyber Harassment Is a Federal Crime
Several federal statutes apply directly, and prosecutors use them regularly.
Federal Stalking Statute
The main one is 18 U.S.C. § 2261A, which criminalizes using an interactive computer service or electronic communication system to engage in a course of conduct that places someone in reasonable fear of death or serious bodily injury, or that causes (or would reasonably be expected to cause) substantial emotional distress to the target or an immediate family member.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking The government has to prove the person acted with intent to harass, intimidate, or injure. Sentences can reach five years in federal prison.2Federal Bureau of Investigation. Cyberstalking – Two Federal Cases Illustrate the Consequences of Sextortion
Interstate Threats
Under 18 U.S.C. § 875, transmitting a threat to kidnap or injure someone across state lines is punishable by up to five years. If the threat is tied to an attempt to extort money or something of value, the maximum climbs to 20 years.3Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications Because almost all internet traffic crosses state lines, this statute reaches a lot of online threats.
Telecommunications Harassment
Under 47 U.S.C. § 223, using a telecommunications device to make repeated contact with someone solely to harass them, or to transmit obscene or threatening material with intent to harass, carries up to two years in prison. The statute also covers anonymous harassment: contacting someone to abuse or threaten them while refusing to identify yourself.4Office of the Law Revision Counsel. 47 USC 223 – Obscene or Harassing Telephone Calls in the District of Columbia or in Interstate or Foreign Communications
The TAKE IT DOWN Act
Signed in May 2025, the TAKE IT DOWN Act specifically criminalizes publishing nonconsensual intimate images. For images of adults, it is illegal to knowingly share intimate visual depictions when the person had a reasonable expectation of privacy and the publisher intended to cause harm or actually caused psychological, financial, or reputational harm. The law covers AI-generated deepfakes, which it labels “digital forgeries.” Penalties reach two years in prison for offenses involving adults and three years for images of minors, with threats to publish such images punishable by up to 18 months when the subject is an adult.5Congress.gov. S.146 – TAKE IT DOWN Act The law also requires covered platforms to set up a notice-and-removal process, with a compliance deadline of May 2026.
When Speech Is Protected Instead
Not everything cruel or offensive online is illegal. The First Amendment protects harsh criticism, political hyperbole, and provocative commentary. The Supreme Court has consistently held, though, that “true threats” fall outside that protection, pointing to the need to shield people from fear of violence, from the disruption that fear causes, and from the possibility that threatened violence actually occurs.6Library of Congress. True Threats – Constitution Annotated
In 2023, the Court tightened the standard in Counterman v. Colorado. Prosecutors now have to show the speaker had some subjective awareness that their statements could be perceived as threatening and delivered them anyway. The minimum mental state is recklessness: the speaker consciously disregarded a substantial risk that their words would be seen as threats.7Supreme Court of the United States. Counterman v. Colorado, 600 U.S. 66 (2023)
Context carries a lot of weight. Repeated unwanted messages sent directly to someone’s inbox carry less First Amendment protection than a single angry public post, even when the public post uses more extreme language. A vague, arguably hyperbolic statement is harder to prosecute than a specific threat aimed at a particular person.
State Laws Add Another Layer
All 50 states and the District of Columbia have stalking laws, and many have been updated to cover electronic communications. Some states have standalone cyberstalking or cyber harassment statutes with their own penalties; others fold online conduct into general stalking or harassment laws. A growing number specifically target doxing, usually requiring disclosure of private identifying information without consent and with intent to harass or cause harm. Because the elements and penalties vary, the same conduct can be a misdemeanor in one state and a felony in another.
Suing the Harasser and Getting a Restraining Order
Criminal cases are run by government prosecutors who make their own charging decisions. Civil remedies put the controls in your hands.
Restraining Orders
Courts can issue restraining orders (sometimes called protection orders) barring the harasser from contacting you through any channel, online or otherwise. Violating one can trigger contempt charges and additional criminal penalties. The process generally involves filing a petition, presenting evidence of the harassment, and attending a hearing. In urgent situations, many courts can grant a temporary emergency order before the full hearing. Filing fees vary, and some courts waive them for victims who show financial hardship.
Civil Lawsuits
You can also sue the person directly for money damages. The usual legal theories are intentional infliction of emotional distress, defamation, and invasion of privacy. An emotional distress claim generally requires showing that the conduct was extreme and outrageous, that the person acted intentionally or recklessly, and that you suffered severe emotional distress as a result. Courts set a high bar for “extreme and outrageous” to filter out ordinary disputes, but sustained harassment campaigns, violent threats, and distribution of intimate images typically clear it. Recoverable damages can include therapy costs, lost income, and compensation for the emotional harm itself.
Can You Sue the Platform?
Usually, no. Section 230 of the Communications Decency Act says that no provider of an interactive computer service is to be treated as the publisher or speaker of content created by its users, which means social media companies generally cannot be sued for hosting someone else’s harassing posts.8Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material
Section 230 is not absolute. It does not block federal criminal enforcement, and it does not apply to intellectual property claims, sex trafficking offenses, or Electronic Communications Privacy Act violations. Courts have also found that when a platform actively develops or encourages illegal content rather than just hosting it, Section 230 may not shield it. Your realistic legal remedies for cyber harassment run against the person doing the harassing, not the platform. Platform reporting is still useful, though, because internal policies can result in content removal and account bans even when no law has been broken.
What to Do If You’re Being Harassed Online
Preserving evidence comes first, before anything gets deleted. Screenshots are the minimum. Capture the full page including the URL bar, the harasser’s username, visible timestamps, and surrounding context like replies or reaction counts. Use your browser’s “Print to PDF” function as a backup, since it preserves the page layout and date. If the platform offers a data export tool, use it to pull the relevant content with its backend metadata. Save original files without re-exporting; re-saving images or video can strip metadata that proves when and where they were created.
Build a timeline as the harassment unfolds. Record the date and time of each incident, when you first became aware of each post or message, and when you sent any responses or takedown requests. That timeline becomes the backbone of any legal action later. Once litigation is reasonably anticipated, you have a legal duty to preserve relevant digital content, so do not delete messages or posts even if the instinct is to make them disappear.
Report the behavior to the platform. Most major services have dedicated reporting flows for harassment, threats, and impersonation, and a platform report creates an official record. If the harassment involves threats of violence, cyberstalking, or nonconsensual intimate images, report it to local law enforcement. You can also file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, which handles internet-facilitated crimes including cyberstalking.9Internet Crime Complaint Center. IC3 Complaint Form The IC3 form is voluntary and does not guarantee an investigation, but it routes your complaint to the appropriate federal or state agencies.
For serious threats, sustained stalking patterns, or distribution of intimate images, talking to an attorney can help you decide whether to pursue a restraining order, a civil lawsuit, or both. Many attorneys offer initial consultations, and some victims qualify for pro bono assistance through organizations that focus on online abuse.