Doxing becomes a crime when someone obtains your private information through illegal means, publishes it to threaten or harass you, or releases details that enable stalking or identity theft. Posting information that’s already public and sharing it for a lawful reason usually isn’t illegal on its own. What pushes the conduct across the line is the method used to get the information, the intent behind releasing it, or the foreseeable harm that follows. A growing number of states now treat doxing as a standalone offense, and federal prosecutors have several statutes they can reach for when the conduct involves threats across state lines or hacked data.
The Line Between Legal and Criminal
Publishing someone’s information isn’t automatically a crime. Sharing a public figure’s business address that’s already listed in a directory is generally lawful. The conduct becomes criminal when the intent or likely result is harassment, threats, stalking, or fraud.
Three factors tend to push doxing into criminal territory:
- The information was obtained through hacking, phishing, or tricking a service provider into releasing it. In that case the method itself is a crime regardless of what gets done with the data.
- The information is posted alongside threats, or alongside a call for others to harm the person. That’s criminal harassment or intimidation in virtually every jurisdiction.
- Social Security numbers, bank details, or similar data are released in a way that enables fraud. Identity theft statutes then apply.
Doxing most often draws legal consequences when the published information produces real-world harm: stalking, swatting, job loss, or physical confrontation. The direct link between what was posted and what happened to the target is what prosecutors build their cases on.
Federal Laws That Apply to Doxing
No federal statute uses the word “doxing,” but prosecutors have several tools when the conduct crosses state lines or involves computer intrusion.
The Federal Stalking Statute
Federal law makes it a crime to use electronic communications with the intent to harass or intimidate someone, where the conduct places the target in reasonable fear of death or serious injury, or causes substantial emotional distress to the target or their immediate family.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking Posting someone’s home address next to threats, or releasing personal details that foreseeably trigger a harassment campaign, can fall within this statute when the communication crosses state lines or uses the internet.
Penalties scale with the harm. A baseline violation carries up to five years in federal prison. If the victim suffers serious bodily injury, the maximum rises to ten years. If the victim dies, the sentence can reach life imprisonment. Violating a protective order while stalking carries a mandatory minimum of one year.2Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
The Computer Fraud and Abuse Act
When a doxer breaks into a computer system to get the information, a different federal law applies. It’s a crime to access a protected computer without authorization to obtain information. A first offense carries up to one year in prison. The maximum rises to five years if the intrusion was committed to further another crime or the stolen data exceeds $5,000 in value. Repeat offenders face up to ten years.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Federal investigators typically get involved when the doxing includes threats transmitted across state lines or evidence of unauthorized computer access. The FBI doesn’t take over from local police in these cases. State and local agencies remain independent and usually work alongside federal investigators through task forces.
State Laws Targeting Doxing Directly
State legislatures have moved faster than Congress on this. As of mid-2025, at least 19 states had enacted some form of legislation targeting doxing. A handful define the term in their statutes and treat it as a standalone offense. A larger group has created doxing-related crimes without using the word, usually by adding provisions to existing harassment or intimidation laws. A couple of states have amended their stalking and harassment statutes to cover the publication of personal information with intent to harm.
Coverage varies. Some states impose only criminal penalties. Others create a private right of action, letting victims sue the person who exposed their information and recover compensation for emotional distress, security costs, and legal fees even when prosecutors decline charges. Significant gaps remain, and the specifics differ enough that you should check your state legislature’s website or consult a local attorney to know what applies where you live.
When Doxing Enables Something Worse
The clearest cases of criminal doxing involve a second crime made possible by the first. Two patterns show up repeatedly.
Swatting is one. A fake emergency report, often describing an active shooter or hostage situation, sends armed police to the target’s home. Swatting depends on knowing where the target lives, which is why doxing and swatting travel together. The consequences can be fatal. In one widely reported case, a man was sentenced to 20 years in federal prison after a swatting call led police to shoot and kill an uninvolved person at the address he supplied. In 2025, another defendant received a four-year sentence for orchestrating over 375 swatting calls across the country. If your information has been posted in a threatening context, calling your local police department’s non-emergency line to alert them you’ve been doxed can help prevent a violent response to a false report.
Identity theft is the other. When Social Security numbers, account numbers, or similar data are exposed, federal and state identity theft statutes apply to anyone who uses that data to open accounts, file fraudulent tax returns, or impersonate the victim. The exposure itself may violate separate privacy laws depending on how the data was obtained.
What to Do If You’ve Been Doxed
Speed matters. The first few hours after discovering your information online determine how much harm you can prevent.
- Screenshot every page where your information appears, including timestamps, usernames, and URLs. This evidence matters for police reports and any later legal action.
- Report the content to the platform. Every major social media service prohibits sharing another person’s private information without consent and will remove it on request.
- File a police report, even if local officers can’t act immediately. The record matters if harassment escalates or federal investigators get involved later.
- Freeze your credit with Equifax, Experian, and TransUnion. Freezes are free, and the agencies must process online or phone requests within one business day.4USAGov. How to Place or Lift a Security Freeze on Your Credit Report
- Change passwords on email, banking, and social media, and switch two-factor authentication from SMS to an authenticator app if your phone number was exposed. Text codes can be intercepted through SIM-swapping.
- Request removal from Google search results. Google will take down links to pages containing your address, phone number, or email, particularly when the content sits alongside threats. You’ll need the specific URLs and screenshots. Google can only remove links from its own results; the underlying page may stay up.5Google Help. Remove My Private Info From Google Search
- Get an IRS Identity Protection PIN if your Social Security number was exposed. An IP PIN blocks anyone from filing a fraudulent tax return in your name. Enrollment is free through the IRS Online Account portal, by mail using Form 15227, or in person at a Taxpayer Assistance Center.6Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Whether you have grounds for criminal charges or a civil suit depends on how the information was obtained, what was posted, what was said alongside it, and what state you’re in. A local attorney who handles cyberharassment or privacy cases can tell you which laws apply to your specific facts.