Cyberbullying becomes illegal when the online conduct matches something the law already criminalizes offline: harassment, stalking, threats, sharing intimate images without consent, impersonation, or defamation. There is no single federal statute labeled “cyberbullying,” but federal law reaches certain online conduct, all 50 states have anti-bullying laws, and nearly all of those state laws explicitly cover electronic behavior. Whether a specific incident crosses the line depends on what the person did, how often they did it, who the target was, and whether a reasonable person in the victim’s position would have felt threatened or seriously distressed.
Behaviors That Cross Into Criminal Territory
A single rude or cruel post almost never leads to charges. Prosecutors and courts look for a pattern, an intent to cause harm, and a victim who reasonably feared for their safety or suffered real distress. The categories that most often trigger criminal or civil liability are:
- Repeated harassing contact. A stream of unwanted messages meant to alarm, annoy, or torment someone, especially after being told to stop.
- Threats of violence. Statements or implications that you intend to physically harm someone, even dressed up as jokes.
- Stalking. A course of online conduct that would make a reasonable person fear for their safety or suffer serious emotional distress.
- Nonconsensual intimate images. Sharing or threatening to share someone’s private sexual images without permission, including AI-generated deepfakes.
- Online impersonation. Fake accounts or stolen identities used to damage someone’s reputation or relationships.
- Defamation. False statements of fact published about someone that damage their reputation.
The more persistent and targeted the behavior, the more likely it crosses into illegality. One angry comment on a stranger’s post is unlikely to be prosecuted. Fifty messages over two weeks to the same person after they blocked you is a different situation entirely.
Federal Laws That Apply
Federal law reaches cyberbullying when the conduct uses interstate electronic communication, crosses state lines, or exploits minors. The core statute is 18 U.S.C. § 2261A, the federal stalking law. It makes it a crime to use any interactive computer service or electronic communication system in interstate commerce to engage in a course of conduct that places someone in reasonable fear of serious bodily injury or death, or that causes substantial emotional distress. The protection extends to the victim, their immediate family, and their spouse or intimate partner.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
The TAKE IT DOWN Act, signed into law on May 19, 2025, created the first federal criminal prohibition on publishing nonconsensual intimate images, including AI-generated deepfakes. Publishing such images of an adult carries up to two years in prison; images involving minors carry up to three. The law also requires covered online platforms to establish a notice-and-removal process by May 2026, giving victims a direct way to force takedowns.2Congress.gov. The TAKE IT DOWN Act – A Federal Law Prohibiting Nonconsensual Intimate Images
Federal child exploitation law under 18 U.S.C. § 2251 can apply when a cyberbully coerces or induces a minor to produce sexually explicit images. The statute targets sexual exploitation rather than bullying as such, but the two overlap when pressure campaigns involve explicit content.3Office of the Law Revision Counsel. 18 US Code 2251 – Sexual Exploitation of Children
State Laws and Penalties
Most cyberbullying cases are prosecuted at the state level. All 50 states have anti-bullying laws, and all but two explicitly reference cyberbullying or electronic harassment.4StopBullying.gov. Laws, Policies and Regulations Some states have standalone cyberharassment statutes. Others fold online conduct into broader harassment, stalking, or threat laws.
Penalties vary widely. A first offense of online harassment is often a misdemeanor punishable by a few months in jail and a fine of a few thousand dollars. Repeat offenses, violations of protective orders, or conduct involving credible threats can escalate to felonies carrying prison terms of two years or more. States also apply stalking statutes to persistent online surveillance, threat and intimidation laws to explicit or implied promises of harm, impersonation laws to fake-profile attacks, and nonconsensual intimate image laws (now in nearly every state) to the sharing of private sexual content.
What the First Amendment Still Protects
The First Amendment protects a lot of speech that people find offensive, hostile, or hurtful. Courts have consistently held that government cannot criminalize speech just because it is mean. This is where most legal challenges to cyberbullying prosecutions focus.
The key doctrine is “true threats.” The Supreme Court has defined true threats as serious expressions conveying an intent to commit unlawful violence, as distinct from jokes, hyperbole, or venting that a reasonable listener would not take seriously. In its 2023 decision in Counterman v. Colorado, the Court held that prosecutors must prove the defendant had at least a reckless awareness that their statements would be perceived as threatening. Recklessness means consciously disregarding a substantial risk that the words will be viewed as threatening violence.5Supreme Court of the United States. Counterman v Colorado
For cyberbullying cases, this means a victim’s fear is not enough on its own. Prosecutors must also show the sender was at least reckless about how the messages would be received. That makes isolated angry comments harder to prosecute than sustained, targeted campaigns, which is one reason prosecutors build cases around patterns rather than single posts. Justice Sotomayor noted in her concurrence that stalking prosecutions involving repeated, unwanted contact raise fewer First Amendment concerns than prosecutions built on isolated statements.5Supreme Court of the United States. Counterman v Colorado
When Schools Can Step In
Schools have their own disciplinary tools, separate from the criminal justice system. Most states require districts to adopt anti-bullying policies and investigate complaints.4StopBullying.gov. Laws, Policies and Regulations Consequences can include suspension, expulsion, mandatory counseling, or loss of extracurricular privileges, and they apply whether or not police are involved.
The harder question is off-campus conduct. In Mahanoy Area School District v. B.L. (2021), the Supreme Court ruled that schools have diminished authority over student speech that happens off campus. The Court gave three reasons: schools rarely stand in for parents when students are at home, regulating both on- and off-campus speech could silence a student entirely, and public schools have an interest in protecting even unpopular expression.6Supreme Court of the United States. Mahanoy Area School District v BL
The Court did not shut the door completely. It specifically preserved school authority over off-campus speech involving “serious or severe bullying or harassment targeting particular individuals” and “threats aimed at teachers or other students.”6Supreme Court of the United States. Mahanoy Area School District v BL In practice, schools can usually intervene when off-campus cyberbullying substantially disrupts the school environment or targets specific students. The weaker the connection to school, the greater the First Amendment risk for the district.
Civil Lawsuits and Restraining Orders
Criminal prosecution is not the only route. Victims can sue cyberbullies for money damages. Common claims include defamation (false factual statements that damage reputation), intentional infliction of emotional distress (conduct that is extreme and outrageous, not merely offensive, and that causes severe emotional harm), and invasion of privacy (sharing private information or images, false light, or intrusion through hacking or surveillance). Civil cases do not produce jail sentences, but they can produce significant awards and give the victim control over the process rather than leaving it to a prosecutor.
Victims can also seek a civil harassment restraining order without waiting for criminal charges. The usual showing is that the conduct was deliberate, that it formed a pattern rather than a one-time incident, and that it placed a reasonable person in fear for their safety or caused serious emotional distress. Judges can issue emergency orders without notice when the risk is immediate, and when the cyberbully’s identity is unknown, some courts allow filings against an anonymous party followed by a subpoena to the platform. Violating a restraining order is itself a crime in every state, which gives the order real force: after it is in place, a single further message can lead to arrest.
When Parents Can Be Held Responsible
When a minor is the cyberbully, the victim may be able to recover from the minor’s parents. Every state has a parental liability law covering harmful acts by minor children, but the caps vary. They run from as low as $800 to as high as $25,000, with most states falling between $2,000 and $10,000. A few states impose no cap and hold parents liable for the full actual damages.
Parents also face a second, potentially larger exposure through their own negligence. If a parent knew their child was cyberbullying someone and did nothing, or gave the child unrestricted internet access despite a known history of online harassment, the parent’s own failure to supervise can support a separate claim. That negligence liability is generally uncapped. For most families, this is the scenario with real financial consequences.
How to Document and Report It
Preserving evidence is the single most important thing a victim can do, and most people do not do it thoroughly enough. Screenshots should capture the full context: username, date and time, platform, and URL where available. Screenshot the bully’s profile page too, because accounts get deleted. If the harassment spans several platforms, document all of them. Save copies in more than one place.
Reporting channels depend on severity:
- Platform tools. Every major social media service has a harassment reporting mechanism. These can get content removed and accounts suspended, but they do not create a legal record.
- School officials. When students are involved, report to a teacher, counselor, or administrator. Most schools are legally required to investigate.
- Law enforcement. When behavior involves threats, stalking, nonconsensual intimate images, or anything that makes you fear for your safety, file a police report with your documented evidence. Some departments have cybercrime units.
- The FBI’s Internet Crime Complaint Center. If the harassment crosses state lines or looks like federal cyberstalking under 18 U.S.C. § 2261A, file at ic3.gov.
Do not delete your own accounts or messages before you have preserved everything. The urge to disengage is understandable, but deleting a conversation can destroy the proof you need. Block after you have saved, not before.