Posting someone’s name online is illegal when the name is paired with something the law separately prohibits: a false statement of fact that damages reputation, a pattern of threatening or harassing contact, private information published to cause harm, intimate images shared without consent, identity theft, or unauthorized commercial use. The name itself is almost never the problem. What travels with it is.
Which law applies depends on what accompanies the name, what the poster intended, and whether the person named is a public or private figure. Consequences range from a civil judgment for money damages to years in federal prison.
When a Post Becomes Defamation
Attaching a false statement of fact to someone’s name online can be libel. To win a defamation claim, the person suing generally has to show four things: the statement was presented as fact rather than opinion, it was false, it reached at least one other person, and it caused real harm to reputation.
“John Doe embezzled from his employer” is a factual assertion that can be tested for truth. “I think John Doe is a lousy manager” is opinion, and opinions receive far stronger protection. Harsh online reviews rarely succeed as defamation claims unless they contain provably false factual assertions. Truth is an absolute defense; an accurate statement is not defamatory no matter how damaging.
The bar shifts depending on who was named. A private individual only has to show the poster was careless about whether the statement was true. Public figures must prove “actual malice,” meaning the poster either knew the statement was false or acted with reckless disregard for the truth. The Supreme Court set that standard in New York Times Co. v. Sullivan, and it still governs claims brought by politicians, celebrities, and other public figures.
Deadlines are tight. Most states give between one and three years from the date the post first appeared to file suit. Miss that window and the claim is dead no matter how damaging the post was.
When It Becomes Harassment or Cyberstalking
A single post naming someone is almost never criminal harassment. Harassment statutes look for a pattern: repeated, targeted contact designed to cause serious emotional distress or fear, with no legitimate purpose. Courts want to see a course of conduct, not a one-off comment.
Federal law draws a hard line at cyberstalking. Under 18 U.S.C. § 2261A, it is a federal crime to use the internet or electronic communications in a course of conduct that places someone in reasonable fear of death or serious injury, or that causes substantial emotional distress. Penalties reach up to five years in prison for the base offense, up to ten years if serious bodily injury results, up to twenty years for life-threatening injury, and life imprisonment if the victim dies.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking Stalking in violation of a restraining order carries a mandatory one-year minimum.
The Supreme Court narrowed what prosecutors must prove in Counterman v. Colorado (2023). The First Amendment now requires the government to show the defendant was at least reckless about the threatening nature of their communications. An objective “reasonable person” test is no longer enough on its own; the prosecution has to show the poster was aware others could view the messages as threatening violence and sent them anyway.2Supreme Court of the United States. Counterman v. Colorado, 600 U.S. 66 (2023) That matters for borderline posts where the sender denies any intent to threaten.
States have their own cyberstalking and electronic harassment statutes. First offenses are typically misdemeanors; repeat offenses or those involving credible threats are often felonies.
When It Becomes Doxxing or an Invasion of Privacy
Doxxing means publishing someone’s private identifying details online without consent, typically a home address, phone number, workplace, or family members’ information, with the goal of encouraging others to harass or threaten them. No single federal statute criminalizes doxxing the general public, but roughly 19 states have enacted specific anti-doxxing laws, many aimed at protecting judges, law enforcement officers, and other public officials.
Even without a doxxing-specific statute, the conduct can trigger civil liability under the tort of “public disclosure of private facts.” The claim applies when someone broadcasts private details that are not a matter of public concern and would strike a reasonable person as deeply offensive. Truth is not a defense here. Accurate information can still be illegal to publish if it is genuinely private and the disclosure serves no public interest.
Two limits matter. The facts have to be actually private, so republishing a name and address pulled from a public court filing will not qualify. And the disclosure has to reach a broad audience; a message in a five-person group chat probably does not meet the publicity threshold, while a public social media post does.
Swatting and Physical Harm
The most dangerous use of doxxed information is “swatting,” where someone uses a published address to file a false emergency report and trigger an armed police response at the victim’s home. Federal prosecutors can charge swatters under 18 U.S.C. § 2292 for knowingly conveying false emergency information, carrying up to five years in prison. If someone is killed or seriously injured during the incident, far steeper penalties follow. The person who originally posted the address can face liability as well if the doxxing was designed to invite that kind of retaliation.
When It Involves Intimate Images
Posting someone’s name alongside intimate images they did not consent to share is now a federal crime. The TAKE IT DOWN Act, passed by Congress in 2025, criminalizes the non-consensual publication of intimate visual depictions, covering both authentic images and computer-generated deepfakes.3Congress.gov. S.146 – TAKE IT DOWN Act, 119th Congress (2025-2026) The law also requires platforms to establish a removal process for victims who report this content.
Before the federal statute, victims relied on a patchwork of state “revenge porn” laws with widely varying scope and penalties. Most states already had those laws on the books. The federal statute now sets a baseline regardless of where the victim or poster is located, so both federal and state enforcement avenues are available.
When It Becomes Impersonation or Identity Theft
Using someone’s name to pretend to be them online is illegal when done with intent to harm, defraud, or deceive. A clearly labeled parody or satire account mocking a public figure is protected speech. A fake profile that convincingly imitates a real person to scam their contacts, damage their reputation, or solicit money is not.
The Identity Theft and Assumption Deterrence Act makes it a federal crime to use another person’s identifying information with intent to commit any unlawful activity.4Federal Trade Commission. Identity Theft and Assumption Deterrence Act “Unlawful activity” reaches well beyond financial fraud. Using a stolen identity to harass someone, file false reports, or commit any federal or state felony qualifies. Penalties under 18 U.S.C. § 1028 scale with severity: up to five years for basic identity fraud, up to fifteen years when government-issued documents are involved or the scheme yields more than $1,000 in a year, and up to twenty years when it is connected to violent crime or drug trafficking.5Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Intent decides these cases. Accidentally logging into the wrong account is a world apart from deliberately building a fake profile to post under someone else’s name. Most major platforms also have internal policies against impersonation and will remove reported fake profiles, which is often a faster practical remedy than a lawsuit.
When It Becomes Commercial Exploitation
Posting someone’s name to sell a product, endorse a service, or promote a business without their permission can violate their “right of publicity.” That principle gives every person the exclusive right to control the commercial use of their own name and likeness. It exists primarily under state law, and most states recognize it either by statute or through court decisions.
The right of publicity is about money, not hurt feelings. If you use a local doctor’s name in an ad implying they endorse your supplement, or create merchandise featuring a celebrity’s name without a license, the person can sue for the profits you made and damages to their commercial value. Newsworthy reporting, commentary, and creative works that add new meaning beyond simply trading on someone’s fame are generally protected. Courts apply a “transformative use” test: if the work adds something genuinely new rather than just exploiting the identity as its core product, it is more likely to survive a challenge.
Posting Children’s Names
Federal law provides extra protection for children’s information. The Children’s Online Privacy Protection Act treats a child’s first and last name as “personal information” and prohibits website operators from collecting, using, or publicly disclosing that information from children under 13 without verified parental consent.6eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule The rule covers websites and services directed at children, and any operator with actual knowledge it is collecting data from a child.
COPPA applies to website operators, not individual posters. A parent posting their own child’s name on social media is not violating COPPA. But a site that lets children create accounts or post content has to provide clear notice and obtain parental consent before making a child’s personal information publicly available. The FTC enforces the rule and can impose substantial civil penalties per violation. Some states have gone further, including provisions letting minors request permanent removal of content they personally posted.
What You Can Do If Someone Posts Your Name Illegally
Your legal options against the website or platform hosting the content are extremely limited. Section 230 of the Communications Decency Act says no provider of an interactive computer service can be treated as the publisher of information posted by someone else.7Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material If another user defames you on a social platform, you can sue the person who wrote the post, but you generally cannot sue the platform for hosting it.
Section 230 has exceptions. It does not block federal criminal law, intellectual property claims, or laws targeting sex trafficking.7Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material The TAKE IT DOWN Act also creates platform obligations for removing non-consensual intimate images. For ordinary defamation, harassment, or privacy violations, though, your claim runs against the individual poster. Documenting who posted the content and preserving evidence of their identity matters because once a post is reported and removed, the platform has no obligation to help you find the poster absent a court order.
For ongoing harassment, a civil restraining order or protective order is often the fastest tool. Document every instance of the behavior to establish a pattern, then file a police report to create an official record. Courts can issue temporary protection quickly, sometimes the same day, and then schedule a full hearing where both sides present evidence. A long-term order legally prohibits further contact, and violating it is a separate criminal offense. Filing fees range from nothing to a few hundred dollars, and many states waive fees entirely for harassment and stalking victims.