Yes, you can sue someone for doxxing, and in the right circumstances those lawsuits win real money. The claim usually rests on one of three legal theories: public disclosure of private facts, intentional infliction of emotional distress, or defamation. Which one fits depends on what the doxxer published, how private that information was, and what harm followed. There is no single federal anti-doxxing law that covers every case, so your path forward is built from older privacy and tort doctrines, sometimes reinforced by a state statute written specifically for this conduct.
The Three Civil Claims That Fit Doxxing
A doxxing lawsuit is not its own category in most states. You bring one of the established privacy or personal-injury claims and shape it around what happened to you.
Public Disclosure of Private Facts
This is the most natural fit. It is a privacy tort aimed at people who broadcast someone else’s private information to the public. To win, you generally need to show three things: the information was genuinely private, the disclosure would be highly offensive to a reasonable person, and the information was not a matter of legitimate public concern. Publishing a home address, phone number, Social Security number, or medical records to an internet audience will usually satisfy all three.
The “highly offensive” element does real work. Courts are not interested in mild annoyance that your workplace got mentioned online. The disclosure has to be the kind of thing that would upset a reasonable person: medical conditions, sexual orientation, financial records, or a home address handed to strangers who may intend harm.
Intentional Infliction of Emotional Distress
If the conduct was extreme, you can add a claim for intentional infliction of emotional distress. Four elements: the person acted intentionally or recklessly, the conduct was outrageous, it caused you emotional distress, and the distress was severe enough that it could be expected to harm your mental health. The bar is high by design. Courts want behavior that goes well past rudeness or insensitivity. Doxxing meant to trigger a harassment campaign, a swatting attempt, or threats of violence is the kind of conduct that clears it.
Proving the severity of the distress is the hardest part. Your own testimony that you felt anxious is rarely enough. Medical records showing treatment for anxiety, depression, or PTSD carry much more weight, as do documented life changes: relocating, missing work, pulling children from school.
Defamation
When the doxxer publishes false claims alongside your personal information, defamation comes into play. You have to prove a false statement presented as fact, publication to at least one other person, fault on the publisher’s part, and actual harm to your reputation. Public figures face a higher standard and must show the person knew the statement was false or acted with reckless disregard for the truth. Private individuals in most states need only show negligence.
Defamation fits when a doxxer adds false context: calling you a sex offender, alleging criminal conduct, or fabricating details designed to provoke outrage. Publishing true personal information, no matter how damaging, does not support a defamation claim. That situation belongs to the privacy tort instead.
What Courts Treat as Private
Not everything that feels private qualifies legally, and this is where many potential lawsuits collapse. Courts look at whether the information was already available to the general public and whether you took steps to keep it private.
Information sitting in public records, such as court filings, property deeds, voter registrations, and business licenses, is generally not considered private, even if most people would not know where to find it. The U.S. Supreme Court has indicated the First Amendment protects the right to publish truthful information lawfully obtained from public records, even when that information is sensitive. Events that happened in public places lose their private character the same way.
Courts have consistently treated the following as private facts whose disclosure can be highly offensive:
- Medical and financial records, including health conditions, treatment history, and bank account details
- Sexual information, including orientation, sexual activity, or a history of sexual assault
- Home addresses and phone numbers, especially when shared with an audience likely to harass
- Deep personal beliefs, including religious convictions or personal struggles not shared publicly
If the information was already widely known before the doxxing, a court is unlikely to treat it as private. The practical takeaway: your claim is strongest when the doxxer surfaced information you actively kept out of view and pushed it to a hostile audience.
Defenses That Sink Doxxing Lawsuits
Before you file, understand the defenses waiting for you. First Amendment arguments are where many otherwise strong claims fall apart.
Newsworthiness
If the information relates to a matter of legitimate public concern, the person who published it has a powerful defense. Courts weigh the public interest in the information against the intrusiveness of the disclosure. Information is considered newsworthy when the public has a legitimate interest in it, but liability can still attach when the publication crosses into what courts have called “morbid and sensational prying into private lives for its own sake.” Publishing a corrupt politician’s business address is far more defensible than publishing an anonymous commenter’s home address.
Public Records
Information drawn entirely from public records is very difficult to sue over. Courts have repeatedly held that the First Amendment protects the right to publish truthful information lawfully obtained from government records, even sensitive information. If your address sits in a searchable property database and someone posts it, your options are narrower than they would be if the doxxer hacked your email to find it.
Anti-SLAPP Motions
More than three dozen states and the District of Columbia have anti-SLAPP laws that let defendants push for quick dismissal of lawsuits targeting speech on matters of public concern. If a defendant files an anti-SLAPP motion, you will have to show early in the case that you have enough evidence to win. If you cannot meet that burden, the case is dismissed, and in many states you will be ordered to pay the other side’s attorney’s fees. Anti-SLAPP does not mean you cannot sue. It means you need solid evidence before you file. A doxxing case built on thin documentation, or one involving arguably public information, is vulnerable to this kind of early exit.
Suing the Platform Rarely Works
A common first instinct after being doxxed is to go after the website or social media platform. Federal law makes this extremely difficult. Section 230 of the Communications Decency Act provides that no provider of an interactive computer service can be treated as the publisher of content posted by someone else.1Office of the Law Revision Counsel. 47 USC 230 – Protection for Private Blocking and Screening of Offensive Material
In practice, social media sites, forums, and messaging services are generally immune from civil liability for doxxing posted by their users. The law also protects platforms that voluntarily moderate content, so removing some doxxing posts does not obligate a platform to catch every one, and it does not create liability for what slips through. Your target in a civil case is almost always the person who posted the information, not the site that hosted it.
Suing an Anonymous Doxxer
Often you do not know who did it. Throwaway accounts, disposable emails, and VPNs make identification hard. The legal tool for this is a “John Doe” lawsuit. You file against an unknown defendant and then use the court’s subpoena power to compel platforms and internet service providers to hand over identifying information tied to the account.
Courts do not issue those subpoenas automatically. Because anonymous speech has First Amendment protection, most courts require you to give the anonymous person notice of the lawsuit, often by posting in the same forum where the doxxing occurred, and an opportunity to fight the subpoena. You will also have to show that your underlying claim is viable, meaning enough evidence to survive a motion to dismiss. Courts balance your right to pursue a legitimate claim against the anonymous person’s right to speak without being unmasked. Weak cases get denied.
The process takes time and money, but it is often the only way to put a name on the complaint. If a criminal investigation is running in parallel, law enforcement may identify the person through their own channels, which can simplify the civil case.
What You Can Recover
If you win, what you can collect depends on the theory you pursued and the harm you suffered. The main categories:
- Compensatory damages for actual financial losses, including relocation costs, lost wages, added security expenses, and therapy bills
- Emotional distress damages for psychological harm, anxiety, fear, and disruption to daily life, even when those harms are harder to quantify
- Punitive damages, available in many jurisdictions when the doxxer acted with malice or reckless disregard for your safety
- Injunctive relief, meaning a court order requiring the doxxer to remove the information and prohibiting future disclosures
- Attorney’s fees, which some state anti-doxxing statutes allow the winner to recover
States with dedicated anti-doxxing statutes sometimes offer enhanced remedies. Some allow treble damages when the doxxing was motivated by the victim’s race, religion, gender, sexual orientation, or disability. Injunctive relief is often the most immediately valuable outcome. A takedown order can stop ongoing harm faster than any damage award.
How Long You Have to File
Civil claims for invasion of privacy and related torts run against a statute of limitations that varies by state. Most states give you between one and four years from the date of the doxxing, with two to three years being the most common window. Miss the deadline and the claim is dead regardless of how strong the evidence is. The clock starts when the information is first published, not when you discover it and not when the harassment peaks. Talk to an attorney sooner rather than later.
What to Do Now to Protect the Case
What you do in the first hours and days shapes the strength of any lawsuit. Evidence disappears online. Posts get deleted, accounts get deactivated, and screenshots you did not take become screenshots nobody has.
Preserve everything. Take screenshots of every post, comment, message, and profile page tied to the doxxing. Capture the full URL, timestamps, and usernames. Save emails, voicemails, and text messages. If the volume is overwhelming or the content is distressing, ask someone you trust to help. Store copies in multiple places.
Report the content to every platform where your information appeared. Most major platforms prohibit doxxing in their terms of service and will remove content that violates those policies. Platform removal will not scrub the information from the internet entirely, but it shrinks the audience and creates a record that you objected.
File a police report, especially if the doxxing involves threats, you feel physically unsafe, or you believe criminal harassment or stalking laws have been violated. A police report creates an official record and may trigger a criminal investigation that runs alongside your civil case. If the conduct crossed state lines or involved threats, you can also file a complaint with the FBI’s Internet Crime Complaint Center. You will not receive a personal follow-up, but complaints are analyzed and may be referred to law enforcement for investigation.2Internet Crime Complaint Center (IC3). IC3 Complaint Form
Secure your accounts and, if needed, your location. Change passwords, turn on two-factor authentication, and review privacy settings. If your home address was published and threats followed, think about whether temporary relocation is warranted. These steps also help establish the seriousness of the situation if you later need to show harm in court.