Doxing laws in the United States come from a patchwork of federal statutes, roughly 20 state laws, and long-standing civil privacy claims rather than any single “doxing” crime. Whether a particular disclosure is illegal turns on three things: what information was published, whether the target consented, and whether the person publishing it intended to harass, threaten, or provoke violence. When those elements line up, both prosecutors and victims have real options.
When Doxing Is Actually Illegal
No federal statute uses the word “doxing” as a defined term. Courts and prosecutors instead look at three elements: someone’s personal identifying information was disclosed, the target did not consent, and the person doing the disclosing acted with intent to harass, threaten, or cause harm. When all three are present, the conduct can be reached by criminal statutes and civil claims even if the charging document never says “doxing.”
Intent is what separates doxing from ordinary information-sharing. Looking up a property record out of curiosity is not doxing. Compiling someone’s home address, employer, phone number, and children’s school into a single post directed at an angry online audience is a very different act, and courts read context to tell them apart: where the post appeared, what language accompanied it, and whether the publisher had reason to expect the material would be used to threaten or harm the target.
A common misconception is that public-record information is fair game. Some of what appears in a doxing post does come from property deeds, voter rolls, or court filings. That does not automatically make the disclosure lawful. Aggregating scattered public data points into a single dossier and pushing it to an audience primed for harassment can still satisfy the intent requirement under multiple laws. The question is not whether the data was technically accessible somewhere. It is whether the person who compiled and broadcast it did so to put someone in danger.
Federal Criminal Statutes That Reach Doxing
Three federal laws do most of the work when a doxing case is prosecuted at the federal level.
Interstate Stalking, 18 U.S.C. § 2261A
This is the statute most often used. It applies when someone uses an interactive computer service or other electronic communication system to engage in a course of conduct that places another person in reasonable fear of death or serious bodily injury, or that causes or would reasonably be expected to cause substantial emotional distress to the target or their immediate family.1Office of the Law Revision Counsel. 18 USC 2261A Stalking The perpetrator must act with intent to kill, injure, harass, or intimidate. Posting someone’s home address on a forum alongside calls for violence generally clears that threshold.
Penalties scale with harm. If the victim dies, the offender faces life in prison. Permanent disfigurement or life-threatening injury carries up to 20 years. Serious bodily injury or use of a dangerous weapon brings up to 10 years. Cases without physical injury carry a maximum of 5 years.2Office of the Law Revision Counsel. 18 USC 2261 Interstate Domestic Violence Federal fines for felony convictions can reach $250,000 per offense under the general sentencing provisions.3Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
Interstate Threats, 18 U.S.C. § 875
When doxing is paired with explicit threats, this statute adds another charge. It prohibits transmitting any communication across state lines that threatens to kidnap or injure another person. A conviction carries up to five years in prison. If the threat was made with intent to extort money or something of value, the maximum jumps to 20 years.4Office of the Law Revision Counsel. 18 US Code 875 – Interstate Communications Prosecutors sometimes pair this charge with the stalking statute when a doxing campaign includes direct threats sent to the victim.
Protection of Federal Officials, Jurors, and Witnesses, 18 U.S.C. § 119
Congress created a dedicated doxing statute for people connected to the federal government. It is a felony to knowingly publish restricted personal information about a federal employee, judge, juror, witness, informant, or a state or local officer assisting a federal investigation, when the publisher intends to threaten, intimidate, or incite a crime of violence against that person or their immediate family. Covered information includes Social Security numbers, home addresses, personal phone and fax numbers, and personal email addresses. A conviction carries up to five years in federal prison.5Office of the Law Revision Counsel. 18 USC 119 Protection of Individuals Performing Certain Official Duties This law is narrower than the stalking statute but easier to prove in the right case because the government does not need a “course of conduct,” just a single knowing disclosure with the required intent.
State Anti-Doxing Laws
Roughly 20 states have enacted statutes that specifically target doxing, either by name or by criminalizing the unconsented disclosure of personal identifying information with intent to harass or endanger. Most of these laws were passed between 2021 and 2024, and new bills continue to appear.
The details vary. Some statutes protect all residents; others cover only narrow categories such as law enforcement officers or minors. Some create criminal penalties, some establish a civil cause of action that lets victims sue directly for damages, and a few do both. What ties them together is the same three-part test seen at the federal level: personal information disclosed, without consent, with intent to cause harm or harassment.
State-level penalties run from misdemeanor charges carrying up to 90 days in jail and modest fines, up through felony convictions with multi-year prison terms when the doxing causes physical injury or death. Because these laws are changing quickly, anyone dealing with a doxing situation should check the current statute in the state where the victim lives and in the state where the perpetrator posted the information.
Civil Lawsuits a Victim Can Bring
Criminal prosecution is not the only route. Victims can sue for money damages, and the standard of proof in civil court is lower than in a criminal case. Several established tort theories apply.
Public Disclosure of Private Facts
This tort requires showing that the defendant publicized private information that would be highly offensive to a reasonable person and that the information was not a matter of legitimate public concern. Medical records or a child’s school schedule clear the “highly offensive” bar easily. The “legitimate public concern” defense protects disclosures about public figures acting in their official capacity but generally does not shield broadcasting a private person’s home address to a hostile audience.
Intentional Infliction of Emotional Distress
This claim requires proving the defendant’s conduct was extreme and outrageous, that the defendant acted purposefully or recklessly, and that the victim suffered severe emotional distress as a direct result. The bar for “extreme and outrageous” is deliberately high, but doxing campaigns that trigger sustained harassment, threats, and forced relocation tend to clear it. Courts look at the totality of the conduct, not just the initial post.
Invasion of Privacy
A broader category that includes intrusion upon seclusion, which covers unauthorized prying into someone’s private affairs. If the doxer obtained the information through hacking, social engineering, or accessing accounts without permission, this tort reaches the information-gathering stage rather than just the publication.
Damages and Practical Considerations
Successful civil claims can recover compensatory damages for therapy costs, lost wages if the victim had to leave a job, relocation expenses, and other out-of-pocket losses. Punitive damages may be available in cases involving particularly egregious conduct. One high-profile case against a video game player who harassed a developer’s community manager resulted in nearly $500,000 in combined damages and legal fees. Filing fees and attorney time can be significant, and victims should weigh the likelihood of actually collecting a judgment against an individual defendant who may have limited assets.
One defensive tool to be aware of: anti-SLAPP motions. In some states, a defendant sued for doxing can move to dismiss early by arguing that the lawsuit targets speech on a matter of public concern. Anti-SLAPP statutes vary widely in scope. The defense is most likely to succeed when the doxed information relates to a public figure or a matter of genuine public debate, and much harder to invoke when the target is a private individual and the disclosure was clearly meant to enable harassment.
Why You Probably Cannot Sue the Platform
Victims often want to hold the site that hosted the doxing content responsible. Federal law makes that very difficult. Section 230 of the Communications Decency Act says that no provider of an interactive computer service shall be treated as the publisher or speaker of information posted by another user.6Office of the Law Revision Counsel. 47 USC 230 Protection for Private Blocking and Screening of Offensive Material That immunity generally shields platforms from civil liability for user-posted doxing content, even when the platform was slow to remove the material after being notified.
Section 230 does not protect the user who posted the information, and it does not bar federal criminal prosecution. In practice, though, it means the fastest path to getting content removed runs through the platform’s own reporting tools rather than a lawsuit. Section 230 also protects a platform’s decision to take content down voluntarily, so a poster cannot sue the platform for removing what they posted.
What to Do Right Now If You Have Been Doxed
Speed matters when your personal information is circulating online. The goal is to get the content removed as quickly as possible while building an evidence trail you will need if you later pursue criminal charges or a civil claim.
Preserve Evidence Before You Report
Before you report anything, screenshot every post, comment, and profile page involved. Capture timestamps and URLs. Platforms can delete content quickly once flagged, and if you have not preserved the evidence first, it may be gone before law enforcement can review it.
Report to the Platform
Every major social media site has a reporting function for content that violates its terms of service, and most treat the posting of someone’s home address or financial information as a high-priority violation. Use the platform’s built-in reporting tool and be specific about what personal information appears in the post.
File a Police Report
Contact your local law enforcement agency and file a formal report. Most departments accept reports online, by phone, or in person.7USAGov. Report a Crime Bring your screenshots, any threatening messages you have received, and a timeline of events. The police report creates an official record that supports both criminal investigation and any later civil lawsuit. Even if local officers are not familiar with doxing specifically, the conduct often falls under existing harassment or stalking statutes they already work with.
Report to Federal Authorities
If the doxing involves threats, crosses state lines, or targets a federal official, report it to the FBI through the Internet Crime Complaint Center at ic3.gov.8Department of Justice. Reporting Computer, Internet-related, Or Intellectual Property Crime The online form asks for details about the incident, any financial transactions involved, and information about the subject. Federal agencies generally become involved when the conduct meets the thresholds of the interstate stalking or threat statutes, so include as much detail as possible about how the information moved across state lines or through electronic communication services.
How to Reduce Your Exposure Before It Happens
The best defense against doxing is limiting how much of your personal information is publicly accessible. No prevention method is foolproof, but reducing your digital footprint makes a doxer’s job significantly harder.
Opt Out of Data Broker Sites
Data aggregation sites collect and sell personal details like home addresses, phone numbers, relatives’ names, and employment history. These sites are often the first stop for someone building a doxing file. Search for your own name on the major people-search platforms, then follow each site’s individual removal process. Most require filling out a form and confirming by email. These databases refresh regularly, so your information can reappear within a few months. Plan to repeat the process at least quarterly.
Request Search Engine Removal
Even after content is removed from a source website, cached versions may continue appearing in search results. Google allows users to request removal of pages that contain personal information like home addresses, phone numbers, or government ID numbers. For content that qualifies as doxing, Google will evaluate whether the URL contains personal information paired with threats or calls for harassment, or a significant amount of aggregated personal data without a legitimate purpose.9Google Search Help. Remove My Private Info From Google Search Google may decline the request if it considers the content newsworthy or in the public interest. Removal from search results does not delete the content from the source website, so you may also need to contact the site owner directly.
Redact Your Domain Registration
If you own a website, your domain registration records may display your name, home address, phone number, and email through the public WHOIS database. Most domain registrars now offer privacy redaction that replaces your personal data with generic placeholders while still allowing third parties to contact you through a forwarding form.10Cloudflare. WHOIS Redaction Your state or province and country will still be visible under ICANN rules, but the specific details doxers look for will be hidden.
General Digital Hygiene
Use different email addresses for public-facing and private accounts. Turn off location data on social media posts. Audit privacy settings on every platform you use at least once a year. Set up alerts for your name so you learn quickly when new content mentioning you appears online. None of these steps guarantee safety, but each one shrinks the pool of information available to someone who decides to target you.