Somebody posted your home address. Or your phone number, your employer, your children’s school, stacked in one place for an audience that was already angry at you. The first question almost everyone asks is the same: is this illegal, and can the person be arrested?
The honest answer is that it depends, and that publishing personal information by itself often is not a crime in the United States. That is not satisfying when your address is sitting on a forum thread. But understanding why the law works this way is the difference between reporting the incident in a way that gets traction and reporting it in a way that gets a case number.
What follows is the shape of US doxxing law as it stands in September 2026: the federal statutes prosecutors actually use, the state patchwork, the factors that turn publication into a chargeable offense, the civil claims that run alongside, and why platform terms of service are usually the fastest lever available.
Contents
The short answer, and why it frustrates people
Doxxing is not a single offense in American law. There is no federal statute saying that publishing another person’s personal information is a crime, and in most states no general statute saying it either. What exists instead is a set of laws about conduct: stalking, threats, harassment, intimidation, extortion, unauthorized computer access. Doxxing becomes illegal when it is the vehicle for one of those, when it targets a category of person a legislature has singled out for protection, or when it happens in a state that has passed a law aimed at doxxing specifically.
The useful reframing is this. The question is rarely whether doxxing is a crime. It is what the person did around the publication: what they intended, whether they threatened, whether they did it repeatedly, whether they urged others to act, what they posted, how they got it, and who you are. Those are the variables the statutes turn on.
If you are still working out whether what happened to you counts as doxxing at all, our companion guide on what doxxing is and how it happens covers the definition, the common attack patterns and where the information usually comes from. This piece picks up at the legal question.
Why there is no single federal anti-doxxing law
Congress has considered one. The Interstate Doxxing Prevention Act, H.R. 6478, was introduced in the 114th Congress in 2016 by Representative Katherine Clark and would have created a general federal offense for knowingly publishing personal information with intent to threaten, intimidate or harass. It did not become law, and there is still no general federal prohibition on publishing another person’s personal details.
The reason is a genuine drafting problem rather than indifference. Truthful information lawfully obtained is presumptively protected speech, and much of what gets called doxxing consists of true facts assembled from sources anyone can reach: property records, voter files, court dockets, business filings, data broker profiles. A statute broad enough to catch the person who posts an address beside a call for violence is also broad enough, if carelessly written, to catch a reporter naming a landlord or a protester identifying an official. Congress has therefore legislated around the edges, protecting specific roles and criminalizing the threatening conduct rather than the publication. The result looks incoherent from the outside and is, in fact, deliberately narrow.
The federal statutes prosecutors actually reach for
Interstate stalking, 18 U.S.C. section 2261A
A federal doxxing case is almost never charged as doxxing, and this is the provision it is usually charged under instead. Subsection (2) covers a person who uses the mail, an interactive computer service, an electronic communication service or system of interstate commerce, or any other facility of interstate commerce, with intent to kill, injure, harass, intimidate, or place another under surveillance with such intent, and who engages in a course of conduct that either places the target in reasonable fear of death or serious bodily injury, or causes, attempts to cause, or would reasonably be expected to cause substantial emotional distress.
Two features matter enormously. The intent element requires proof of purpose, not carelessness. And “course of conduct” means a pattern, so a single post containing an address is a difficult fit, while a campaign running over weeks with repeated posts and escalation is a much better one. This is why documenting the whole sequence matters more than documenting the worst individual post.
Interstate threats, 18 U.S.C. section 875
Subsection (c) makes it an offense to transmit in interstate or foreign commerce any communication containing a threat to kidnap or injure another person, punishable by up to five years. Subsection (d) covers threats to injure property or reputation, or to accuse someone of a crime, made with intent to extort money or anything of value, punishable by up to two years. That second provision reaches the blackmail pattern: pay me, or I publish your address.
Hoaxes and computer intrusion
Doxxing and swatting travel together. When a published address is used to send an armed police response to a house on a fabricated report, the federal false information and hoaxes provision at 18 U.S.C. section 1038 becomes available alongside state offenses for false reporting.
Separately, how the information was obtained can be an offense independent of the publication. Where the details came out of a hacked account, a breached database or an abused employer system, federal computer crime law is potentially in play even if posting them would not have been. Compiling a profile from public records is legally very different from taking the same facts out of somebody’s inbox.
Special protection for officials, jurors and judges
The closest thing to a federal anti-doxxing statute is 18 U.S.C. section 119, titled “Protection of individuals performing certain official duties.” It makes it an offense to make restricted personal information about a covered person, or a member of their immediate family, publicly available with intent to threaten, intimidate, or incite a crime of violence against them, and also to knowingly provide that information intending it to be used for such purposes.
Restricted personal information is defined as the Social Security number, home address, home phone number, mobile phone number, personal email, or home fax number of, and identifiable to, that individual. Covered persons include the federal officers and employees designated in section 1114, federal jurors, witnesses, court officers, informants in federal criminal investigations, and state or local officers assisting federal investigation
|
Federal provision
|
What it covers
|
What must be shown
|
|
2261A
|
Online campaigns intended to harass or intimidate
|
Intent, a course of conduct, and reasonable fear or substantial emotional distress
|
|
18 U.S.C. 875(c)
|
Interstate threats to injure or kidnap
|
A communication containing a true threat
|
|
18 U.S.C. 875(d)
|
Threats to property or reputation for extortion
|
The threat plus intent to extort
|
|
18 U.S.C. 119
|
Publishing restricted personal information about covered officials
|
Covered person status plus intent to threaten, intimidate or incite violence
|
|
1038
|
Hoax reports, including swatting
|
A knowingly false report of a listed kind
|
|
Federal computer crime law
|
How the data was obtained, not what was posted
|
Unauthorized access or exceeding authorized access
|
s. The maximum term is five years.
The conduct it prohibits is exactly what most people mean by doxxing. What stops it being a general anti-doxxing law is the covered person list. If you are not on it, section 119 does nothing for you.
Federal judges gained their own protection through the Daniel Anderl Judicial Security and Privacy Act, enacted in December 2022 as part of the annual defense authorization legislation. It is named for the son of a federal judge in New Jersey, killed at the family home by a man who had obtained the judge’s address. New Jersey had already passed a state analogue, Daniel’s Law, in 2020, which lets covered persons including judges, law enforcement officers and child protective investigators demand that entities stop disclosing their home addresses and unpublished home phone numbers, with a ten business day compliance window and liquidated damages of not less than $1,000 per violation. It has produced substantial litigation against data brokers since 2024. Where legislatures have acted decisively, they have usually done so for a defined occupational group after a specific tragedy, rather than for the public at large.
State doxxing laws: a patchwork that is filling in
State law is where the real movement has been, and it moves fast enough that any count goes stale. An October 2025 review by the Council of State Governments found that since the early 2000s, 54 bills had been enacted across 19 states aimed at protecting public officials from doxing.
That review sorts the states into groups. Three, Alabama, California and Illinois, explicitly define doxing as a standalone offense. Fourteen more establish it as a standalone crime without defining the term: Colorado, Florida, Missouri, Oklahoma, Pennsylvania, Virginia, Oregon, Delaware, Kentucky, Minnesota, Nevada, New Jersey, Utah and Washington. Two, Arizona and Connecticut, amended their existing harassment and stalking statutes rather than creating a new offense.
Scope varies as much as structure. Most of these laws protect all individuals and their families, but seven, Alabama, Colorado, Delaware, Minnesota, New Jersey, Oklahoma and Pennsylvania, limit their reach to specified public sector officials, typically judges, law enforcement officers and election workers. Colorado has been the most active legislature here, expanding its protections repeatedly since its original 2002 law to cover judges, public defenders, election officials, firefighters and child abuse investigators. Roughly half of these states provide criminal penalties only; the others allow both criminal charges and a civil action.
In states with no targeted statute, the conduct is reached, if at all, through the general criminal code: harassment, cyberharassment, stalking and cyberstalking, intimidation, terroristic threats, criminal coercion. Those provisions usually require the same ingredients as their federal counterparts, so the analysis converges even where the label differs. One further complication: the poster may live in another state or country, and which law governs and which agency has jurisdiction is a real question rather than a formality.
What turns publishing information into a crime
Strip away the statutory labels and the same handful of factors decide almost every case.
- Intent. Nearly every applicable statute turns on purpose: to threaten, intimidate, harass, alarm or place someone in fear. A post made to warn a community, however badly judged, is a different legal object from one made to frighten a person.
- A threat, explicit or implicit. “Here is where he sleeps” carries a payload that “here is his address” does not. Framing is evidence of intent, and often the entire case.
- A course of conduct. Repetition, escalation, reposting after removal and moving platforms after a suspension all build the pattern stalking and harassment statutes require.
- A result. Many statutes require reasonable fear of death or serious bodily injury, substantial emotional distress, or tangible disruption to the target’s life. Harm is an element, not a sentencing detail.
- Who the target is. The same post about a judge, election official or police officer may fall inside a statute that would not reach a private person.
- What was published. A Social Security number, home address, unlisted number or identity document sits in a different category from a name and an employer.
- How it was obtained. Assembled from public records, or extracted from a hacked account. That distinction can create a separate offense regardless of the publication.
- Whether others were recruited. Calls for readers to contact, visit or confront the target push the conduct toward incitement and toward the aggravated end of every statute that applies.
The First Amendment, and why the line sits where it does
Any discussion of whether doxxing is illegal runs into constitutional limits within about thirty seconds. Truthful information lawfully obtained enjoys strong protection. The categories that fall outside it, and that doxxing prosecutions depend on, are true threats, incitement to imminent lawless action, and speech integral to criminal conduct such as extortion.
In 2023, in Counterman v. Colorado, the Supreme Court added a mental state requirement to the true threats category. A true threat prosecution requires proof that the speaker had at least a reckless mental state, meaning they consciously disregarded a substantial risk that the communication would be viewed as threatening violence. A purely objective test, asking only whether a reasonable person would feel threatened, is not sufficient on its own.
The consequence is direct. Someone who posts an address with no commentary and says they were sharing public information is a harder target than someone who posts it with a suggestion about what should happen there. Prosecutors build these cases from the surrounding text, the reply thread and the account’s later behavior, because that is where the mental state evidence lives. Legislatures know this, which is why better drafted statutes contain express carve-outs. The Illinois civil doxing law, for example, excludes reporting criminal activity to law enforcement and activity protected by the federal and state constitutions relating to speech, press, assembly, protest and petition, including providing information to a news outlet.
The intuitive answer is usually wrong in both directions. On the criminal side, the target’s fame generally does not change the analysis: the statutes turn on intent, threat, course of conduct and resulting fear, not on whether the person is well known.
Where public status does matter is in removal and civil claims. Platforms and search engines weigh newsworthiness, and information about an official’s public conduct is far more likely to be treated as legitimately published. Pulling the other way, several states give officials extra statutory protection precisely because their roles expose them. Public role can cut either way.
Civil claims that can run in parallel
Criminal law is not the only route. A criminal case belongs to the state, which decides whether to bring it; a civil case belongs to the person harmed.
Targeted civil doxxing statutes
Some states now provide a private right of action built for this conduct. California Civil Code section 1708.89, which came out of Assembly Bill 1979 and took effect on January 1, 2025, creates liability where a defendant electronically distributes a person’s identifying information or harassing messages without consent, with intent to place that person in reasonable fear for their safety or a family member’s, in circumstances likely to incite unlawful action by a third party. Remedies include damages, statutory damages running from $1,500 to $30,000, punitive damages, attorney’s fees and injunctive relief, and a plaintiff may proceed under a pseudonym, which matters when the whole injury was exposure.
The Illinois Civil Liability for Doxing Act uses different elements. The plaintiff must show that personally identifiable information was intentionally published without consent, with intent that it be used to harm or harass and with knowledge that the person would be reasonably likely to suffer death, bodily injury or stalking, and that the publication caused significant economic injury, emotional distress, fear of serious bodily injury or substantial disruption to the plaintiff’s life. Remedies include damages, attorney’s fees, restraining orders and injunctions, and a defendant can recover fees where the claim was frivolous or brought in bad faith.
Common law claims and their limits
Where no targeted statute exists, older tort theories may still be available, subject to wide variation in their elements and in whether a state recognizes them at all. The privacy torts most often discussed here are public disclosure of private facts, intrusion upon seclusion and false light. Intentional infliction of emotional distress is sometimes pleaded alongside them, though it requires conduct a court will describe as extreme and outrageous, a demanding standard rather than a rhetorical one. If the posts carry false factual assertions rather than just contact details, that is a separate body of law, and the elements and defenses are set out in our guide to defamation of character.
Civil claims are constrained by realities unrelated to the merits. The defendant is frequently anonymous, which means a subpoena process before the case meaningfully begins. Litigation costs money and takes time. A judgment against a defendant with no assets is a piece of paper. Filing a public lawsuit republishes the underlying facts and can amplify the exposure. And limitation periods are short and vary by state and by claim, which is the most common way a viable case becomes a dead one.
People often assume the site that hosted the post is the obvious defendant, since it has money and a legal department. Federal law generally says otherwise: providers of interactive computer services are broadly shielded from being treated as the publisher or speaker of user content. The poster is the defendant, not the platform. Which is why the terms of service route matters: the law that stops you suing the platform does not stop the platform enforcing rules stricter than the criminal code.
Every major platform bans the publication of private personal information outright, with no requirement that you prove intent, no jurisdictional question and no lawyer involved. X, to take one published example, prohibits posting another person’s home address or physical location including street addresses and GPS coordinates, government issued identification and national identity numbers, non-public phone numbers, email addresses and passwords, bank and credit card details, medical records and biometric information, and media or names that identify anonymous account holders. It separately prohibits threatening to expose someone’s private information and demanding payment to post or withhold it. Enforcement runs from required deletion and a temporary read-only period through to suspension, with accounts whose sole purpose is posting others’ private information subject to suspension outright. Discord, Reddit, Meta’s platforms and the rest maintain comparable policies.
Two practical points. Report under the specific private information or doxxing category rather than generic harassment, because the review queues and criteria differ. And capture evidence before you report, because a successful takedown removes the proof along with the post. The sequencing, in the order that works in the first 48 hours, is in our guide on what to do if you get doxxed.
Search engines: removal without a courtroom
Search engines run their own removal policies, independent of whether anything illegal occurred. Google will consider removing from Search, on request, results containing your home address, phone number or email, confidential government identification numbers, bank or credit card numbers, images of handwritten signatures and identification documents, medical records, and login credentials.
It also maintains criteria aimed at doxxing specifically: pages where your contact information appears alongside explicit or implicit threats, or calls for others to harm or harass you, and pages carrying a significant amount of aggregated personal information without a legitimate purpose. That second criterion reaches a typical people search profile.
Two caveats keep expectations realistic. Google weighs public interest and newsworthiness, so material tied to genuine reporting may stay. And removal from search results is not removal from the internet: the page still exists, and anyone with the link still reaches it. Cutting off supply at source, which means working through the brokers republishing your address, is covered in our guide to removing your address from the internet. Where exposure has already reshaped what appears for your name, suppressing and rebuilding those results is the ongoing discipline of online reputation management, a separate project from the legal question entirely.
What reporting it to law enforcement looks like
Local departments vary enormously in their familiarity with these statutes, and an officer taking a walk-in report may never have handled a case like it. Reports involving out of state or anonymous posters are slower still. What tends to help is speaking the language of the elements. Rather than describing the incident only as doxxing, it is generally more productive to ask which statute the department would consider, naming the categories: the state’s harassment or cyberharassment provision, its stalking or cyberstalking provision, criminal threats or intimidation, or a targeted doxxing statute where one exists. If threats arrived, or anyone showed up, or calls and deliveries started, lead with that, because the threat or the resulting conduct, not the publication, is usually what gets charged.
Documentation decides most of these cases: full screenshots showing the URL and a visible timestamp, archived copies of the pages, a written timeline, copies of every message or call received, and a record of every report filed with its reference number. Where there is an interstate element, a complaint to the FBI’s Internet Crime Complaint Center creates a federal record alongside the local one. None of that guarantees a charge. All of it makes one possible.
Frequently asked questions
Is doxxing a crime?
Sometimes, depending on the state, the intent behind it and who was targeted. It is not a standalone federal crime for the general public. It is a standalone state crime in a growing number of states, and elsewhere it is prosecuted through harassment, stalking or intimidation statutes when the required intent and course of conduct are present.
Is it illegal to dox someone if the information is already public record?
It can be. Public availability of the underlying facts is a serious defense argument and a genuine constitutional constraint, but the statutes that reach this conduct generally turn on intent and effect rather than on whether the data was secret. Assembling scattered public records into a single profile and publishing it to intimidate someone is a different act from those records sitting separately in a county database.
Can you go to jail for doxxing?
Yes, where the conduct falls within a criminal statute. Federal provisions in this area carry maximum terms measured in years, and state offenses range from misdemeanors to felonies depending on the statute, the harm caused and any aggravating factors. Maximum sentences are ceilings rather than expectations, and most cases resolve below them.
Conclusion
Is doxxing illegal? Not by itself, not everywhere, and not as a single named offense in federal law. It becomes illegal when intent, threat, repetition, harm or the target’s protected role bring it inside a statute that already exists, and a growing number of states have written statutes aimed squarely at it. The federal provisions that get used are the interstate stalking and threat statutes, plus a narrow protective section for officials, jurors, witnesses and judges.
The gap between what feels criminal and what is provable is where most people get stuck, and it is why the practical response matters more than the legal characterization. Evidence captured before anything is deleted keeps every option open. Platform reports, which require no proof of intent and no jurisdiction, usually move within days. Search removal requests operate on their own criteria. Data broker removals cut off the supply of the information being republished. The legal question, criminal or civil, runs alongside all of that rather than replacing it, and it runs slowly.
This article is general information about how US law is structured in this area, not legal advice. These statutes vary significantly from state to state, they are being amended frequently, and limitation periods for civil claims are often short. Anyone facing an active doxxing incident, or considering a claim, should speak with a lawyer licensed in their own state about their specific facts, and should contact law enforcement immediately if they believe they are in danger.
