Someone posts your home address, phone number, workplace, or family information online and sends hundreds of strangers in your direction. The natural question is straightforward: is doxxing illegal, especially when the information may have been collected from social media or public records rather than stolen from a private database? In the United States, the answer depends heavily on what was disclosed, why it was disclosed, how it was obtained, what happened afterward, and which federal or state law applies.
Short answer: Yes, doxxing can be illegal in the United States, but there is no single federal law that prohibits every instance. Liability can depend on the information shared, the method used to obtain it, the publisher’s intent, associated threats or stalking, the person targeted, resulting harm, and applicable state law.
That distinction matters because merely identifying someone online is not, by itself, the same as committing a crime. A neutral publication of lawful information may raise very different issues from posting a home address while encouraging strangers to frighten, threaten, or physically confront the resident. Federal stalking and threat statutes, specialized protections for certain officials, state anti-doxxing laws, privacy claims, and computer-access laws can all become relevant depending on the facts.
Legal note: This article provides general information about U.S. law and is not legal advice for a particular incident. Doxxing rules vary substantially among states, and small factual differences can affect whether conduct is criminal, civilly actionable, constitutionally protected, or outside a particular statute. Anyone facing immediate danger, criminal allegations, a restraining-order issue, or significant financial harm should seek advice from a qualified attorney in the relevant jurisdiction.
What does doxxing mean?
Doxxing, also spelled “doxing,” generally means publicly revealing personal information that identifies or locates another person without that person’s consent. Cornell Law School’s Legal Information Institute, in its July 2026 overview of doxxing, lists a home address, Social Security number, phone number, email address, workplace, and family information as the information most commonly exposed. The practice often becomes especially dangerous when several pieces of information are assembled in one place, allowing others to contact, locate, impersonate, or target the person.
| Information commonly exposed | Why it can create risk |
|---|---|
| Home address | Can make in-person harassment or stalking easier |
| Personal phone number | Can lead to threatening calls, texts, or account attacks |
| Personal email | May be used for harassment, phishing, or account-recovery attempts |
| Employer or school | Can direct harassment toward a workplace or institution |
| Family details | May expose relatives who were not part of the original dispute |
| Social Security or financial data | Can increase identity-theft and fraud risks |
| Account credentials | May allow unauthorized access to private accounts |
Not every uncomfortable disclosure meets the legal definition used by every state. Some laws focus on intent to cause harassment or physical harm, while others require specified consequences such as fear, substantial disruption, financial injury, or mental anguish. This is one reason a legal analysis should focus on the full conduct rather than simply asking whether a post contained someone’s personal information.
Is doxxing illegal under federal law?
There is currently no comprehensive federal statute that makes every act of doxxing a crime. Cornell’s Legal Information Institute confirmed that position in its July 2026 review, while also noting that federal statutes can reach particular forms of doxxing. The most relevant laws can involve protected government personnel, cyberstalking, threatening communications, or unauthorized access to electronic information.
Doxxing certain officials can violate 18 U.S.C. § 119
Federal law gives special protection to certain people performing official duties. Under 18 U.S.C. § 119, knowingly making restricted personal information about a covered person or immediate family member publicly available can be a federal crime when done with specified intent involving threats, intimidation, or facilitating a crime of violence. Restricted information under the statute includes items such as a Social Security number, home address, home or mobile phone number, personal email address, and home fax number.
The statute does not protect every person in the United States merely because personal information was posted about them. Its definition of a “covered person” includes specified federal officers and employees, federal jurors and witnesses, federal criminal informants, and certain state or local personnel involved in federal criminal investigations. A violation can carry a fine, imprisonment for up to five years, or both.
A 2026 federal prosecution illustrates how the law operates in practice. In May 2026, the U.S. Department of Justice announced that a North Carolina man pleaded guilty after posting a U.S. Supreme Court Justice’s home address online with the intent to threaten, intimidate, or incite violence. The case illustrates why the target, accompanying message, and publisher’s intent can be just as important as the information itself.
Doxxing may become federal cyberstalking.
The federal stalking statute, 18 U.S.C. § 2261A, can apply when someone uses an interactive computer service, an electronic communication service, or another facility of interstate commerce with the required intent. The person must also engage in a course of conduct that causes or would reasonably be expected to cause substantial emotional distress, or that places someone in reasonable fear of death or serious bodily injury. A doxxing campaign combined with repeated online harassment, surveillance, intimidation, or threats may therefore raise issues under the statute, even though the law itself is labeled as stalking. The exact elements still have to be established, and posting identifying information does not automatically satisfy them.
Federal stalking penalties depend on the outcome and circumstances. The general maximum under 18 U.S.C. § 2261(b) is up to five years in cases without the specified enhanced harms, while serious bodily injury, life-threatening injury, permanent disfigurement, use of a dangerous weapon, or a resulting death can increase potential punishment substantially. Because sentencing and charging depend on case-specific facts, those maximums should not be treated as a prediction for an individual case.
Threatening someone after revealing their information can be a separate crime.
A doxxing post may also contain an explicit or implied threat. Under 18 U.S.C. § 875, transmitting certain threatening communications in interstate or foreign commerce can create federal criminal liability, including communications containing threats to kidnap or injure another person. Section 875(c) provides for imprisonment of up to five years for covered threats to kidnap or injure, while separate subsections address extortion-related threats.
This means the legal problem may not be the address or telephone number standing alone. The surrounding words, prior communications, audience, and pattern of conduct can transform the situation into something much more serious. A post that reveals a person’s address alongside a credible threat of violence therefore presents a very different legal question from a neutral reference to an address in an ordinary public discussion.
How the information was obtained also matters
Doxxing does not begin only when information is posted. If someone first obtains private communications by intentionally accessing an electronic communications service without authorization, separate federal computer and communications laws may be implicated. For example, 18 U.S.C. § 2701 prohibits certain unauthorized access to facilities through which electronic communication services are provided when that access obtains, alters, or prevents authorized access to communications in electronic storage.
That distinction is important because information can be published lawfully, obtained unlawfully, or both lawfully and unlawfully. Breaking into an email account to obtain private messages is legally distinct from reading information openly posted on a public government website. When evaluating a possible doxxing incident, the collection method deserves as much attention as the eventual publication.
State doxxing laws can be much stricter.
State law complicates the U.S. legal landscape. Some states have enacted statutes that specifically address doxxing, while others use electronic-harassment, stalking, intimidation, privacy, impersonation, or related laws. A reader should therefore never assume that conduct lawful in one state will receive the same treatment in another.
| State example | How the law approaches doxxing |
|---|---|
| California | Penal Code § 653.2 makes specified electronic distribution of personal identifying information a misdemeanor when done with the required intent to place someone in fear and imminently cause unwanted physical contact, injury, or harassment by a third party. The statute provides for up to one year in county jail, a fine of up to $1,000, or both. |
| Washington | RCW 4.24.792 creates a civil claim for unauthorized publication of personal identifying information when its requirements concerning consent, intent or reckless disregard, and resulting harm are met. Available remedies can include compensatory damages, punitive damages, statutory damages of $5,000 per violation, attorney fees, costs, and injunctive relief. |
| Alabama | Alabama has a statute expressly addressing “doxing,” including intentional electronic publication of identifying information with the intent that others use it to harass or harm the target when the statutory requirements are met. Cornell’s Legal Information Institute identifies Alabama as a state with a specific anti-doxxing law. |
These examples are useful because they show that states do not all use the same legal model. California’s provision is criminal, Washington provides a detailed civil cause of action, and other states may protect specific professions or use broader harassment statutes instead. An accurate answer to a real incident therefore requires checking the law in the state or states connected to the publisher, target, conduct, and resulting harm.
Is it legal to post information that is already public?
The fact that information can be found somewhere in a public record does not automatically answer whether republishing it is lawful. Purpose, context, applicable statutory language, and constitutional protections can all matter, especially when information is gathered together and used to target a particular person. Washington’s anti-doxxing civil statute, for example, expressly states that it is not a defense that the personal information had previously been publicly disclosed or was readily discoverable through research. The same statute also preserves constitutionally protected activity and contains several exceptions.
At the same time, the First Amendment protects substantial amounts of truthful speech, journalism, public discussion, and lawful political activity. That is why many anti-doxxing provisions are written around factors such as malicious purpose, threats, harassment, fear, harm, or incitement rather than simply forbidding people from mentioning another person’s identity. Saying that “public information is always legal to repost” is therefore too broad, but saying that “publishing anyone’s address is always a crime” is also inaccurate.
A useful way to think about the issue is to separate information from conduct. A street address listed in a legitimate news report may serve a very different purpose from the same address posted in a hostile group with instructions encouraging people to confront the resident. Courts and investigators can examine the surrounding circumstances rather than treating identical pieces of information as legally identical in every context.
When can doxxing lead to a civil lawsuit?
Criminal prosecution is not the only possible consequence. Depending on the state and the facts, a victim may be able to pursue a statutory doxxing claim or ask a lawyer whether privacy, emotional-distress, defamation, stalking, harassment, or other civil theories are available. The remedies can differ considerably, and not every harmful online disclosure automatically supports every type of claim.
Washington provides a particularly clear statutory example. When RCW 4.24.792 is violated, a prevailing claimant may seek remedies that include compensatory damages, punitive damages, $5,000 in statutory damages per violation, reasonable attorney fees and costs, and injunctive relief. Courts can also issue orders to stop further disclosure of the protected information.
Some disputes may eventually involve settlement discussions rather than a full trial, although cases involving threats or immediate safety concerns may require stronger protective measures first. Understanding how mediation works as an alternative to a court ruling can help a target weigh a negotiated resolution against litigation. Whether mediation is appropriate in an actual doxxing dispute depends on safety, power imbalances, applicable law, and counsel’s advice.
What are the possible penalties for doxxing?
There is no single nationwide “doxxing penalty” because charges depend on the statute used. Federal penalties can range from fines and imprisonment under specialized statutes to much greater exposure when stalking causes serious physical injury or death. State criminal penalties and civil damages add another layer, making location and circumstances essential.
| Law or claim | Example consequence |
|---|---|
| 18 U.S.C. § 119 | Fine and up to five years in prison for qualifying conduct involving covered persons |
| 18 U.S.C. § 875(c) | Up to five years in prison for a qualifying interstate threat to kidnap or injure |
| 18 U.S.C. § 2261A | Federal stalking penalties generally reach up to 5 years, with higher maximums when serious harm is specified. |
| California Penal Code § 653.2 | Misdemeanor punishable by up to one year in county jail, up to a $1,000 fine, or both |
| Washington RCW 4.24.792 | Civil remedies can include $5,000 statutory damages per violation plus other damages, fees, and injunctive relief |
A person can also face consequences outside criminal sentencing or civil damages. Platforms may remove posts or suspend accounts under their own policies; employers may respond to misconduct; and courts may issue restraining or protective orders when the legal requirements are met. None of those possibilities means that every accusation is valid, which is why evidence showing exactly what was posted, when it was posted, and by whom can become critical.
Examples of when doxxing may cross the legal line
Consider several different situations. Posting an address while telling followers to confront the resident physically may implicate very different laws from mentioning the same address in a legitimate public-record discussion. Likewise, repeatedly exposing new personal details while threatening someone can look much more like stalking than a single isolated disclosure.
The same distinction applies to how the information was collected. Hacking into an account, impersonating someone to obtain confidential data, or stealing login credentials can create separate legal problems even before the information is published. By contrast, lawful research involving genuinely public material raises more complicated speech and privacy questions that cannot be resolved simply by applying the label “doxxing.”
Intent is often central, but consequences can also matter. Some statutes require fear, harassment, physical harm, economic injury, mental anguish, or substantial disruption, while others focus on threats or the status of the person being targeted. A fact-specific review is therefore much more useful than assuming that every unpleasant disclosure receives the same legal treatment.
What should you do if you have been doxxed?
A doxxing incident can spread rapidly, so preserving evidence and reducing immediate exposure are usually more useful than arguing publicly with the person who posted the information.
The appropriate response depends on whether the disclosure involves only contact details, credible threats, financial credentials, stalking, account access, or an immediate physical danger. If you believe someone is in imminent danger, contact emergency services rather than relying only on platform reporting.
- Preserve evidence before content disappears. Save screenshots showing usernames, dates, timestamps, surrounding messages, and the information that was posted.
- Record where the information appears. Keep a clear log of posts, accounts, forums, messages, and copies or reposts so an attorney or investigator can understand the spread.
- Report the material to the platform. Use the service’s privacy, harassment, threat, or personal-information reporting process where available.
- Secure exposed accounts. Change affected passwords, use unique credentials, enable multifactor authentication, and review account-recovery information.
- Protect financial identity if sensitive identifiers leaked. If a Social Security number or other identity information was exposed, the FTC recommends reviewing credit reports and considering a free credit freeze with all three nationwide credit bureaus.
- Document threats separately. Preserve voicemails, texts, emails, direct messages, packages, unwanted visits, and other conduct that may establish a broader pattern.
- Contact law enforcement when appropriate. Credible threats, stalking, account intrusion, identity theft, or immediate safety risks may justify reporting to local or federal authorities depending on the circumstances.
- Speak with a lawyer about state-specific remedies. Counsel can assess criminal statutes, civil claims, protective orders, preservation requests, subpoenas, and possible injunctions under the law that applies to the incident.
Evidence should be preserved without repeatedly redistributing the sensitive information yourself. Forwarding the original doxxing post across multiple public accounts may increase the target’s exposure even when the intention is to condemn what happened. Keep complete records for legitimate reporting, legal advice, or law-enforcement purposes while minimizing unnecessary republication.
Digital records can also matter if there is a dispute over who published the information or what the person intended. Context, account records, communications, location evidence, and timestamps may support or undermine accusations in a criminal proceeding. Magazetter’s article on exculpatory evidence provides additional background on how evidence that favors an accused person can become important in U.S. criminal cases.
The bottom line
So, is doxxing illegal in the United States? It can be, but the law does not treat every disclosure of personal information the same way. Federal statutes can cover threats, stalking, unauthorized access, and disclosures targeting certain protected officials, while state laws can create additional criminal offenses or civil remedies.
The most important questions are what information was shared, how it was obtained, why it was published, what was said alongside it, whether the conduct formed part of a larger campaign, and what harm resulted.
A person facing immediate danger should prioritize safety and contact law enforcement, while someone dealing with financial or identity information should secure accounts and consider identity theft protections. For broader plain-English legal explainers, readers can also explore Magazetter’s Law section.
Frequently asked questions
Is doxxing illegal if the information is public?
Not automatically, but public availability does not guarantee that republishing the information is lawful in every context. Some laws focus on harmful intent, harassment, threats, or resulting injury, and Washington expressly states that prior public disclosure or discoverability is not necessarily a defense to its statutory civil claim. Constitutionally protected reporting, political speech, and other lawful uses can still receive protection, so the surrounding circumstances matter.
Is posting someone’s home address illegal?
Posting an address by itself is not universally prohibited by one federal law applicable to everyone. It can become illegal or actionable when additional statutory requirements are satisfied, such as an intent to cause harassment, facilitate violence, threaten a covered official, or engage in stalking. California, Washington, and federal § 119 demonstrate how the answer changes depending on the conduct and the person targeted.
Can you go to jail for doxxing?
Yes, some doxxing-related conduct can result in criminal charges carrying jail or prison exposure. Federal stalking, interstate threat, and protected-official statutes can apply in qualifying circumstances. At the same time, states such as California also criminalize certain forms of electronic publication intended to cause third-party harassment or harm. The potential sentence depends on the actual offense charged, not on someone casually labeling the behavior “doxxing.”
Can you sue someone for doxxing?
Potentially, although the available claim depends on state law and the facts. Washington expressly creates a civil cause of action for qualifying unauthorized publication of identifying information and provides damages and injunctive remedies. In other states, an attorney may need to examine privacy, harassment, stalking, defamation, or other applicable statutes and civil causes of action.
Is doxxing a federal crime?
There is no comprehensive federal offense that criminalizes every instance of doxxing. Federal law can nevertheless apply when doxxing satisfies another statute, including laws governing certain protected officials, stalking, interstate threats, or unauthorized access to stored electronic communications. Cornell Law School summarizes the federal position by noting that no overarching federal doxxing law exists while several federal statutes can reach particular conduct.
Is doxxing someone on social media illegal?
Using social media does not automatically make a disclosure criminal or protected. Investigators and courts may look at the personal information released, the poster’s intent, accompanying threats or instructions, repeated conduct, resulting harm, and the relevant state or federal statute. A social-media post can therefore be lawful in one context and potentially criminal or civilly actionable in another.
