Over 300 companies trust Media Removal. Get a Quote Now >

Defamation & harassment law guide

Is Doxxing Illegal? Doxxing Laws Explained

Doxxing is often illegal in the US, but no single law covers it. Here is how federal and state laws apply and what to do if your private information has been exposed.

Reviewed byIsabella Custódio Mesquita
Verified November 1, 2026
12 min read
11 official sources

Is doxxing illegal? The short answer

Doxxing is not a single crime under one national law in the United States, but it is often illegal. Publishing someone’s home address, phone number or other private details becomes unlawful when it is done to threaten, harass or put that person at risk, or when it is part of a stalking campaign. Federal stalking law, a federal statute protecting certain officials and witnesses, and a growing number of state laws can apply. Several states also let victims sue the person who doxxed them for damages and a court order.

Whether a specific post crosses the line depends on what was shared, why it was shared and what happened next. This guide explains the main laws, what they require and the practical steps you can take. It is general information, not legal advice. For your own situation, speak with a licensed attorney in your state.

What counts as doxxing

Doxxing (also spelled doxing) means gathering and publishing someone’s identifying or private information without their consent, usually so that others can find, contact or target them. Common examples include:

Posting a person’s home address, workplace or daily routine alongside a call to “pay them a visit”.
Sharing a private phone number or personal email in a thread that is already hostile.
Linking an anonymous account to a real name, employer or family members.
Publishing Social Security numbers, financial records, medical information or ID documents.
Compiling scattered public details into one profile designed to expose and intimidate.

Not every disclosure is doxxing in the legal sense. Laws usually look for two things: harmful intent (to threaten, harass or endanger) and a real effect on the victim (fear, distress, financial loss or a disrupted life). Reporting a crime to the police, sharing information with the press or discussing a public figure’s official conduct is generally treated differently.

Federal laws that can apply to doxxing

There is no general federal “doxxing statute” that covers everyone. Two federal laws are the most relevant.

Publishing restricted personal information (18 U.S.C. § 119)

18 U.S.C. § 119 makes it a federal crime to knowingly make public the restricted personal information of a covered person or their immediate family, either intending to threaten, intimidate or incite a crime of violence against them, or intending and knowing that the information will be used for that purpose. Restricted information includes a Social Security number, home address, home or mobile phone number, personal email and home fax number. Covered persons are limited: federal officers and employees, jurors, witnesses and officers of a federal court, informants and witnesses in federal criminal cases, and certain state or local officials who assisted a federal investigation. The maximum penalty is five years in prison, a fine, or both.

Federal cyberstalking (18 U.S.C. § 2261A)

For private individuals, the broader tool is the federal stalking statute. 18 U.S.C. § 2261A(2) covers a course of conduct carried out through the internet, email, social media or other interstate facilities, with intent to kill, injure, harass or intimidate, that places the victim in reasonable fear of death or serious bodily injury or causes, or would reasonably be expected to cause, substantial emotional distress. Repeated doxxing used to frighten or torment someone can fall within it. Penalties are set in 18 U.S.C. § 2261(b), with a maximum of five years in prison in the base case and higher maximums when the conduct causes serious injury or death.

For more on how these rules work in practice, see our guide to cyberstalking laws.

State doxxing laws: examples

Most of the action is at the state level, and it is changing quickly. Some states treat doxxing as a crime, others give victims a civil claim, and some do both. A few examples show the range:

California (criminal). Penal Code § 653.2 makes it a misdemeanor to electronically distribute someone’s personal identifying information, without consent, with intent to place them in reasonable fear for their own safety or their immediate family’s, and for the purpose of imminently causing them unwanted physical contact, injury or harassment by a third party. The penalty is up to one year in county jail, a fine of up to $1,000, or both.
California (civil). Civil Code § 1708.89 gives doxxing victims a private right to sue. A prevailing plaintiff can recover economic and noneconomic damages, statutory damages of $1,500 to $30,000, punitive damages and, after a noticed hearing, attorney’s fees. The court can order the defendant to stop, and the plaintiff may proceed under a pseudonym such as Jane Doe.
Illinois (civil). The Civil Liability for Doxing Act applies when someone intentionally publishes another person’s personally identifiable information without consent, intending it to be used to harm or harass, and knowing or recklessly disregarding that the person is reasonably likely to suffer death, bodily injury or stalking. The publication must also cause significant economic injury, emotional distress, fear of serious harm or a substantial life disruption. Victims can seek damages, attorney’s fees and injunctions.
Washington (civil). RCW 4.24.792, enacted in 2023, allows a civil action for publishing personal identifying information without the person’s express consent when the publisher intended or knew it would be used to harm the person, or recklessly disregarded that risk, and the publication caused harm such as physical injury, significant economic injury, mental anguish, fear of serious bodily injury or death, or a substantial life disruption. Remedies include compensatory and punitive damages, statutory damages of $5,000 per violation, fees and injunctive relief. The fact that the information was already public is not a defense.
Oregon (civil). ORS 30.835, enacted in 2021, lets a person sue when someone knowingly disclosed their personal information, without consent, with intent to stalk, harass or injure them, and the disclosure did so. A reasonable person in the same position must also have been stalked, harassed or injured by it. Remedies include damages, punitive damages, injunctive relief and attorney fees.

Outside these examples, conduct that looks like doxxing is often prosecuted under general harassment, stalking, threats or identity theft laws. Our guide to online harassment laws covers those broader rules.

Is it still doxxing if the information is already public?

This is the most common defense people raise, and it is weaker than many assume. Laws focus on what the poster did with the information and why, not only on where it came from. Washington’s statute says expressly that prior public availability is not a defense (RCW 4.24.792). Federal cyberstalking law, for its part, looks at the overall course of conduct, the intent behind it and its effect on the victim.

That said, publicly available information is often the raw material. Data broker and people-search sites make it easy to compile an address or phone number in minutes. Reducing that exposure is a practical part of prevention, and our guide on how to opt out of data brokers explains how.

Doxxing, defamation and free speech

Doxxing and defamation are different problems that sometimes appear together. Doxxing usually exposes real private information. Defamation involves a false statement of fact that damages someone’s reputation. A post can do both, for example by publishing your address next to a false accusation. In that case, separate claims may be available. See our overview of defamation laws and, for state-specific rules, pages such as California defamation law.

The state doxxing laws covered here are drafted around the First Amendment. Illinois and Washington both exclude constitutionally protected speech, press activity and good-faith reports to law enforcement (Illinois Act, Section 10; RCW 4.24.792). Criticism, journalism and commentary on public conduct are generally protected even when they are unwelcome. The line is crossed when private details are used as a weapon.

It is also worth knowing who is usually responsible. Under 47 U.S.C. § 230(c)(1), platforms are generally not treated as the publisher of content posted by their users. Legal claims are normally brought against the person who posted, while platforms are approached through their own reporting rules.

What to do if you have been doxxed

Acting in the right order matters. Evidence comes first, because content can disappear once it is reported.

Prioritize your safety. If there is a threat of violence or someone has appeared at your home, contact local police right away. Tell your employer and family if they may be affected.
Document everything. Take full-page screenshots that show the URL, the date, the account name and any threatening replies. Save links and note when you found each post.
Report the content to the platform. Major platforms prohibit sharing private information. Meta, for example, removes content that shares full private residential addresses or national ID numbers (Meta Community Standards). Use the platform’s privacy or harassment reporting form rather than a generic report.
Ask Google to remove the results. Google accepts removal requests for doxxing content, meaning personal contact information combined with threats or calls to harass, or large amounts of aggregated personal information with no legitimate purpose (Google Search Help). Google only removes results from its search engine, so the page can still exist at its source.
Lock down your accounts. Change passwords, turn on two-factor authentication, review privacy settings and remove old posts that reveal where you live or work.
Talk to an attorney. A lawyer can assess whether a criminal complaint, a civil claim or a court order makes sense where you live, and whether filing deadlines apply.

For a broader walk-through of search removal options, see how to remove negative content from Google.

When doxxing becomes a reputation crisis

For executives, public figures and businesses, doxxing rarely arrives alone. It often comes with a viral thread, coordinated reviews or false claims that spread to news sites and AI search answers. At that point, the legal question is only part of the problem. You also need to decide what to say, to whom and when, while the harmful content is being reported and removed.

Our guides on crisis management and social media crisis management cover how to stabilize the situation and protect your search results while it unfolds.

How Media Removal can help

Media Removal is not a law firm and does not give legal advice. We work alongside you and, when needed, your attorney. Our role is the practical side: finding where your information has spread and getting it taken down through the right channel for each site.

Mapping the exposure. We identify the posts, profiles, people-search listings and search results that show your private information.
Removal at the source. We use each platform’s own reporting rules, privacy policies and, where your attorney pursues them, legal channels. Whether a page comes down is ultimately decided by the platform, the site owner or a court, so we do not promise any particular outcome.
Search results. We submit deindexing requests to Google where its policies allow, and work to push down what cannot be removed.
Crisis support. When doxxing is part of a wider attack, our reputation crisis management team helps you contain the damage and rebuild.

For content removal, you are billed only when the URL is verified offline. Every client signs an NDA, and so do we. We answer within one business day. To discuss your situation, request a quote or learn more about our content removal services.

Frequently asked questions

Is doxxing a federal crime?

Not in general. There is no single federal doxxing law that protects everyone. Federal law makes it a crime to publish the private information of certain covered people, such as federal officers, jurors and witnesses, with intent to threaten or incite violence (18 U.S.C. § 119). Doxxing that is part of a pattern of online harassment or threats can also be prosecuted under the federal cyberstalking statute (18 U.S.C. § 2261A).

Can I sue someone for doxxing me?

In several states, yes. California, Illinois, Washington and Oregon all give doxxing victims a civil claim, with remedies that can include damages, attorney’s fees and court orders to stop the disclosure. In other states, a claim may be possible under harassment, privacy or emotional distress theories. An attorney licensed in your state can tell you which options apply.

Is it illegal to post someone’s address online?

Posting an address is not automatically illegal. It can become illegal when it is done to threaten, harass or endanger the person, or when it is part of a stalking campaign. Many platforms also ban sharing private home addresses under their own rules, even when no law is broken.

Is it doxxing if the information was already public?

It can be. Doxxing laws generally focus on intent and harm, not only on whether each detail was secret. Washington’s doxxing statute, for example, states that prior public availability of the information is not a defense.

Can Google remove doxxing content?

Google accepts removal requests for search results that show your personal contact information together with threats or calls to harass you, or that contain a large amount of aggregated personal information with no legitimate purpose. Google can only remove results from its search engine. To take the page offline, you need to reach the site owner or the platform that hosts it.

What should I do first if I am doxxed?

If you feel unsafe, contact the police first. Then document every post with screenshots that show the URL and date before you report anything, because content can disappear once it is flagged. After that, report the posts to each platform, request removal from Google and speak with an attorney about your legal options.

Sources

Need harmful content taken down?

Tell us where it lives. We review each case and recommend the fastest route that fits it.

Get a quote Content removal services