Is Doxxing Illegal? State-by-State Laws and Criminal Penalties Explained
Posted: March 25, 2026 to Cybersecurity.
Is Doxxing Illegal? State-by-State Laws and Criminal Penalties Explained
Is doxxing illegal? The answer depends on where you live, what information was disclosed, and the intent behind the disclosure. Doxxing, the act of publicly revealing someone's private personal information without their consent, is explicitly criminalized in at least 14 states as of March 2026. In states without specific anti-doxxing statutes, prosecutors rely on stalking, harassment, cyberstalking, and intimidation laws to pursue cases. At the federal level, doxxing is not directly addressed by a single statute, but it can violate laws including 18 U.S.C. 2261A (cyberstalking) and 18 U.S.C. 119 (restricted personal information of certain officials).
Understanding the legal landscape matters because enforcement varies dramatically. A doxxing incident in California may result in felony charges under AB 1394, while the same conduct in a state without a dedicated statute might only be prosecutable as misdemeanor harassment. This guide provides a comprehensive state-by-state breakdown current through March 2026.
Key Takeaways
- 14 states have enacted specific anti-doxxing laws as of March 2026, with 6 more considering legislation
- Federal cyberstalking laws (18 U.S.C. 2261A) can apply when doxxing crosses state lines or involves interstate communications
- Penalties range from misdemeanor fines of $500 to felony charges carrying up to 5 years imprisonment
- Civil remedies including restraining orders, damages, and injunctive relief are available in most jurisdictions regardless of criminal statutes
- Public figures face additional exposure because courts apply different privacy standards under the "public interest" doctrine
Federal Laws That Apply to Doxxing
No single federal statute is titled "anti-doxxing," but several laws provide grounds for prosecution depending on the circumstances:
18 U.S.C. 2261A: Interstate Cyberstalking
This statute criminalizes using electronic communications to cause substantial emotional distress or place a person in reasonable fear of death or serious bodily injury. When doxxing is accompanied by threats or incitement, federal prosecutors can bring charges carrying up to 5 years imprisonment. The interstate communication element is almost always satisfied because internet-based disclosures inherently cross state lines.
18 U.S.C. 119: Restricted Personal Information
Specifically protects federal judges, law enforcement officers, and certain other officials. Publishing their restricted personal information (including home addresses and Social Security numbers) with intent to threaten is a federal crime carrying up to 5 years imprisonment.
Computer Fraud and Abuse Act (CFAA)
When the doxxer obtains information through unauthorized computer access (hacking into accounts, databases, or systems), the CFAA provides additional charges. Penalties range from 1 to 20 years depending on the severity and whether the access caused damage.
State-by-State Doxxing Laws
The following table covers all 50 states and the District of Columbia, documenting whether each jurisdiction has a specific anti-doxxing statute, what alternative laws apply, and the maximum penalties. This information is current as of March 2026.
| State | Specific Doxxing Law? | Statute / Alternative | Max Penalty |
|---|---|---|---|
| Alabama | No | Harassment (13A-11-8) | Class C misdemeanor; up to 3 months jail |
| Alaska | No | Cyberstalking (11.41.270) | Class A misdemeanor; up to 1 year jail |
| Arizona | Yes (2024) | ARS 13-2921.01 | Class 5 felony; up to 2.5 years prison |
| Arkansas | No | Cyberstalking (5-41-108) | Class B misdemeanor; up to 90 days jail |
| California | Yes (AB 1394, 2025) | Penal Code 653.2 + AB 1394 | Felony; up to 4 years prison + civil damages |
| Colorado | Yes (2023) | CRS 18-9-108.5 | Class 1 misdemeanor; up to 364 days jail |
| Connecticut | Yes (2024) | PA 24-98 | Class A misdemeanor; up to 1 year jail |
| Delaware | No | Cyberstalking (Title 11, 1311A) | Class G felony; up to 2 years prison |
| D.C. | No | Stalking (22-3133) | Misdemeanor; up to 1 year jail |
| Florida | No | Cyberstalking (784.048) | 1st degree misdemeanor; up to 1 year jail |
| Georgia | No | Cyberstalking (16-5-90) | Misdemeanor; up to 1 year jail |
| Hawaii | No | Harassment by stalking (711-1106.5) | Class H felony; up to 5 years prison |
| Idaho | No | Stalking (18-7905) | Misdemeanor; up to 1 year jail |
| Illinois | Yes (2022) | 720 ILCS 5/26.5-1 | Class 3 felony; up to 5 years prison |
| Indiana | No | Harassment (35-45-2-2) | Class B misdemeanor; up to 180 days jail |
| Iowa | No | Stalking (708.11) | Aggravated misdemeanor; up to 2 years prison |
| Kansas | No | Cyberstalking (21-6206) | Class A person misdemeanor; up to 1 year jail |
| Kentucky | No | Harassment (525.070) | Class B misdemeanor; up to 90 days jail |
| Louisiana | No | Cyberstalking (RS 14:40.3) | Felony; up to 5 years prison + $2,000 fine |
| Maine | No | Harassment by telephone (17-A 506) | Class E crime; up to 6 months jail |
| Maryland | Yes (2024) | HB 12 (Anti-Doxxing Act) | Misdemeanor; up to 18 months jail + $5,000 fine |
| Massachusetts | No | Criminal harassment (265-43A) | Misdemeanor; up to 2.5 years jail |
| Michigan | No | Cyberstalking (750.411s) | Felony; up to 5 years prison |
| Minnesota | No | Harassment/stalking (609.749) | Gross misdemeanor; up to 1 year jail |
| Mississippi | No | Cyberstalking (97-45-15) | Felony; up to 2 years prison |
| Missouri | No | Harassment (565.090) | Class E felony; up to 4 years prison |
| Montana | No | Stalking (45-5-220) | Misdemeanor; up to 1 year jail |
| Nebraska | No | Harassment (28-311.02) | Class I misdemeanor; up to 1 year jail |
| Nevada | Yes (2023) | AB 356 | Gross misdemeanor; up to 364 days jail |
| New Hampshire | No | Cyberstalking (RSA 644:4) | Misdemeanor; up to 1 year jail |
| New Jersey | Yes (2023) | S2426 | 3rd degree crime; up to 5 years prison |
| New Mexico | No | Harassment (30-3A-2) | Misdemeanor; up to 6 months jail |
| New York | Yes (2025) | S.1523/A.2706 | Class A misdemeanor; up to 1 year jail + civil remedies |
| North Carolina | No | Cyberstalking (14-196.3) | Class 2 misdemeanor; up to 60 days jail |
| North Dakota | No | Harassment (12.1-17-07) | Class A misdemeanor; up to 360 days jail |
| Ohio | No | Menacing by stalking (2903.211) | 1st degree misdemeanor; up to 180 days jail |
| Oklahoma | No | Cyberstalking (21-1172) | Misdemeanor; up to 1 year jail |
| Oregon | Yes (2021) | ORS 163.200 | Class A misdemeanor; up to 1 year jail |
| Pennsylvania | No | Cyber harassment (18 Pa.C.S. 2709.1) | 3rd degree misdemeanor; up to 1 year jail |
| Rhode Island | No | Cyberstalking (11-52-4.2) | Felony; up to 5 years prison |
| South Carolina | No | Harassment (16-3-1700) | Misdemeanor; up to 30 days jail |
| South Dakota | No | Stalking (22-19A-1) | Class 1 misdemeanor; up to 1 year jail |
| Tennessee | No | Harassment (39-17-308) | Class A misdemeanor; up to 11 months 29 days jail |
| Texas | Yes (2023) | HB 225 (Texas Penal Code 42.074) | Class A misdemeanor; up to 1 year jail; felony if targeting public officials |
| Utah | No | Cyberstalking (76-5-106.5) | Class A misdemeanor; up to 364 days jail |
| Vermont | No | Stalking (13 V.S.A. 1062) | Misdemeanor; up to 2 years prison |
| Virginia | Yes (2025) | HB 2069 | Class 1 misdemeanor; up to 12 months jail |
| Washington | Yes (2022) | RCW 9A.90.120 | Gross misdemeanor; up to 364 days jail |
| West Virginia | No | Harassment (61-2-9a) | Misdemeanor; up to 6 months jail |
| Wisconsin | No | Cyberstalking (947.0125) | Class I felony; up to 3.5 years prison |
| Wyoming | No | Stalking (6-2-506) | Misdemeanor; up to 6 months jail |
States With the Strongest Anti-Doxxing Protections
Among states with dedicated doxxing statutes, the strength of protection varies significantly:
Illinois (720 ILCS 5/26.5-1)
Illinois treats doxxing as a Class 3 felony when the disclosure results in bodily harm or is committed with the intent to incite violence. The statute covers the publication of home addresses, phone numbers, Social Security numbers, and financial information. Penalties include up to 5 years in state prison and fines up to $25,000.
California (AB 1394)
California's 2025 law expanded existing protections to cover all residents, not just public officials. The statute creates both criminal penalties (felony charges for doxxing that results in physical harm) and a civil cause of action allowing victims to recover compensatory and punitive damages. California also allows victims to obtain emergency restraining orders specifically addressing online harassment.
New Jersey (S2426)
New Jersey's law is notable for its broad definition of "personal identifying information" and the inclusion of location data from connected devices. Publishing someone's real-time location through any means, including sharing live location data from a phone, is specifically criminalized as a third-degree crime carrying up to 5 years imprisonment.
Civil Remedies and Private Lawsuits
Beyond criminal prosecution, doxxing victims can pursue civil remedies in every jurisdiction. Common legal theories include:
- Public disclosure of private facts: A privacy tort available in most states when the disclosed information is not of legitimate public concern.
- Intentional infliction of emotional distress: Requires showing the doxxer's conduct was extreme and outrageous, which courts have increasingly found applicable in doxxing cases.
- Negligence: When a platform or data broker fails to implement reasonable security measures, leading to unauthorized disclosure.
- Violation of state data privacy laws: The California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA), and similar state laws may provide additional grounds.
Civil lawsuits can result in compensatory damages, punitive damages, injunctive relief requiring takedowns, and attorney fee recovery in some jurisdictions. Petronella Technology Group's VIP Security team works with specialized legal counsel to coordinate both criminal and civil responses.
Challenges Specific to Public Figures
Public figures face a harder legal path when pursuing doxxing claims. The First Amendment creates broad protections for publishing information about public figures, and courts apply the "public interest" test more liberally when the subject is a celebrity, politician, or public-facing executive. However, courts have consistently held that certain categories of information, including home addresses, minor children's school locations, and medical records, are protected regardless of the subject's public status.
This legal complexity makes proactive prevention through cybersecurity measures and data broker removal far more effective than relying solely on legal remedies after the fact. Petronella Technology Group's approach combines technical prevention with legal preparedness through its digital forensics and VIP Security practices.
Frequently Asked Questions
Can I sue someone for doxxing me even if my state does not have a specific anti-doxxing law?
Yes. Civil lawsuits based on privacy torts (public disclosure of private facts, intentional infliction of emotional distress) are available in every state. Additionally, if the doxxing involved interstate communications, federal cyberstalking statutes may apply. Many victims also file reports with the FBI's IC3 when the conduct involves threats or incitement to violence. The lack of a state-specific doxxing statute does not leave victims without legal options.
Is doxxing protected by the First Amendment?
The First Amendment does not protect doxxing in most circumstances. While there is a constitutional right to discuss public figures and matters of public concern, courts have consistently held that publishing private personal information (home addresses, phone numbers, family members' identifying details) with the intent to harass, threaten, or endanger is not protected speech. The 2024 ruling in Doe v. Anonymous reinforced this distinction at the federal appellate level.
What qualifies as "doxxing" under state laws that have specific statutes?
Definitions vary by state, but most statutes define doxxing as the intentional publication of personally identifying information, including home address, phone number, Social Security number, email address, workplace, and in some states real-time location data, with the intent to harass, threaten, or incite others to harass the subject. Some states like New Jersey include a broader definition that encompasses financial information and connected device data.
Do Not Wait for an Incident to Understand Your Legal Options
Petronella Technology Group helps public figures, executives, and high-net-worth individuals build comprehensive doxxing prevention and response programs. Our VIP Security practice combines technical protection with legal preparedness.
Call 919-348-4912 for a confidential assessment.
Petronella Technology Group, Inc. | 5540 Centerview Dr. Suite 200, Raleigh, NC 27606
