Doxing can be illegal in the United States, but it is not automatically unlawful in every situation. The legal result depends on what information was shared, how it was obtained, why it was published and whether the person intended to threaten, harass, intimidate or expose the victim to harm.
There is no single federal law that prohibits every act commonly described as doxing. However, federal and state laws may apply when personal information is published as part of cyberstalking, threats, identity theft, harassment or an attempt to encourage violence.
What Does Doxing Mean?
Doxing generally means finding and publicly sharing someone’s private or identifying information without permission. The information may include:
- A home address
- Personal telephone numbers
- Private email addresses
- Workplace or school details
- Social Security numbers
- Financial information
- Names of family members
- Photographs or real-time locations
Doxing commonly occurs through social media, forums, websites, group chats and mass emails. The purpose may be to frighten someone, damage their reputation, encourage strangers to contact them or make it easier for others to locate them.
Is Publishing an Address Always Illegal?
No. Publishing another person’s address or telephone number is not automatically a crime merely because the person did not provide consent. Some identifying information may already be available through business records, professional websites, property databases or other lawful public sources.
However, the surrounding circumstances are important. Posting an address during an ordinary news report is legally different from posting it alongside threats or instructions encouraging others to confront the resident.
Even publicly available information may become part of criminal conduct when it is distributed with the intent to cause fear, harassment or violence. The fact that information was found online does not provide complete protection when it is republished for a harmful purpose.
Federal Laws That May Apply
Federal law specifically prohibits publishing restricted personal information about certain protected people, including some federal officials, court personnel, jurors, witnesses and informants, when the information is shared with the intent to threaten, intimidate or facilitate a violent crime. Restricted information includes home addresses, telephone numbers, personal emails and Social Security numbers. A violation can carry imprisonment of up to five years.
Federal cyberstalking law may also apply when someone uses an online service or electronic communication system as part of a course of conduct intended to kill, injure, harass or intimidate another person, and the conduct causes substantial emotional distress or a reasonable fear of death or serious injury.
A doxing post containing a threat to kidnap or injure someone may also fall under the federal law governing interstate threats. That law can apply to threatening communications transmitted through interstate or foreign commerce, including many internet-based communications.
State Doxing and Harassment Laws
Several states have laws directly addressing the harmful publication of personal information. Others prosecute doxing through existing stalking, harassment, intimidation or identity-theft statutes.
California Penal Code Section 653.2 makes it a misdemeanour to electronically distribute someone’s identifying information without consent when it is done to place that person in reasonable fear and to cause unwanted physical contact, injury or serious harassment by a third party. A conviction may result in up to one year in county jail, a fine of up to $1,000, or both.
Florida prohibits electronically publishing another person’s identifying information with the intention of encouraging violence or enabling someone to threaten or harass the person in a way that creates a reasonable fear of bodily harm. The offence is classified as a first-degree misdemeanour.
Washington’s cyber-harassment law covers certain electronic communications made with the intent to harass or intimidate. It can apply to threats of bodily injury or property damage and provides increased penalties in some cases involving death threats, repeated offences, protected officials or violations of restraining orders.
Because state laws use different definitions, the same online post may be treated differently depending on where the sender and victim are located.
Can a Doxing Victim File a Lawsuit?
A victim may sometimes bring a civil claim even when prosecutors do not file criminal charges. Possible claims can include invasion of privacy, intentional infliction of emotional distress, defamation, stalking or negligence.
For example, a public-disclosure-of-private-facts claim may be available when someone widely publishes genuinely private and highly offensive information that is not a matter of legitimate public concern. The exact requirements differ by state.
A victim experiencing continuing harassment, stalking or threats may also seek a restraining order. Such an order can prohibit contact and require the person responsible to stay away.
What Should a Victim of Doxing Do?
A victim should preserve screenshots, URLs, usernames, dates, messages and records showing how the information was distributed. The victim can report the content to the relevant social-media platform and request removal.
Immediate threats, attempted violence or suspicious activity near the victim’s home should be reported to law enforcement. Financial institutions should be contacted if bank details, passwords or identity documents were exposed.
Therefore, doxing is not illegal merely because personal information is mentioned online. It becomes far more likely to violate the law when the information is private, unlawfully obtained or published to threaten, stalk, harass, intimidate or encourage others to harm the person.