Here’s the misconception that trips up a lot of people, including plenty who think they’re in the clear. Someone’s home address, employer, or phone number often technically counts as findable, public information. But courts don’t treat “the information was technically public” as a defense once intent enters the picture. Publishing that same information specifically to encourage harassment, intimidation, or physical confrontation is a completely different legal category, regardless of how easily you could have found the details through a basic search.
Why Intent Is the Hinge Everything Swings On
Picture two nearly identical scenarios. Someone shares an ex-partner’s workplace in a neighborhood Facebook group with no accompanying message. That alone often doesn’t cross a legal line. Now picture that same person sharing the identical workplace information alongside a message calling their ex dangerous and asking neighbors to confront them directly. That second version hands prosecutors exactly the evidence of intent they need to bring charges. The information posted can be word-for-word identical; what changes everything is the purpose behind sharing it.
There’s No Single Federal “Doxxing” Law, and That’s Genuinely Confusing
This is worth stating plainly because it surprises almost everyone researching this topic. Congress has never passed one specific federal statute that names doxxing as a crime. Instead, federal prosecutors reach for a patchwork of existing tools depending on the specific facts. The federal stalking statute under 18 U.S.C. § 2261A covers using electronic communications to stalk, harass, or intimidate someone across state lines, which catches a lot of interstate doxxing cases automatically since most online posting crosses state borders by default. A separate statute, 18 U.S.C. § 119, specifically protects federal officials, jurors, and witnesses from having their information published with intent to threaten them.
Which States Actually Name Doxxing in Their Statutes
As of 2026, roughly 17 states have standalone anti-doxxing laws, though only three, Alabama, California, and Illinois, actually use the word “doxxing” directly in their statutory language. California got here first, back in 2008, with Penal Code 653.2 criminalizing the publication of personal information with intent to cause unwanted contact or harassment, well before the term “doxxing” had even entered mainstream vocabulary. A second wave followed after 2020, with Kentucky, Nevada, Arizona, and Colorado all passing specific doxxing legislation within a couple of years of each other, reflecting how quickly this became a legislative priority as online harassment campaigns became more visible and more damaging.
States Without a Named Law Still Prosecute This Effectively
Roughly a dozen additional states, including Florida, Oregon, Virginia, and Washington, criminalize the same underlying conduct without ever using the word “doxxing” in their books. And even states with neither approach generally fold doxxing into existing cyberstalking, harassment, or intimidation statutes. Texas is a clear example here; the state has no doxxing-specific law, but its general harassment statute under Penal Code 42.07 covers electronic communications intended to harass, which prosecutors apply to doxxing cases without needing a separate, purpose-built law at all.
The Worst-Case Escalation: Swatting
This is where doxxing stops being a privacy violation and becomes something with genuine, immediate physical danger attached. Swatting is when someone uses a victim’s leaked address to place a fake emergency call, deliberately triggering an armed police response at that address. No federal statute mentions “swatting” by name specifically, but prosecutors have real tools available regardless. The federal hoax statute under 18 U.S.C. § 1038 punishes conveying false emergency information with up to five years in prison, and that number climbs substantially if someone is injured or killed as a result. Real sentences reflect how seriously courts treat this connection between doxxing and swatting; beyond the 2019 case that resulted in a 20-year federal sentence after an innocent man was killed, a 2025 case saw someone sentenced to four years for orchestrating over 375 separate swatting calls nationwide.
What Happens If the Doxxer Obtained Your Information Illegally
If someone got your private information through unauthorized computer access, hacking an account, breaking into a database, or similar methods, rather than simply piecing together publicly available details, that opens up an entirely separate federal charge under the Computer Fraud and Abuse Act. This matters because it means the legal exposure for a doxxer can stack; they might face state harassment charges for publishing the information and a completely separate federal computer crime charge for how they obtained it in the first place.
Your Civil Options Beyond Criminal Prosecution
Even in situations where criminal charges don’t move forward, victims of doxxing generally retain the ability to sue in civil court. Common legal theories include intentional infliction of emotional distress and public disclosure of private facts, and where a specific state anti-doxxing statute exists, that can support its own separate civil claim as well. Success in these cases depends heavily on being able to actually identify the person responsible, documenting the real harm that resulted, harassment, job loss, relocation costs, and understanding what your specific state’s law requires to prove the claim.
What New York’s 2026 Changes Show About Where This Is Heading
New York’s recent legislative update made doxxing an explicit criminal offense under state law, specifically layering additional protection on top of existing federal tools like the Computer Fraud and Abuse Act. This kind of state-level clarification reflects the broader national trend: rather than states slowing down enforcement or narrowing these laws, nearly every legislative update since 2021 has moved in the direction of more specific statutes and stronger penalties, not fewer.
FAQs
Q1. If someone’s address is already publicly listed online, is it automatically legal for me to repost it anywhere I want?
Not necessarily, since courts focus heavily on your intent and the context of the post rather than simply whether the information was technically findable elsewhere, meaning reposting it alongside a harassing message can still be illegal.
Q2. Can I be charged federally for doxxing someone who lives in a different state than me?
Yes, this is actually one of the more common paths to federal charges, since the federal stalking statute specifically covers using electronic communications to harass or intimidate someone across state lines.
Q3. Does it matter if the information I posted turned out to be inaccurate?
Potentially yes, in a different direction; inaccurate information shared with harmful intent can add defamation exposure on top of any harassment or doxxing-related charges, since you’re now dealing with both a privacy violation and a false statement.
Q4. If I’m the victim of doxxing, is there anything urgent I should do beyond reporting it to platforms?
Documenting everything immediately, screenshots, timestamps, and any resulting harassment, genuinely matters for both criminal reporting to police and any future civil claim, since proving the connection between the original post and subsequent harm is often the hardest part of these cases.
