Doxxing is illegal in some situations, but posting someone's personal information is not automatically a crime in the United States. Federal law has no general doxxing crime that covers everyone. Doxxing can be prosecuted when it is part of a threat or a stalking campaign, or when someone exposes a federal officer or a court witness in order to threaten or intimidate them. Some states have their own doxxing laws, and a few of those let victims sue.
What is doxxing?
Doxxing means publishing someone's private identifying details online, usually so other people can find them, frighten them or hurt them. The word comes from "dropping docs," and you'll see it spelled both doxxing and doxing. Washington's statute uses the one-x spelling. Same thing.
The details that get posted are usually the ones that let a stranger show up at your door or reach you directly: a home address, a cell number, a personal email, the name of your employer, sometimes your kids' school. Often none of it was secret. A determined person can pull an address from property records and a phone number from an old resume, then stitch them together in one post with a message like "you know what to do."
That last part matters a lot legally. The law mostly cares about two things: why the information was posted and what happened next. A reporter publishing a public official's business address and an anonymous account posting a nurse's home address alongside threats can involve the same kind of data. They are treated very differently.
Is it legal to post someone's public information?
Often, yes. Posting information is speech, and the First Amendment limits how far a law can punish speech. The Supreme Court described the worry in its 2023 decision in Counterman v. Colorado: prohibitions on speech "have the potential to chill, or deter, speech outside their boundaries." That case was about threats. It doesn't make every post of public information safe.
State doxxing laws are written with this in mind. Washington's civil doxxing statute carves out information shared while exercising free speech or press rights, or the rights to assemble and associate, that the federal and state constitutions guarantee. The same law also says it is no defense that the information was already public or could be found through research, so "it was in the property records" won't end a Washington case by itself. A protest group posting the office address of a company it is picketing is in a very different position from someone posting a private person's home address with a call to "pay them a visit."
Where the line gets crossed is when the post is combined with something the law already forbids. A threat of violence is the clearest example. A pattern of harassment meant to cause serious emotional distress is another. So is a post aimed at a juror or a federal agent to scare them, or a disclosure that a state statute specifically targets.
Which federal laws apply to doxxing?
No single federal statute bans doxxing in general. Three federal crimes come up most often, and each one has its own limits.
Publishing personal information of protected officials (18 U.S.C. 119)
The closest thing to a federal doxxing law is 18 U.S.C. 119. It makes it a crime to knowingly make "restricted personal information" about a covered person, or a member of that person's immediate family, publicly available. The statute defines restricted personal information as six specific items: Social Security number, home address, home phone number, mobile phone number, personal email and home fax number.
Two limits keep this law narrow. First, the person targeted has to be a covered person. That includes anyone protected under 18 U.S.C. 1114, which covers "any officer or employee of the United States or of any agency in any branch of the United States Government." It also reaches people tied to the courts, including grand and trial jurors and witnesses. Informants and witnesses in federal criminal cases are covered as well, along with state or local officers whose information is exposed because they helped with a federal investigation. A private citizen with no tie to those roles is outside this statute.
Second, intent is required. The person must act with intent to threaten or intimidate, or to incite a violent crime against the covered person or family member, or must intend and know that the information will be used for those purposes. The statute says a violator "shall be fined under this title, imprisoned not more than 5 years, or both."
Cyberstalking (18 U.S.C. 2261A)
The federal stalking law, 18 U.S.C. 2261A, reaches far more people. Its second paragraph covers anyone who, acting with one of the intents the statute lists (harassing or intimidating another person, for example), uses the mail, "any interactive computer service or electronic communication service," or another facility of interstate commerce to carry out a course of conduct that has a certain effect on the victim.
That effect can be placing the person in reasonable fear of death or serious bodily injury to themselves, an immediate family member, a spouse or intimate partner, or even a pet. It can also be conduct that "causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress." A single post probably won't qualify by itself, because the statute speaks of a course of conduct. A doxxing post followed by weeks of messages, fake accounts and contact with the victim's employer looks much more like what Congress described.
Our guide to stalking and criminal threats walks through how these charges usually work at the state level, where most stalking cases are actually prosecuted.
Interstate threats (18 U.S.C. 875)
Under 18 U.S.C. 875(c), it is a federal crime to transmit in interstate or foreign commerce "any communication containing any threat to kidnap any person or any threat to injure the person of another." The penalty written into subsection (c) is a fine, imprisonment of "not more than five years," or both. Posting someone's address with a message saying you'll come hurt them can fall here if the message traveled across state lines.
A different subsection, 875(d), covers threats to injure someone's property or reputation made with intent to extort money or "other thing of value." A message demanding payment to keep someone's information offline can raise that issue, depending on what exactly was threatened.
When does a doxxing post become a true threat?
A "true threat" is speech the First Amendment does not protect. In Counterman, the Supreme Court described true threats as "serious expression[s]" conveying that a speaker means to "commit an act of unlawful violence." Obvious jokes and angry venting usually don't qualify.
The case itself had nothing to do with addresses. Billy Counterman sent hundreds of Facebook messages to a local musician he had never met, and he kept creating new accounts after she blocked him. Colorado convicted him under its stalking law using a test that asked only how a reasonable person would read the messages.
The Court vacated the state appeals court judgment that had upheld his conviction, and it set a floor. The government must prove the speaker had some awareness of the threatening nature of what he said, and recklessness is enough. In the Court's words, "The State must show that the defendant consciously disregarded a substantial risk that his communications would be viewed as threatening violence."
For doxxing, this cuts both ways. Someone who posts a person's home address with a skull emoji and "see you soon" can't escape a threats charge just by saying he didn't mean it, if he knew there was a real chance people would read it as a threat and posted anyway. On the other hand, a post that a reasonable reader might find menacing, written by someone who truly had no awareness of that risk, can't be punished as a true threat. Counterman sets this as a constitutional minimum. Individual statutes, including federal ones, may require more.
Is swatting a federal crime?
Swatting is often the next step after doxxing. The FBI describes it as "the malicious tactic of making hoax calls or reports to emergency services, typically feigning an immediate threat to life." The caller uses the victim's posted address, and armed officers arrive expecting a life-threatening emergency.
Swatting can be a federal crime. The main federal hoax statute is 18 U.S.C. 1038, which punishes conduct intended "to convey false or misleading information under circumstances where such information may reasonably be believed," when the false information describes activity that would violate certain listed federal criminal chapters and sections. Whether a particular hoax call fits depends on what the caller falsely reported, and prosecutors may use other federal or state laws instead. Section 1038(b) also makes the person who did it "liable in a civil action to any party incurring expenses incident to any emergency or investigative response."
A threat made during the hoax call can also bring in 875(c). States add their own tools. Oregon, for example, lets a person sue anyone who "knowingly causes a police officer to arrive at a location to contact another person" with improper intent, such as intent to make that person feel harassed or to infringe their constitutional rights (ORS 30.845). Check your own state's false-report and emergency-call laws, which vary.
Which states have doxxing laws?
Some states have passed laws aimed squarely at doxxing, and they differ a great deal. Some are civil, giving the victim a right to sue. Others are criminal and protect only certain groups. We are not aware of a reliable official count, and whether your state has one varies, so check. Here are three examples we read on the states' own legislature websites, current as of November 2026.
Publication without express consent, with intent or knowledge the information will be used to harm, or reckless disregard of that risk, plus a resulting injury such as mental anguish or substantial life disruption
Knowing disclosure with intent to stalk or harass the plaintiff (or to injure), no consent, actual harm, and harm a reasonable person would also suffer
Crime (misdemeanor; gross misdemeanor in some cases)
Peace officers, law enforcement agency employees and their family or household members
Knowingly making personal information public without consent when it poses an imminent and serious threat the person knows or reasonably should know about
Look at how differently those are built. Washington accepts reckless disregard and lists "mental anguish" as an injury. Oregon requires intent and a showing that a reasonable person would have been harmed too. Minnesota is a criminal law, but only for law enforcement and the people they live with. A post that breaks one of these laws might not break the others, and your state may have no comparable law at all. If you're dealing with doxxing, search your own state legislature's website for terms like "personal information" and "disclosure," or ask the local prosecutor's office what applies.
Can you sue someone for doxxing you?
Sometimes. In Washington and Oregon, the statutes above create a direct claim. Washington lets the victim sue the person who published the information and anyone who knowingly benefits from a venture they knew or should have known was violating the law. Oregon allows economic and noneconomic damages, punitive damages, an injunction and attorney fees, and sets a deadline: the action must be filed within two years of the conduct.
Outside those statutes, victims usually look to older civil claims, such as privacy claims for public disclosure of private facts, or claims for intentional infliction of emotional distress. Whether these exist in your state, and what they require, varies from state to state, and they can be hard to win when the information was technically public. If the doxxer also spread false statements about you, a defamation claim may fit; our article on suing for defamation and emotional distress explains the basics.
A practical problem sits underneath all of this. Many doxxers are anonymous. Finding out who ran an account usually means filing a lawsuit and asking the court to let you subpoena the platform, which takes time and money.
Can you sue the website or platform?
Usually not for what a user posted. Federal law at 47 U.S.C. 230(c)(1) says no provider or user of an interactive computer service "shall be treated as the publisher or speaker of any information provided by another information content provider." In plain terms, the social network that hosted the doxxing post generally isn't legally treated as the one who said it.
Two other parts of Section 230 matter here. Subsection (c)(2) protects platforms that take good-faith steps to remove material they consider harassing or "otherwise objectionable." So a site that takes your doxxing report seriously and deletes the post is on safe legal ground. Section 230 also does nothing for the person who wrote the post, because its protection covers information provided by someone else. And subsection (e)(1) says the law does not impair enforcement of "any other Federal criminal statute."
What should you do if you've been doxxed?
Move fast. Information spreads quickly once it's posted, and evidence disappears when accounts get deleted.
If you believe you're in immediate danger, call 911. The FBI's Internet Crime Complaint Center says the same: "If you or someone else is in immediate danger, please call 911 or your local police."
Document everything before reporting it. Take screenshots that show the full post, the account name, the date and the web address. The FBI's swatting alert tells targets to keep related usernames, email addresses and websites, along with any photos or videos. Save threatening messages in their original form too.
Report the post to the platform using its harassment or private-information reporting tool. Ask for removal and keep the confirmation.
File a police report with your local department, and bring your screenshots. If the post includes threats, say so plainly. Our guide on whether police can arrest someone for threatening you explains what officers look for.
Report to the FBI. The FBI's public service announcement on swatting lists tips.fbi.gov, 1-800-CALL-FBI and your local field office. The Internet Crime Complaint Center calls itself the "central hub for reporting cyber-enabled crime" and encourages people to file even when unsure whether their complaint qualifies.
Lock down your accounts. The FBI recommends "strong, unique passwords, and multi-factor authentication," including on smart home devices, and suggests reviewing your online presence for sensitive personal information.
Think about swatting risk. The FBI suggests planning ahead with family members or colleagues for possible police contact at your home or business. Some people also call their local police non-emergency line to let them know a hoax call is possible.
Ask about a protective order. If the doxxer is someone you know or can identify, a civil protective or stalking order may be available in your state. The steps are laid out in how to get a restraining order.
If your Social Security number or financial details were exposed, treat it as identity theft too, and consider freezing your credit.
What if you're accused of doxxing?
Take it seriously, but don't assume the worst. Most of these laws turn on intent and on what happened after the post, so the details of your situation matter.
Start with the elements, because each law above has its own. Section 119 only applies if the person was a covered official or witness and you meant to threaten or intimidate them. Cyberstalking needs a course of conduct, so one post is a harder case for prosecutors than a months-long campaign. For a threats charge, Counterman means the government has to show you at least consciously disregarded the risk that your words would be read as threatening violence. The state laws in the table have their own consent and intent rules.
Then look honestly at what you did. Information that was already widely published, shared as part of commentary on a public issue, is in a much stronger position than an address posted with a call to action, and contacting the person afterward makes things worse.
Practical steps help too. Don't delete posts or accounts once you know about an investigation, because destroying evidence can create a separate problem. Don't contact the person who complained. If a protective order is served on you, follow it exactly, even if you think it's unfair; our article on violating a protective or no-contact order explains why. If police want to question you, you can decline to talk without a lawyer present. See what to do if you're arrested for more on that right.
This article is general information, not legal advice. Doxxing laws change and vary by state, so check the official statute or talk with a licensed attorney in your state.
Frequently asked questions
Is doxxing a federal crime?
There is no general federal doxxing crime that covers everyone. Federal law at 18 U.S.C. 119 makes it a crime to publish certain personal information about covered people, such as federal officers or witnesses in federal cases, with intent to threaten or intimidate them. Doxxing can also be part of federal cyberstalking under 18 U.S.C. 2261A or an interstate threat under 18 U.S.C. 875(c).
Is it illegal to post someone's address online?
Not by itself in most situations. Posting an address can become illegal when it comes with a threat or is part of a stalking campaign. It is also a federal crime to expose a covered person, such as a federal officer, with intent to threaten or intimidate them. Some state laws target harmful disclosures too, and Washington's says it is no defense that the information was already public.
Can I sue someone for doxxing me?
Possibly. Washington (RCW 4.24.792) and Oregon (ORS 30.835) give doxxing victims a statutory right to sue, and Oregon's claim must be filed within two years. Elsewhere, victims may look to privacy or emotional distress claims, which vary by state. If the doxxer is anonymous, you may need a court order to learn who ran the account.
Can I sue a social media site over a doxxing post?
Usually not for the post itself. Under 47 U.S.C. 230(c)(1), a platform is not treated as the publisher or speaker of what its users post. Section 230 also protects platforms that remove harassing material in good faith, so reporting the post to the platform is often the faster route to getting it taken down.
What is the difference between doxxing and swatting?
Doxxing is publishing someone's personal information, like a home address. Swatting is using that kind of information to make a hoax report to emergency services so armed police respond to the victim's location. The FBI describes swatting as making hoax calls or reports to emergency services, typically feigning an immediate threat to life.
Where do I report doxxing to the FBI?
The FBI's 2025 swatting alert lists tips.fbi.gov, 1-800-CALL-FBI and your local FBI field office for reporting threats and criminal activity. The FBI's Internet Crime Complaint Center at ic3.gov accepts reports of cyber-enabled crime. If you are in immediate danger, call 911 first.
Does a doxxing post count as a threat if the poster was joking?
It depends on what the poster knew. In Counterman v. Colorado (2023), the Supreme Court held that punishing a statement as a true threat requires proof of at least recklessness, meaning the speaker consciously disregarded a substantial risk that the words would be seen as threatening violence. Claiming it was a joke does not help if the poster was aware of that risk.
Can I get a restraining order against someone who doxxed me?
Often, if you can identify the person and your state's protective order or stalking order law covers the conduct. The rules on who qualifies and what proof is needed are set by each state. When you apply, bring your screenshots and a dated log of what happened to the court clerk or a local victim advocate.
18 U.S.C. 119: Crime to knowingly make restricted personal information (SSN, home address, home or mobile phone, personal email, home fax) about a covered person (18 U.S.C. 1114 federal officers and employees and those assisting them, federal jurors, witnesses and court officers, informants and witnesses in federal criminal matters, certain state or local officers aiding federal investigations) or immediate family publicly available with intent to threaten, intimidate or incite a crime of violence, or with intent and knowledge it will be used to threaten, intimidate or facilitate one; up to 5 years.
18 U.S.C. 2261A(2): Federal cyberstalking: course of conduct using interactive computer service with listed intent causing reasonable fear or substantial emotional distress.
18 U.S.C. 875(c), (d): Interstate threats to kidnap or injure (c, up to five years); threats to property or reputation made with intent to extort (d).
18 U.S.C. 1038(a)(1), (b): False information and hoaxes describing activity that would violate listed federal chapters and sections; civil liability for emergency response costs. Reaches a swatting call only when the false report describes a listed offense; swatting may also be charged under other federal or state laws.
47 U.S.C. 230(c)(1), (c)(2)(A), (e)(1): Platform not treated as publisher of user posts; good-faith removal protected; no effect on federal criminal law.
Counterman v. Colorado, No. 22-138 (U.S. June 27, 2023): True-threats prosecutions require proof that the speaker had some subjective understanding of the threatening nature of the statements; recklessness is enough. Does not address doxxing as such.
Wash. Rev. Code 4.24.792 (2023 c 381): Civil action (not a crime) for publishing personal identifying information without express consent with intent, knowledge or reckless disregard of harm, causing listed injury; prior public availability is not a defense; free-speech and other exemptions.
Or. Rev. Stat. 30.835 (2021 c.300; 2025 c.2) and 30.845 (2019 c.415): Civil actions (not crimes). 30.835: knowing disclosure of personal information with intent to stalk, harass or injure, no consent, actual harm a reasonable person would also suffer; two-year limit. 30.845: action against one who knowingly causes police to arrive to contact another person with listed improper intents.
Minn. Stat. 609.5151 (2026): Crime: misdemeanor (gross misdemeanor on great bodily harm or death, or a repeat conviction) to knowingly and without consent make personal information about a law enforcement official or family or household member publicly available when it poses an imminent and serious threat the person knows or reasonably should know of.
18 U.S.C. 1114: Identifies the federal officers and employees (and those assisting them) who are covered persons under 18 U.S.C. 119(b)(2)(A).
This article is general legal information, not legal advice, and may not reflect the most current law or the law in your jurisdiction. Laws vary by state and change over time. For advice about your specific situation, consult a licensed attorney.
Knowing your rights is the first step
Join thousands committing to calmly and consistently exercise their constitutional rights.
