Cyberbullying as a Federal and State Criminal Offense

Cyberbullying can be a federal or state criminal offense, but the label alone tells little about criminal liability. With no single federal cyberbullying statute, the answer depends on the conduct, the applicable law, and the state involved. Different laws cover threats, stalking, harassment, and image distribution. Understanding that patchwork is essential because the same online behavior can produce very different consequences.

Why no federal cyberbullying law exists and what fills the void

Someone harmed online quickly encounters a frustrating problem. There is no single federal cyberbullying law to point to, even when the harm is clear. Instead, the person must describe conduct that fits an existing offense, such as threats, harassment, stalking, impersonation, or unlawful image distribution. “Cyberbullying” describes a problem, but it is not a universal charge sheet.

Even the term has no agreed legal definition. Canadian educator Bill Belsey is credited with coining it around 2003, although earlier uses have been documented as far back as 1995–1998. That uncertainty reflects a wider mismatch between evolving online communication and laws often written before the internet. First Amendment concerns and debates over federal and state authority have also limited a national response. The gap is not merely a forgotten item on Congress’s to-do list.

Congress took up the Megan Meier Cyberbullying Prevention Act and the Tyler Clementi Higher Education Anti-Harassment Act, but neither became law. Both stalled over free speech concerns, including fears that they would cover too much. Existing criminal statutes therefore supply much of the enforcement framework. Those laws can punish specific acts without making everything people call cyberbullying a crime.

How federal statutes reach cyberbullying indirectly, and where they stop

Under 18 U.S.C. § 875, transmitting a threat across state lines can lead to imprisonment, but the communication must qualify as a true threat. Cruelty alone does not meet that test.

The federal cyberstalking statute, 18 U.S.C. § 2261A, covers electronic conduct that causes substantial emotional distress or a reasonable fear of death or serious bodily injury. The conduct can come under federal law when it crosses state lines, uses internet infrastructure, or targets someone on federal property. First-time offenders face up to five years in prison. For cases involving children, 18 U.S.C. § 2252 provides a separate route by criminalizing distribution of visual depictions of minors under 18 engaged in sexually explicit conduct, regardless of state lines.

School duties run on a different track. Title IX, Title VI, and Section 504 of the Rehabilitation Act require federally funded schools to address online harassment based on sex, race, national origin, or disability. The U.S. Department of Education’s Office for Civil Rights enforces those duties through administrative remedies.

The Supreme Court’s 2021 decision in Mahanoy Area School District v. B.L. adds another boundary. The Court recognized limited school authority over some off-campus student speech, but ruled against the school and left the precise limits unresolved. School authority is not a blank check. Meanwhile, a cruel post, repeated peer mockery, or exclusion from group chats rarely meets federal criminal thresholds, leaving state law as the main enforcement terrain for most incidents.

How state laws became the primary enforcement mechanism, and why they diverged so sharply

Every state has an anti-bullying law, but that does not mean every state has created the same crime. Most explicitly address electronic communication, while others reach online conduct through offenses that do not use the cyberbullying label. School rules form another layer of protection. All states except Montana require school districts to maintain anti-bullying policies, but a policy requirement and a criminal prohibition do different work.

The divergence begins with how legislatures classify the problem. Some create a standalone cyberbullying offense, while others fold digital conduct into harassment or stalking statutes. States also differ over whether criminal penalties attach directly or follow failed school-level intervention. States also choose how much power schools have over digital conduct that takes place off campus. Each choice changes the route from a complaint to a possible sanction.

A state that starts with school intervention organizes its response differently from one that starts with a criminal offense. Likewise, extending school authority beyond campus does not automatically broaden the criminal code. The patchwork reflects state autonomy over definitions, enforcement, and punishment.

What the variation looks like in practice — four state models compared

Texas places the conduct within harassment law. Texas Penal Code § 42.07 prohibits repeated electronic communications sent in a manner reasonably likely to harass, annoy, alarm, abuse, torment, embarrass, or offend. It also addresses repeated website or social-media communications reasonably likely to cause emotional distress, abuse, or torment, with an exception for communications connected to a matter of public concern. School authority extends beyond campus as well. David’s Law reaches off-campus cyberbullying that interferes with educational opportunities or substantially disrupts a classroom, school, or school-related activity.

California Penal Code § 653.2 makes electronic harassment a misdemeanor when identifying information or harassing messages are distributed to incite third parties to harass someone, with intent to place that person in reasonable fear for their safety. The mechanism is important here. This provision addresses using others to harass a target, while felony cyberstalking can bring up to three years in state prison, or five under aggravated circumstances. Victims may also ask for restraining orders and civil damages.

Illinois treats severe online conduct as a felony. Its criminal harassment statutes apply to online threats of immediate or future bodily harm. Cyberstalking involving credible threats or conduct causing someone to fear for their safety is a Class 4 felony. The emphasis is on threats and fear. That approach places the most serious behavior within the criminal framework rather than treating it solely as a school-policy violation.

New York’s pending Assembly Bill A2641 would move conduct previously lacking a standalone criminal charge from administrative treatment toward criminal framing. The distinction is essential for anyone assessing current exposure. A pending bill shows what lawmakers want to change, but no one can be charged under it yet. Together, these models show different theories of where online abuse belongs, rather than a league table of tougher and softer states.

What determines whether conduct is a misdemeanor, a felony, or not criminal at all

Within a jurisdiction, four factors commonly drive escalation from misdemeanor to felony, including prior criminal history, severity, victim vulnerability, and measurable harm. The statute still controls the result. Credible death threats, sexual exploitation of minors, stalking that makes someone fear for their safety, and repeated violations of protective orders can lead to serious criminal charges.

A hurtful or offensive post is not automatically criminal, even when its effects are painful. For these laws to apply, the conduct must involve things such as threats, intimidation, fear, or substantial emotional distress. The platform does not settle that question. Nor does adding “cyberbullying” to a complaint replace proof of the conduct and harm the statute requires.

A school may investigate and sanction behavior even when police find no crime, while prior school discipline does not rule out prosecution. Civil claims can also be brought without a criminal conviction first. They also use a lower proof standard. Civil liability can rest on a preponderance of the evidence, while a criminal conviction must rest on proof beyond a reasonable doubt.

What the Megan Meier case exposed about the limits of shoe-horning

United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009), showed the cost of trying to use a law for new conduct that it did not fit. Missouri prosecutors said there was insufficient evidence to charge Lori Drew over her role in the cyberbullying of her 13-year-old neighbor, Megan Meier, who died by suicide. Federal prosecutors instead used the Computer Fraud and Abuse Act. The charge depended on computer access. That choice made the mismatch between the alleged harm and the available law unavoidable.

A jury initially found Drew guilty of three misdemeanor counts of illegally accessing a protected computer. U.S. District Judge George Wu then acquitted her of all federal criminal charges. The case ended without a conviction. It became a defining example of prosecutors trying to “shoe-horn” cyberbullying into legislation never designed for it, with the limits of that approach exposed in court.

Later cases sharpened the dispute over responsibility for harmful words. Michelle Carter and Inyoung You were both held responsible for deaths linked to their electronic communications. Their cases raised the question of when punishment for words crosses a constitutional boundary. The Massachusetts Supreme Judicial Court rejected Carter’s free speech arguments. That result showed that speech protection is not absolute, without resolving how a broader cyberbullying law should be drawn.

The First Amendment barrier that keeps federal legislation stalled

A broad federal law would face a difficult drafting problem. It would need to capture harmful conduct without turning protected expression into a crime. The everyday meaning of cyberbullying spans threats, humiliation, insults, exclusion, and persistent abuse, but those acts do not occupy the same constitutional ground. A single umbrella definition can cover too much. Narrowing it enough to protect speech can also exclude conduct lawmakers want to address.

That tension stalled the Meier and Clementi proposals. Harassment, credible threats, and conduct causing imminent harm can be criminalized, while opinions, insults, and cruel but non-threatening speech generally cannot. The line remains contested in litigation and varies by jurisdiction. Protected speech is therefore a real defense under existing laws.

The strongest objection deserves to be taken seriously. A loosely drafted statute could expose ordinary online expression to criminal prosecution because someone found it harmful or offensive. Yet a narrowly written law may fail to cover acts that cause serious harm. Political agreement about the problem does not solve that constitutional design challenge. The unresolved task is to define a punishable offense without making criminal law the moderator of every ugly argument online.

What the patchwork means for victims, the accused, and anyone trying to apply the law

Geography can change the legal outcome substantially. Repeated threatening messages sent to a minor may support a felony in one state, a misdemeanor in another, only school discipline elsewhere, or no enforceable charge if the applicable threshold is unmet. For victims, the practical lesson is to document what happened, how often it happened, and what harm followed. Evidence is more useful than finding the perfect label. Schools, platforms, and law enforcement need that record to assess which rules or laws apply.

Conduct described as online speech can still support harassment, stalking, or threat charges with serious penalties. Available defenses, including free speech arguments, depend on the jurisdiction and the conduct. Meanwhile, states are adding criminal penalties to frameworks previously centered on school policy. The pending New York bill illustrates that direction without establishing what will become law.

A 2026 barometer of cyberbullying victims found that nearly 31% reported humiliating AI-generated content, particularly deepfakes. Most existing statutes were not expressly drafted for that category, and the supplied findings do not establish how those statutes are being applied to it. For parents, educators, attorneys, and policymakers, a reliable legal answer still begins with the specific behavior and the state where it occurred.