Doxxing Legality by US State and Federal Law

Doxxing legality under US state and federal law depends on jurisdiction, victim class, intent, and available remedies (not a single national rule). For security teams and counsel, that legal map is the starting point for assessing exposure and response options. A state can have an anti-doxxing law and still offer no protection to the person whose address just appeared online.

Why "is doxxing illegal?" is the wrong question to ask

Doxxing is the malicious publication of someone’s personal information online. The same home address can sit at the center of a felony, a misdemeanor, a civil claim, or conduct not clearly covered by a doxxing statute. The applicable law, the person targeted, and the circumstances of disclosure govern how the disclosure is treated.

Intent is a threshold issue because neutral disclosure and publication meant to enable harassment can involve identical information. Public availability does not resolve that distinction. A useful assessment therefore asks what was shared, why it was shared, and which state’s law applies. It then asks whether the victim qualifies for protection and who can take legal action. “Is it illegal?” skips most of the work.

What the federal layer actually covers — and what it leaves out

Federal law reaches doxxing mainly through statutes aimed at adjacent harms. 18 U.S.C. § 2261A covers interstate stalking using electronic means, while 18 U.S.C. § 875(c) covers transmitting threats across state lines. Both require more than publication of personal information. Most victims therefore have no direct federal cause of action for doxxing itself.

The TAKE IT DOWN Act is now law and offers narrow protection against the sharing of nonconsensual intimate images, including AI-generated deepfakes. It requires platforms to remove covered content within a short window after a valid notice.

Federal prosecution of typical doxxing cases remains rare. The FBI and US Attorneys’ offices prioritize credible threats of violence, serial offenders, and targeting of federal personnel. Federal law offers a fallback only when the conduct falls under a federal offense. The next step is to check state law, where who is covered and what remedies they have vary.

How state legislatures have structured the patchwork — three tiers, not one rule

State approaches fall into three tiers, beginning with standalone statutory treatment that explicitly defines doxxing. As of June 2025, Alabama, California, and Illinois occupied that group. Illinois provides a civil claim. Alabama HB 287 (2023), by contrast, requires electronic publication of personal identifying information with intent that others use it to harass or harm, followed by actual harassment or harm.

The second tier reaches the conduct through standalone provisions without explicitly defining “doxxing.” Kentucky uses “dissemination of personal information on the internet,” while Florida uses “cyberintimidation by publication.” The label is not the legal test. Washington HB 1335 (2023) illustrates the proof burden through three requirements that must all be met. Publication must occur without consent, involve intent or knowledge that the information will be used to harm, and cause physical injury or fear of bodily injury.

The third tier adapts existing harassment, stalking, or threat laws. Arizona and Connecticut took this route through amendments. Here, a pattern of conduct can become central to the analysis, and a one-time disclosure may not satisfy the applicable requirements. One post is not necessarily a pattern. These tiers organize the map, but they do not yet answer whether a particular victim can use it.

The protected-class gap that leaves most corporate victims outside the statute

For executive protection teams, victim eligibility is the first substantive checkpoint. Seven states explicitly limit anti-doxxing protections to particular public-sector officials, namely Alabama, Colorado, Delaware, Minnesota, New Jersey, Oklahoma, and Pennsylvania. The groups these laws protect often include judges, law enforcement officers, and election officials. Corporate executives do not qualify simply because their exposure is serious. A law’s guest list can be surprisingly short.

Delaware shows how narrow that list can be. Its provision protects judicial officers, defined as active, formerly active, or retired judges and justices, and their family members. A corporate executive in Delaware has no recourse under that provision merely by being an executive. Counsel would instead need to look at stalking, harassment, or another privacy provision. “The state has a doxxing law” is therefore not a sufficient intake conclusion.

That eligibility check keeps an executive protection program from relying on a legal route its principal cannot use. It also separates two different problems. A victim may fall outside the statute entirely, or qualify for protection but face difficulty proving intent and pursuing a cross-jurisdictional case. The first is a coverage problem. The second is an enforcement problem. Neither disappears because the threat is urgent.

Criminal-only versus criminal-plus-civil — how the remedy structure changes who can act and when

Once coverage is established, the next question is who can act. Under a criminal-only doxxing statute, the first step for the victim is to refer the case to law enforcement. There is no private right to sue under that statute itself, and the victim does not control prosecution priorities or pace. Civil provisions create a separate route. They let an eligible victim bring a claim without waiting for prosecutors to move.

California has both tracks through Penal Code 653.2 and AB 1979, which took effect on January 1, 2025. The latter lets victims bring civil suits for substantial damages, including for pain and suffering, plus court and attorney fees. Illinois’s Civil Liability for Doxing Act likewise creates civil liability, allowing damages, attorney’s fees, and injunctive relief. That distinction changes the available response more than a dramatic maximum sentence does.

Kentucky applies graduated Class D through Class B felony penalties when doxxing results in physical injury, serious physical injury, or death to the victim, family, or household members. Arizona sets a Class 1 Misdemeanor with a short jail term and modest fine. Nevada and Washington cap gross misdemeanor exposure at under one year, with Washington allowing a higher maximum fine. Those penalties set out the punishment an offender could face but say nothing about how soon a victim can get help.

What Moriarty v. Gondek shows about how civil doxxing liability actually works in court

Moriarty v. Gondek, No. 2024 LA 651 in Will County, puts the Illinois civil framework into concrete terms. Judge Brian Barrett issued a ruling on March 19, 2026, awarding tens of thousands of dollars to Ellen Moriarty. She was a field technician for the Will County Clerk’s Office, responsible for making sure election equipment worked correctly. The incident involved fabricated content. That distinction broadens the practical picture of a doxxing incident.

Michael Gondek, the former Homer Township collector, allegedly created a fabricated screenshot of Moriarty’s Facebook page. It was designed to make it appear that she had endorsed the July 2024 assassination attempt against President Donald Trump. He shared it in a group chat with other Will County elected officials, who accepted the screenshot as authentic, then passed it to the Will County clerk. Real-world employment harm followed the incident. The attorney-fee provision also reduced the cost barrier to bringing suit.

The case illustrates civil doxxing liability at the boundary with disinformation. The Illinois framework reaches manipulated and AI-assisted content as well as accurate personal information republished with harmful intent. That does not mean this screenshot was AI-generated. The practical significance is narrower and clearer than that claim would be. A civil doxxing assessment cannot stop at asking whether the disclosed material was true.

The First Amendment constraint that limits how far legislatures can go

Broader coverage also creates a genuine First Amendment problem. Personal information may already be public, and sharing it may be part of journalism, whistleblowing, or public-interest advocacy. A law written to catch harmful exposure can also catch protected speech. Political speech makes the tension especially sharp.

Georgia Senate Bill 27, sponsored by Sen. John Albers, illustrates the difficulty. The proposal would have criminalized distributing personal information in a way that could cause meaningful economic losses or leave a victim scared. “Reckless disregard” would have been enough for the lower-level misdemeanor offense. The Georgia First Amendment Foundation argued that this provision was unconstitutionally overbroad and could chill protected speech, including journalism.

Specific intent to harm, named categories of protected information, and concrete harm requirements help distinguish targeted abuse from protected disclosure. Vague or overbroad statutes risk invalidation, leaving victims without a remedy they expected to use. Broader wording is not automatically stronger protection. For practitioners, the durability of a legal route belongs in the assessment with its apparent reach.

Where the law is moving — pending federal bills and the states to watch

The 2025–2026 legislative wave shows that the map is still being redrawn. But the major federal proposals discussed here are still pending, so their proposed penalties are not yet law. State amendments also need to be distinguished from proposals, because an enacted change can expand coverage without creating a newly named doxxing offense.

Senator Marsha Blackburn introduced S. 1952, the Protecting Law Enforcement from Doxxing Act, on June 4, 2025. It would amend Title 18 to prohibit willfully making a federal law enforcement officer’s name public with intent to obstruct a criminal investigation or immigration enforcement operation. Proposed penalties reach 5 years, with no escalating bodily-harm penalty in the introduced bill. As of April 2026, it remained in Senate committee with no floor schedule. Its companion, H.R. 5118, was in the House Judiciary Committee.

H.R. 8927, the Stop the Doxx Act, proposes a 10-year maximum for first offenders and a civil private right of action. Fix the Court endorsed it in July 2026, but it remains pending. Texas, by contrast, enacted an amendment to Penal Code § 42.074 covering disclosure through electronic communication. That change applies to offenses committed on or after September 1, 2025. The contrast is operationally important because one provision can govern qualifying conduct while the others remain proposals.

What the map means for security teams assessing exposure or planning response

The lesson for security teams is to run this assessment at the start of an incident. The first check is geographic, beginning with which state’s law applies to the victim’s location and whether its protected classes include that person. That can eliminate an entire legal track immediately. The next check is remedy structure, distinguishing a criminal-only route from a private right of action. A possible civil claim offers independent action, with the timing of relief still uncertain.

The third check is evidence of intent. Saving communications and recording the post’s context and the threats around it from the time it is found helps show why the information was published. The raw disclosure may not prove the required purpose. Where the statute also requires actual harassment, injury, or fear of bodily injury, those elements shape the assessment too.

Content can circulate within hours, while legal action takes weeks. Proactive monitoring and early detection address a different part of the problem by identifying personal information in threat forums, aggregator sites, or dark-web channels before a campaign escalates. Domain-specific security intelligence based on live threat data gives executive protection teams ways to act that generic monitoring and later litigation cannot replace.