Is Doxxing Illegal? How to Assess the Law and Respond (2026)

Doxxing usually means publishing or distributing identifying information—such as a home address, phone number, workplace, family details, or location—with the intent or foreseeable effect of harassment, intimidation, stalking, or harm. “Doxxing” is not one universal legal category. The same publication can raise different issues depending on the information, intent, audience, threat, conduct that followed, jurisdiction, relationship, and whether the information was already public.

Publishing a public record is not automatically unlawful. Intentional threats, stalking, harassment, extortion, unauthorized access, impersonation, or incitement can trigger criminal or civil law even when one detail was available elsewhere. A lawyer, law-enforcement agency, or court—not a blog post—must assess the facts.

If there is an immediate threat of violence, stalking, or an unsafe person at your location, contact emergency services and move to a safer place if you can. Preserve evidence without confronting the person or increasing your exposure.

Quick Answer

Doxxing may be actionable under a state-specific privacy, harassment, stalking, threat, cyberstalking, or protected-person law, or under a civil claim. Some jurisdictions have targeted address-publication protections for particular officials or at-risk people. Other situations may be lawful speech, protected reporting, or a dispute about public information. Start by identifying the conduct and applicable jurisdiction instead of assuming a universal “doxxing law.”

What Makes a Publication More Legally Significant?

The following factors can change the analysis:

No single factor decides the outcome. A public address posted with an explicit threat is different from a professional office address in a news report, even though both may be technically public.

Possible Legal Theories

The applicable theory depends on the facts and jurisdiction. Possibilities can include:

• criminal harassment or stalking;
• threats or extortion;
• cyberstalking or repeated electronic communications;
• unauthorized account access or identity theft;
• witness, juror, election-worker, health-worker, judge, or law-enforcement protections;
• state privacy, publicity, intrusion, or intentional-infliction claims;
• a statute allowing an eligible person to demand removal from certain publishers; and
• platform, workplace, school, or housing rules.

The existence of one of these categories does not prove that a specific post violates the law. The words, intent, recipient, pattern, and evidence matter.

Federal Versus State Law

The United States does not have one general federal offense named “doxxing.” Federal laws may still apply to conduct that involves interstate threats, stalking, extortion, hacking, identity misuse, or other defined offenses. Whether a federal statute fits requires a fact-specific analysis.

State law can provide criminal offenses, civil remedies, protective orders, confidentiality programs, or special protections for defined professions. Some laws cover only a protected class; others may address a broader pattern of harassment or publication. Definitions, intent requirements, proof of harm, defenses, deadlines, remedies, and enforcement agencies differ.

New Jersey's Daniel's Law is an example of a targeted protected-person framework, not a general rule for every resident or executive. California Government Code § 6254.21 also concerns the Internet publication of certain elected or appointed officials' home addresses and phone numbers; it should not be presented as a universal private-address deletion law. California Government Code § 6254.21

For a real incident, search the current official statute, attorney-general guidance, court rules, and local law-enforcement resources. Do not rely on a dated state list or an article that treats a bill, proposal, complaint, settlement, and enacted law as equivalent.

What to Do in the First Hour

1. Triage safety

If a threat is immediate or specific, call emergency services. If the risk is ongoing but not immediate, contact a local victim advocate, law-enforcement non-emergency line, workplace security team, school safety office, or qualified lawyer. Change location and alert trusted people if that is part of your safety plan.

2. Preserve the evidence

Save the exact URL, username, post, message headers, date, time zone, screenshots, screen recording, replies, call logs, and any threat or demand. Preserve the original file where safe. Do not edit screenshots or respond in a way that could erase the thread.

3. Avoid amplification

Do not repost the address or quote the threat in a public response. When reporting to a platform or authority, include only the minimum sensitive information necessary and use a secure channel. Ask a trusted person to help with evidence if viewing the material is unsafe.

4. Report the content

Use the platform's current privacy, harassment, threat, or personal-information route. Report the account or post rather than engaging in a public argument. A platform removal changes the platform copy; it does not establish that every copy or search result is gone.

5. Protect accounts and sources

Change exposed passwords from a safe device, enable multifactor authentication, review account recovery methods, and tell household or workplace staff how to verify unexpected contacts. If a leaked detail came from a business, directory, or data broker, document that source separately.

Reducing the Source Exposure

After urgent safety steps, inventory the exact commercial listings, public pages, professional profiles, property records, business filings, and family-linked results that expose actionable information. Separate:

• the original government or court record;
• the commercial provider's profile;
• a search-engine result;
• a social or forum post; and
• copies held by relatives, affiliates, or other services.

Use the current provider-specific opt-out, correction, or legal-removal route. The FTC explains that people-search sites may compile public records, broker data, and public social profiles, and that opting out does not erase the underlying public record or every related profile. FTC people-search guidance

OfflistMe can help a user review recorded provider workflows and prepare browser-local drafts for selected commercial sources. The user chooses the route, reviews the request, completes any verification, sends or submits it, and preserves the evidence. The workflow does not investigate the publisher, establish a legal violation, enroll someone in a safety program, or guarantee removal.

Legal-Remedy Questions to Ask a Lawyer or Advocate

• Which jurisdiction's law applies to the publisher, subject, platform, and resulting conduct?
• Does the fact pattern involve a threat, stalking pattern, extortion, impersonation, unlawful access, or protected-person statute?
• Is the information accurate, public, privileged, or subject to a confidentiality or sealing order?
• What evidence proves intent, notice, repetition, reach, and resulting fear or harm?
• Is there a civil claim, protective order, subpoena, emergency disclosure, or platform route?
• What deadline, notice, venue, or damages rule applies?
• Could public reporting or a takedown request increase the risk?

Do not send a legal demand that reveals a survivor's safe address or creates a new record without safety advice.

Frequently Asked Questions

Is publishing an address always illegal?

No. Public availability alone does not decide legality. Intent, threat, pattern, audience, accuracy, harm, jurisdiction, and protected status can change the analysis.

Is there a federal doxxing law?

There is no single general federal offense named doxxing. Federal laws may apply to conduct that fits a defined offense such as interstate threats, stalking, extortion, hacking, or identity misuse. A qualified authority must assess the facts.

Can a data broker be sued for doxxing?

Possibly in a specific jurisdiction and fact pattern, but not as a universal rule. A broker's profile, source records, publisher intent, notice, protected status, and resulting harm all matter. Seek local advice before relying on a damages claim.

Does removing my data prevent doxxing?

It may reduce one source of reconnaissance, but it cannot control public records, copies, independent research, or an attacker. Pair provider requests with account, household, workplace, and physical-safety controls.

Should I contact the person who posted it?

Not if that could increase danger or erase evidence. Consider a platform report, advocate, lawyer, or law-enforcement route first.

Response Checklist

• [ ] Move to safety and contact emergency services for an immediate threat.
• [ ] Preserve URLs, timestamps, screenshots, messages, calls, and threats.
• [ ] Avoid reposting the information or escalating publicly.
• [ ] Report the account or page through the platform's current safety route.
• [ ] Secure exposed accounts and alert trusted household or workplace contacts.
• [ ] Identify the original source and separate it from copies and search results.
• [ ] Use provider-specific correction or opt-out routes with minimum necessary data.
• [ ] Ask a local lawyer or advocate about the applicable statute, remedy, deadline, and evidence.

Sources and Related Guides

• U.S. Code § 2261A, Interstate stalking
• U.S. Code § 875, Interstate communications
• New Jersey Office of Information Privacy
• California Government Code § 6254.21
• FTC: People-search sites and opt-outs
• Address Confidentiality Programs vs. Data-Broker Opt-Outs
• Doxxing Prevention Guide
• Privacy Guide for High-Risk Professions