The State-by-State Reality of US Doxxing Laws

Verification frame

This article is a legal-reference map, not legal advice. Last verified: Aug. 2, 2026. Scope: U.S. doxxing laws and legal protections at the federal and state levels, with emphasis on whether a particular disclosure is criminal, civilly actionable, both, or not clearly covered by the specific source set reviewed here.

The useful question is not whether “doxxing is illegal” in the abstract. The working question is what law applies where, to whom, with what intent requirement, and with what remedy. A disclosure that creates federal exposure in one setting may be outside the federal statute in another. A state may criminalize the same conduct, allow a civil action, fold it into stalking or harassment, or leave counsel to evaluate some other privacy, threat, or disclosure theory.

The federal layer is real, but narrow

There is no comprehensive federal doxxing statute. The main federal criminal provision in this lane, 18 U.S.C. § 119, protects restricted personal information of covered persons, including judges, jurors, witnesses, informants, federal officers, and their families; the penalty can reach up to five years depending on the statutory circumstances. [1]

That limitation matters before anyone asks about penalties. If the exposed person is outside the covered class, § 119 is not converted into a general online privacy statute merely because the disclosure is frightening, reckless, or socially indefensible. For the narrower federal-only treatment, see Is Doxxing a Federal Crime? Penalties Under § 119. For an enforcement-oriented example involving a federal officer, see Federal Law Consequences for Doxing an ICE Officer.

For everyone else, the analysis usually moves quickly to state law. That is where the map becomes uneven.

The state map does not reduce to one doxxing rule

The Council of State Governments’ October 2025 survey is the best dated backbone in the source set, but it should be used as a routing tool rather than as a substitute for primary statutory text. Its most important point is also the easiest to miss: as of that survey, only Alabama, California, and Illinois define doxing as a standalone crime with an explicit statutory definition. [2]

That table is intentionally conservative. A state-by-state doxxing answer cannot be built by importing California’s definition into another state, or by assuming that a stalking amendment operates like a standalone disclosure offense. The same disclosure may require a different first question depending on the jurisdiction: Was the victim in a protected class? Was the information a home address, telephone number, restricted personal information, or something broader? Did the publisher act with the intent the statute requires? Is the remedy criminal prosecution, a private lawsuit, or both?

CSG also reports that 54 bills in 19 states have been enacted since the early 2000s to protect public officials. [2] That data point is easy to overread. It supports a conclusion about legislative attention to public-official exposure; it does not prove that every state protects private individuals in the same way, or that every harmful disclosure has an obvious statutory home.

Criminal-only and criminal-plus-civil states must be separated

The remedy split is not a drafting footnote. CSG reports that eight states codify doxing as solely criminal, while nine allow both criminal charges and civil action. [2] For intake, incident response, or litigation hold purposes, that distinction changes who can move first. A criminal-only statute may require law-enforcement involvement before anything happens. A civil remedy may let an exposed person seek damages or other relief directly, assuming the statutory elements are met.

Penalty labels also require primary-text review. The source base flags Kentucky’s reported penalty classification for re-checking against Ky. Rev. Stat. § 525.085 before use. The same caution applies to any quoted California civil-damages figure or fee provision; Civil Code § 1708.89 should be checked directly before an amount appears in advice, a complaint, or a client alert.

The 2025–2026 change layer is where stale summaries become unsafe

A doxxing-law summary written before late 2025 may now miss an operative amendment. Texas Penal Code § 42.074 was amended to cover disclosure through an electronic communication, with the change applying to offenses committed on or after Sept. 1, 2025. [3]

Pending bills belong in the file, but not in the elements chart for current liability. They are useful for watch lists, policy memos, and legislative-risk updates. They are not current law until the relevant enactment steps occur.

Protected class and intent do most of the routing work

The first factual sort should be the exposed person’s status. Federal § 119 is built around covered persons. Many state measures have grown out of threats against public officials or other defined groups. A private individual may still have protection, but the route may be narrower, different, or not available under the doxing label.

The second sort is the publisher’s mental state. Some statutes are concerned with knowing disclosure, some with intent to threaten, harass, intimidate, or facilitate harm, and some may require a connection between publication and a foreseeable or intended consequence. The exact formulation decides whether a bad disclosure is chargeable, civilly actionable, or merely evidence for another claim.

A hypothetical example shows why the sequence matters. Suppose a person posts another person’s home address in an online argument. The legal answer changes if the exposed person is a federal officer, a state judge, a juror, a public-school employee, a private landlord, or a private citizen with no protected status under the relevant statute. It changes again if the post includes a threat, encourages others to visit the home, follows a pattern of harassment, or merely republishes information already visible in a public record. Those are not moral distinctions; they are statutory routing facts.

Where harmful disclosure may still fall outside a doxxing statute

The patchwork leaves gaps. A disclosure can be dangerous and still fail the current doxxing statute because the victim is not in the protected class, the information is not covered, the publisher’s intent cannot be shown, the state has no standalone offense, or the available statute requires a harassment or stalking pattern that the facts do not establish.

Government-compelled or publicly available information creates a separate problem. The fact that information appears in a public system does not make misuse harmless, but it may affect which claim is available and against whom. For a case-in-point involving private individuals outside the § 119 framework, see Legal Consequences of Doxing Wealthy Property Owners in 2025.

This is the place where overbroad slogans do the most damage. If the internal note says only “doxxing is illegal,” the next lawyer still has to determine the jurisdiction, statute, protected person, covered information, mental state, remedy, effective date, and filing path. The note has not saved work; it has postponed it.

Working rule before advising or filing

For any specific disclosure, start with the jurisdiction and the date of the conduct. Then verify the current statute in primary text. Do not stop at the presence or absence of the word doxing.

• Identify the forum state, the victim’s state, the publisher’s location, and any federal nexus.
• Check whether the exposed person falls within a protected class under the federal or state statute.
• Confirm the covered information: address, telephone number, restricted personal information, identifying data, or another statutory category.
• Read the intent element before characterizing exposure as criminal.
• Separate criminal exposure from civil remedies; the existence of one does not prove the other.
• Check the effective date, especially for jurisdictions with 2025–2026 changes or pending bills.
• If relying on a survey, use it to find the statute, then cite the statute.

That is the operational answer to doxxing laws and legal protections in the United States as of Q3 2026: no national framework does the work. The current rule comes from the specific federal or state statute that applies to the person, information, intent, remedy, and date at issue.

References

1. 18 U.S.C. § 119, Legal Information Institute
2. Doxing: State Protections Against Digital Threats, Council of State Governments, Oct. 31, 2025
3. Unlawful Disclosure of Residence Address or Telephone Number – The Texas Doxxing Law, Saputo Toufexis
4. S.1952 - Protecting Law Enforcement from Doxxing Act, Congress.gov
5. H.R.5118 - Protecting Law Enforcement from Doxxing Act, Congress.gov
6. Fix the Court Endorses Bill to Protect Judges from Doxxing, Fix the Court, July 2026