How Do Doxxing Laws and Penalties Vary by State?

The first usable answer to “is doxxing illegal?” is not a national yes or no. It is: which state, which protected person, which statute, which remedy, and when was that row last checked. This article is not legal advice; it is a dated state-law tracker for narrowing the question before counsel, a court clerk, law enforcement, or a platform team is asked to act.

Last verified for this article: August 2, 2026, against the source set cited below. The federal question is separate. If the person exposed is a federal covered official, witness, juror, informant, or another person covered by federal law, start with Is Doxxing a Federal Crime? Penalties Under § 119. This record stays with state law.

The short answer: standalone doxxing crimes are still rare

The cleanest verified count comes from the Council of State Governments. As of its June 2025 cutoff, 54 bills had been enacted in 19 states to protect public officials from doxxing-related digital threats; only Alabama, California, and Illinois used a standalone defined doxxing crime, while 14 additional states criminalized similar conduct without using the term “doxing” or “doxxing.” CSG also separated criminal-only states from states that add civil remedies, describing an 8-to-9 split, and noted that penalties range from Missouri’s class C misdemeanor to Kentucky’s class A felony.[1]

That count should not be inflated into “about half the states make doxxing illegal” without explaining the filter. Broader public-facing summaries use a wider lens, including states with cyberharassment, stalking, intimidation, address-confidentiality, or targeted-disclosure statutes that may reach doxxing facts even when no statute says “doxxing.” One such 2026 consumer legal summary frames the coverage as close to half of all states, but that is not the same measurement as CSG’s public-official protection count or its narrower standalone-crime count.[2]

For a victim, that distinction is not academic. A statute limited to judges, police officers, election workers, or other officials may not help a private resident. A criminal statute may allow a police report but no private damages action. A civil statute may allow an injunction, statutory damages, attorney’s fees, or pseudonymous filing even when a prosecutor does not bring a case.

How to read the tracker

Each row below is deliberately narrow. “Standalone” means the cited source classifies the state as using a defined doxxing offense or doxxing-specific scheme. “Related conduct” means the source identifies criminal exposure for the same kind of targeted personal-information disclosure without relying on the word doxxing. “Public-official limited” means the protection is not general resident protection unless the statute separately says so.

• Start with the protected person: all persons, public officials, judicial officers, or another specified class.
• Then identify the remedy: criminal prosecution only, civil action only, or both.
• Check the penalty tier or civil recovery tools: misdemeanor, felony, statutory damages, attorney’s fees, injunction, or pseudonymous filing.
• Do not use 2026 bill activity to update a row until the enacted text, effective date, and codification are checked.

California: the criminal route and the civil route do different work

California is the easiest state to misuse in conversation because it has both a criminal provision and a civil private right of action. California Penal Code §653.2 is described as a misdemeanor provision carrying up to one year and a $1,000 fine for electronically distributing another person’s personal identifying information with the required malicious intent and resulting fear or unwanted contact.[3]

That is not the same tool as a civil claim. California’s AB 1979 created a private right of action at Civil Code §1708.89, effective January 1, 2025, with actual damages, punitive damages, statutory damages from $1,500 to $30,000, attorney’s fees, injunctive relief, and the ability to proceed pseudonymously.[3]

Those civil features matter when the immediate problem is practical: the address is still online, the target wants a takedown or injunction, the person is afraid to file under a name that will be indexed again, and the economics of hiring counsel are otherwise impossible. A misdemeanor classification answers only one part of that problem.

Illinois: fee shifting changes the leverage calculation

Illinois deserves separate treatment because its Civil Liability for Doxing Act moves the analysis from criminal exposure to whether a private claimant can make a case economically viable. A law-firm analysis of the statute emphasizes the fee-shifting feature: successful victims may recover attorney’s fees, which can change whether a smaller-dollar privacy injury can be litigated at all.[4]

There is also at least one reported early use of the law beyond the statute book. A 2026 legal summary reports that an Illinois jury in Will County returned a verdict of nearly $46,000 in an early doxxing case.[2]

That verdict should not be converted into a predicted recovery range. It is a reported case result, not a statewide average. Its value for a tracker is narrower and more useful: it shows that a civil doxxing statute with fee shifting can become a real litigation lever, not only a policy statement.

Public-official-only laws are easy to overread

CSG identifies seven states whose doxxing-related protections are limited to public-sector officials: Alabama, Colorado, Delaware, Minnesota, New Jersey, Oklahoma, and Pennsylvania. Delaware is even narrower in that description, protecting judicial officers only.[1]

That limitation is where many quick answers go wrong. If a school board member, judge, prosecutor, police officer, or election worker is targeted, a public-official statute may be central. If a tenant, streamer, nurse, private employee, or protest participant is targeted, the same state row may not answer the question at all. The analysis then has to move to general harassment, stalking, threat, cyberstalking, privacy, or civil-liability law in that jurisdiction.

Colorado illustrates the expansion pattern rather than a simple all-person rule. CSG describes Colorado as having enacted 13 bills since 2002 in this public-official protection arc.[1] That tells a researcher where the state has been legislatively active; it does not, by itself, prove that every doxxing victim in Colorado has the same cause of action.

2026 bill activity belongs in a refresh queue until the text is checked

The most dangerous tracker row is the one updated from a headline, committee note, or bill-summary snippet. Indiana shows why. Its court legislative update page reported that SB 140 was heard on January 6, 2026, but that kind of status note is only a prompt to check the bill text, amendments, passage status, effective date, and codification before advising anyone that Indiana law has changed.[5]

The same discipline applies to any 2026 state item that appears in a monitoring queue. A proposed anti-doxxing bill is not an enacted criminal offense. An enacted act is not necessarily codified where a claimant or prosecutor will use it. An effective date is not the same as retroactive coverage. If the row cannot show those fields, it should be marked “verify,” not treated as law.

What the state-law answer can and cannot do

A state doxxing law can create criminal exposure, a private lawsuit, statutory damages, fee shifting, an injunction, or procedural protection for a claimant’s identity. It may also do none of those things for a particular person because the statute protects only officials, requires a specific intent, requires resulting fear or harassment, or sits in a related offense rather than a doxxing-labeled statute.

If the facts involve federal officers, federal witnesses, or federal protected-person categories, use the federal §119 record first. If the facts involve swatting after an address disclosure, adjacent civil exposure may matter as much as the doxxing statute; the site’s records on doxing an ICE officer, doxing wealthy property owners, and the Pima County swatting shooting claim are consequence records, not substitutes for the state-law row.

For a working file, the defensible format is simple: name the state, quote or cite the statute, identify the protected person, label the remedy, state the penalty or damages range only if verified, and date the row. Anything broader is a starting guess.

References

1. Doxing: State Protections Against Digital Threats, The Council of State Governments, October 31, 2025.
2. When Your Information Has Been Revealed Online, CriminalDefenseLawyer.com, May 1, 2026.
3. California Doxing Laws, EG Attorneys.
4. Democratizing the Defense to Doxing: New Attorney Fee Awards for Victims Alters Paradigm, Amundsen Davis.
5. Doxxing, Indiana Legislative Update, January 16, 2026.