Doxxing Laws by State: Who Is Liable and How to Get Your Information Taken Down

Is doxxing illegal?

In a growing number of states, yes. Illinois, California, Washington, Oregon and Nevada give doxxing victims a civil lawsuit with damages and an injunction. Everywhere else, doxxing is usually reached through stalking, harassment and cyberstalking statutes, or through privacy torts. Posting someone’s address is not illegal by itself. Posting it with intent to harm, and causing harm, often is.

Doxxing means publishing a person’s home address, phone number, employer, family details or similar information so that others will find, harass or hurt them. The information is often true and sometimes public. That is why defamation law rarely fits and why legislatures have started writing doxxing-specific statutes.

The statutes share a structure. The plaintiff must show publication without consent, an intent to harm or harass (or knowledge or reckless disregard that harm was likely), and a real consequence: fear, emotional distress, economic loss, or having to move or change jobs. Each statute also carves out reporting crimes to police, news reporting and constitutionally protected speech.

What does the Illinois doxing law require?

The Illinois Civil Liability for Doxing Act, 740 ILCS 195, took effect January 1, 2024 (P.A. 103-439). It creates a civil claim, not a crime. A plaintiff must prove three things: the defendant intentionally published the plaintiff’s personally identifiable information without consent, intending it be used to harm or harass, with knowledge or reckless disregard that the plaintiff was reasonably likely to suffer death, bodily injury or stalking; the publication caused significant economic injury, emotional distress, fear of serious bodily injury or death, or a substantial life disruption; and the plaintiff is identifiable from the published information itself. 740 ILCS 195/10(a).

“Personally identifiable information” is broad. It covers name, Social Security number, home address, phone number, email, social media accounts, and medical and financial information linked to an identifiable person. 740 ILCS 195/5. “Substantial life disruption” means a material change to how the person lives, such as moving, changing jobs or losing time from work.

The remedies are what make the Act useful. A court may award damages, other appropriate relief and reasonable attorney’s fees, and multiple defendants are jointly and severally liable. 740 ILCS 195/15. A victim can also get a temporary restraining order, an emergency order of protection, or a preliminary or permanent injunction against further publication. 740 ILCS 195/20. A permanent injunction requires clear and convincing evidence of a violation, a present and ongoing risk of death, bodily injury or stalking, and no lawful purpose for continued publication, and it lasts one year, renewable for another year. Suit can be filed in any county where an element occurred or where the victim lives. 740 ILCS 195/25.

The limits matter as much as the claim. The Act does not apply to reporting crime to police, reporting conduct reasonably believed to be unlawful, or activity protected by the U.S. or Illinois Constitution, including speech, press, assembly, protest and petition. 740 ILCS 195/10(b). It expressly does not conflict with Section 230 of the Communications Act, so it reaches the person who posted, not the platform that hosted. 740 ILCS 195/10(c). And a court can shift fees to the defendant if the claim is frivolous or brought in bad faith. 740 ILCS 195/15. The Act sets no statutory damages, so the plaintiff proves actual loss.

Which states have doxxing laws?

At least five states give every doxxing victim a civil claim: Illinois, California, Washington, Oregon and Nevada. A doxxing panel at the 2026 Internet Law Leadership Summit counted 17 states with anti-doxxing statutes, and the table covers all of them plus Michigan. Most are criminal only. Colorado, Minnesota and Oklahoma protect only judges, police and other listed officials and workers. The rest of the country relies on general stalking and harassment laws. The table covers the statutes most often used.

Three differences decide most cases. First, intent: Illinois and Washington reach a defendant who acted with reckless disregard of the risk of harm, while California requires intent to place the victim in reasonable fear and to provoke imminent harassment or injury by a third party. Second, money: Washington’s $5,000 per violation and California’s $1,500 to $30,000 let a plaintiff recover without proving a dollar of loss, while Illinois and Oregon require actual damages. Third, who pays: Illinois and Washington extend liability beyond the poster to people who knowingly benefit from the doxxing.

Michigan has no doxxing-specific civil statute. A Michigan victim relies on the posting-a-message statute, MCL 750.411s, which makes it a felony to post a message about someone, knowing it could cause two or more unconsented contacts, intending to frighten or harass, where the victim actually suffers emotional distress. Civil relief comes through personal protection orders and stalking and privacy claims.

What if my state has no doxxing law?

Use the stalking and harassment statutes. Every state criminalizes stalking, and most define it as a course of conduct, usually two or more acts, that would cause a reasonable person fear or significant emotional distress. Electronic posts count. A doxxing campaign that draws strangers to a victim’s home or inbox usually fits.

These statutes matter for two practical reasons. They support a civil protective order, which is faster and cheaper than a lawsuit. And several give the victim a damages claim. Michigan is a good example. A nondomestic personal protection order can restrain conduct prohibited by the stalking statutes, MCL 750.411h and 750.411i, or by the posting-a-message statute, MCL 750.411s, whether or not the respondent has been charged. MCL 600.2950a(1). A stalking victim can also sue for actual damages, exemplary damages, costs and reasonable attorney’s fees, again without a criminal charge or conviction. MCL 600.2954. That damages statute covers stalking under 411h and 411i, not the posting offense under 411s, so plead the stalking course of conduct.

Common-law claims fill gaps. Public disclosure of private facts, intrusion upon seclusion and intentional infliction of emotional distress all appear in doxxing complaints. Defamation applies only when the post also says something false.

Federal law reaches the worst cases. The federal cyberstalking statute, 18 U.S.C. § 2261A(2), makes it a crime to use an interactive computer service or other electronic means, with intent to harass or intimidate, in a course of conduct that causes, attempts to cause or would reasonably be expected to cause substantial emotional distress. Interstate threats are separately covered by 18 U.S.C. § 875. Federal prosecutors take a small fraction of these cases, usually those involving threats of violence or a sustained campaign.

The First Amendment sets the outer boundary. In Counterman v. Colorado, No. 22-138 (U.S. June 27, 2023), the Supreme Court held that a true-threats prosecution requires proof that the defendant “consciously disregarded a substantial risk that his communications would be viewed as threatening violence.” That is why the newer doxxing statutes require intent to harm or at least reckless disregard, and why a doxxing claim built only on the fact that true information was posted will fail.

Who is liable for doxxing?

The person who posted the information is liable. In Illinois and Washington, so are people who direct or profit from the doxxing. The platform that hosted the post almost never is, because of Section 230. People-search sites and data brokers sit in between.

Start with the poster. Every statute above targets the person who published the information with the required intent. If several people pile on, Illinois and Nevada make them jointly and severally liable, so the victim can collect the full judgment from whichever defendant can pay. 740 ILCS 195/15; NRS 41.1347.

Liability can reach organizers and beneficiaries. Washington reaches “any person who knowingly benefits from participation in a venture” that the person knew or should have known was violating the statute. RCW 4.24.792. Illinois similarly extends liability to a person who directs a violation and knowingly benefits financially. 740 ILCS 195/15. These provisions matter when a campaign is run by a group, a website operator who solicits addresses, or someone who sells access to the information.

People who reshare are harder to reach. Section 230 protects any “provider or user of an interactive computer service” from being treated as the publisher of information provided by someone else. 47 U.S.C. § 230(c)(1). A user who simply reposts another person’s doxxing post can raise that defense. A user who adds the address, adds commentary urging people to show up, or compiles information from several sources is creating new content and cannot.

Platforms are usually immune. Section 230 bars most claims that would hold a social network, forum or host liable for what its users post, and the Illinois, Washington, Nevada and California statutes expressly preserve that immunity. 740 ILCS 195/10(c); RCW 4.24.792(4). The exception is a platform that helps create the unlawful content. Under Fair Housing Council v. Roommates.com, LLC, 521 F.3d 1157 (9th Cir. 2008) (en banc), a site loses immunity when it materially contributes to the content’s alleged unlawfulness. A forum built to collect and publish home addresses of targets is a candidate for that argument. A general-purpose social network is not. Section 230 also does not block federal criminal prosecution. 47 U.S.C. § 230(e)(1).

Data brokers and people-search sites are different. They compile and publish their own profiles rather than hosting user posts, which weakens their Section 230 position. More useful in practice, they are subject to opt-out and deletion obligations under state privacy law, discussed below.

Practically, the platform is the removal target and the poster is the litigation target. Suing the platform for damages rarely works. Getting the platform to take the post down, and to produce the poster’s account records under subpoena, usually does.

How do you get doxxed information removed?

Work from the fastest lever to the slowest: the platform’s own rules, then search engines, then data brokers, then a court order. Many doxxing posts come down on a well-drafted platform report. A court order is for the posts that do not, and for unmasking an anonymous poster.

Platform reports come first because platform rules are broader than the law. X’s private information policy prohibits posting someone’s home address or physical location, non-public phone numbers and email addresses, and government ID numbers without consent, and it also bars threatening to expose that information or offering a bounty for it. X lets anyone report a post that shares private information “in a clearly abusive way”; otherwise the report must come from the person or an authorized representative, which can be counsel. Penalties run from forced deletion to permanent suspension of accounts dedicated to posting private information. Meta, Reddit, YouTube and most forums have comparable rules. A report that quotes the platform’s own policy and identifies each URL gets faster action than a general complaint.

Search engines come second. Google’s Results about you tool takes removal requests for search results showing a person’s phone number, home address or email address. Google is clear about the limit: removal from Search “doesn’t mean that the info is gone from the internet,” and the source page must be addressed with the site owner. Delisting still matters, because most people find a doxxing post through a name search.

Data brokers come third. People-search sites are where most doxxers get the address in the first place. Each site has an opt-out, and paid services will file them in bulk. California residents have a single channel: the Delete Request and Opt-Out Platform (DROP) under the California Delete Act, and data brokers must check DROP and process deletion requests at least every 45 days starting August 1, 2026.

If the post uses your own photograph, a copyright takedown notice under 17 U.S.C. § 512 is often the fastest removal tool available, because hosts act on those notices to keep their safe harbor.

Court orders come last, but they work where nothing else does. The Illinois Act authorizes a TRO, an emergency order of protection and an injunction against continued publication. 740 ILCS 195/20. California and Washington authorize injunctions, and California waives the bond. A protective order under a state stalking statute does the same work in most other states. Platforms that refuse a policy report will usually honor a court order directed at the poster’s content.

Anonymous posters require a subpoena. The usual path is a John Doe lawsuit, a motion for early discovery, and subpoenas to the platform for account and IP records and then to the internet provider for the subscriber’s identity. Courts protect anonymous speech, so expect to show a viable claim before a judge allows the subpoena. Platforms and providers often keep logs for limited periods, so this step should start early.

What should you do in the first 48 hours?

1. Preserve the evidence before reporting anything. Capture full-page screenshots showing the URL, date and account name, save the links, and note who reshared the post. Once a platform removes a post, it is gone for your purposes until a subpoena brings it back.
2. If there is a threat of violence, call the police and get a report number. You will need it for a protective order and for platform escalation.
3. Report each post under the platform’s private information or doxxing policy, citing the policy by name.
4. File Google’s Results about you request for any search result showing your address, phone or email.
5. Opt out of the major people-search sites, or use DROP if you live in California.
6. Lock down your own accounts, tell your employer’s security team if the posts mention your workplace, and warn family members whose information was included.
7. Do not engage the poster. A reply often fuels the campaign and can complicate a later claim.
8. Talk to counsel about a protective order, a demand letter, an injunction or a John Doe subpoena. Limitations periods are short in places: Oregon’s is two years. ORS 30.835(4).

FAQ

Is doxxing illegal in Illinois?

It is a civil wrong. The Civil Liability for Doxing Act, 740 ILCS 195, effective January 1, 2024, lets a victim sue a person who published their personal information without consent, intending harm, where the publication caused fear, distress, economic loss or a major life disruption. Remedies include damages, attorney’s fees and injunctions.

Can I sue someone for doxxing me?

In Illinois, California, Washington, Oregon and Nevada, yes, under a doxxing-specific statute. California adds statutory damages of $1,500 to $30,000 and Washington $5,000 per violation. In other states, the claim usually runs through stalking statutes, protective orders and privacy torts such as public disclosure of private facts.

Can I sue the website or social network that hosted the post?

Rarely. Section 230, 47 U.S.C. § 230(c)(1), bars most claims treating a platform as the publisher of a user’s post, and the Illinois, Washington, Nevada and California doxxing statutes preserve that immunity. A site that helped create the unlawful content can lose it. The practical use of the platform is removal and producing the poster’s account records under subpoena.

Is it doxxing if my address was already public?

It can be. The statutes turn on publication without consent, intent to harm or harass, and resulting harm, not on secrecy. Illinois defines personally identifiable information to include a home address and phone number. Public availability may still matter to a court weighing intent and harm.

How do I get my home address removed from Google?

Use Google’s Results about you tool, which takes requests to remove search results showing your phone number, home address or email. Removal is from Google Search only. The source page stays up until the site owner, the platform or a court order takes it down.