Skip to content

CAPITOL IDEAS

Doxing: State Protections Against Digital Threats

Oct. 27, 2025

In holding public office, state officials make many sacrifices to serve their communities. Campaigns can strain their personal finances, while the heightened visibility of public life can take a toll on their mental health. Increasingly, however, state officials must weigh their desire to serve against the growing threats to their personal safety — an unfortunate calculation that is reshaping their decision to hold public office.

One such threat is doxing — a serious crime that is used to threaten, harass or harm public officials and their family members. While many definitions exist, the Center for Internet Security considers doxing to be, “the malicious identification and online publication of information about an individual.” This information is often personal in nature and is shared without the consent of the individual or their family members. 

Historically, many states have lacked legal frameworks to hold perpetrators accountable for doxing. Most states have laws addressing forms of electronic communication harassment and terroristic threatening. However, these laws have traditionally addressed direct threats or unwanted repeated contact, either in-person or via an electronic device. As such, doxing can be difficult to prosecute under these provisions.

This landscape is changing, though. Since the early 2000s, 54 bills have been enacted in 19 states to protect public officials from doxing. These laws have criminalized the act by establishing doxing — or its associated actions — as a standalone offense or amending laws related to harassment, threatening or stalking to address doxing. In most states, the term “doxing” is not explicitly defined or referenced in statute but rather referred to as the “improper disclosure of private information,” among other things.

Doxing Laws Across the States

As of June 2025, three states — Alabama, California and Illinois — have established doxing as a standalone crime and ascribed an explicit definition for the act. For example, Alabama HB 287 (2023) created the crime of doxing, defining it as the electronic publication, posting or provision of an individual’s personal identifying information with the intent that others will use that information to harass or harm the individual.

Fourteen states — Colorado, Florida, Missouri, Oklahoma, Pennsylvania, Virginia, Oregon, Delaware, Kentucky, Minnesota, Nevada, New Jersey, Utah and Washington — have established doxing as a standalone offense, but do not explicitly define or reference the term “doxing” in statute. These states refer to doxing as the dissemination of personal information on the internet (Ky. Rev. Stat. §525.085), the improper disclosure of private information (Or. Rev. Stat. §30.835) or cyberintimidation by publication (Fla. Stat. Ann. §836.115).

Only Arizona and Connecticut have amended laws related to harassment, threatening or stalking to address doxing. In these states, “doxing” is not explicitly defined or referenced in statute but described alongside other types of prohibited conduct. Connecticut SB 989 (2021) is one such example, extending the crime of second-degree stalking to include certain electronic disclosures of personal identifiable information (Conn. Gen. Stat. §953-53a-181d).

Defining Doxing in State Law

Although most states do not explicitly define or reference doxing in statute, its descriptions are similar in that they address:

  • The disclosure of an individual’s personal identifying information
  • The lack of consent to share that information
  • The intent to cause harm or harass that individual or their family members

In Washington, HB 1335 (2023) prohibited the publication of an individual’s personal identifying information when the publication is (a) made without the consent of the individual; (b) with the intent or knowledge that the information will be used to harm the individual; and (c) causes the individual to suffer physical injury or fear of bodily injury (RCW 4.24.792).

Scope of Anti-Doxing Protections for Public Officials

Most states provide broad doxing protections to all individuals and their family members. Statute simply states that the unauthorized disclosure of the personal identifying information of “another individual” or “any person” is a crime.

Seven states — Alabama, Colorado, Delaware, Minnesota, New Jersey, Oklahoma and Pennsylvania — limit the scope of anti-doxing laws to specific public sector officials. In these instances, statute explicitly delineates those covered by the act, which most often includes judicial officers, law enforcement officers and election officials. In Delaware, doxing protections only apply to judicial officers, which is defined to be active, formerly active or retired judges and justices and their family members (Del. Code Ann. tit.10 §1921).

Although Colorado limits doxing protections to specific public sector officials, they have taken legislative action to significantly expand the scope of these laws. In 2002, the General Assembly enacted HB 02-1113 to protect peace officers from doxing. Since then, 13 bills have been enacted to extend protections to active, formerly active or retired judges and justices; public defenders; election officials; firefighters; and state or county employees investigating child abuse or neglect.

State Doxing Penalties

States have established three avenues of legal recourse for public officials who are doxed — criminal penalties, civil remedies or both. If a state provides pathways for both criminal prosecution and civil action, these provisions are often put forth in a singular piece of legislation that amends both civil and criminal code.

Eight states — Alabama, Arizona, Colorado, Florida, Missouri, Oklahoma, Pennsylvania and Virginia — have codified doxing as solely a criminal offense, with penalties ranging from a class C misdemeanor (Mo. Rev. Stat. §565.240) to a class A felony (Ky. Rev. Stat. §525.085). In many states, criminal penalties are graduated based on the intended target, outcome of the action (e.g., if the victim suffers bodily harm or injury) and whether the perpetrator has any prior convictions for doxing (Figure 3).

In nine states — California, Connecticut, Delaware, Kentucky, Minnesota, Nevada, New Jersey, Utah and Washington — anti-doxing laws enable victims to press both criminal charges and pursue civil action. For instance, Kentucky enacted SB 267 (2021), allowing victims of doxing to press criminal charges under Ky. Rev. Stat. §525.085. If the individual is found guilty, the victim can also bring a civil cause of action against their perpetrator under Ky. Rev. Stat. §411.065.

As threats to public officials continue to evolve, so do the legal frameworks that protect them. By establishing doxing protections for public officials, states have taken critical steps to safeguard the privacy and safety of those dedicated to serving our communities. Policymakers can learn more about state efforts to protect public officials against swatting by reading “Swatting: State Efforts to Prevent Political Violence.”