Doxxing

Topics and Issues

Arizona. Arizona amended its existing harassment law to add an anti-doxing provision. The new statute makes it a crime to “electronically distribute, publish, email, hyperlink or make available for downloading” a person’s PII, “[w]ithout the person’s consent and for the purpose of imminently causing the person unwanted physical contact, injury or harassment,” if the harm or harassment actually does occur. Ariz. Rev. Stat. Ann. § 13-2916(A)(4). This law covers a broad scope of disclosures, including a person’s home or work address, “or other contact information that would allow the identified person to be located, contacted or harassed.” Id. § 13-2916(E)(4). It does not define the terms publish or distribute.

Colorado. A preexisting state law that prohibited knowingly sharing personal information online about a peace officer, judge, or prosecutor was broadened in 2021 to also apply to information about public health workers (who were targeted by opponents of COVID-19 safety measures) or their families. Colo. Rev. Stat. Ann. § 18-9-313(2.7); see also id. § 18-9-313(1)(n). The scope of the information covered by the statute is broad, including not just home address, phone number, or personal email address, but also a “personal photograph” or a photo of the person’s home or vehicle. Id. § 18-9-313(1)(l). Misdemeanor criminal penalties apply if the information is shared and two preconditions are met: (1) the posting presents an “imminent and serious threat” to safety, and (2) the publisher “knows or reasonably should know of the imminent and serious threat.” Id. § 18-9-313(2.7). Neither publish nor cognates are defined.

Florida. Florida enacted a law that included a prohibition against “cyberintimidation,” making it unlawful for any person to “electronically publish” another person’s PII “with the intent to, or with the intent that a third party will use the information to … incite violence or commit a crime against the [targeted] person,” or place the person in “reasonable fear of bodily harm.” Fla. Stat. Ann. § 836.115(2). The scope of PII encompasses “any name or number that may be used, alone or in conjunction with any other information, to identify a specific person” including, but not limited to, an email address or phone number. Id. § 836.115(1)(c). The law defines the term “electronically publish” to mean “to disseminate, post, or otherwise disclose information to an Internet site or forum. Id. § 836.115(1)(a).

Kentucky. Ky. Rev. Stat. Ann. § 525.085(2) prohibits the dissemination of anyone’s PII online when the disclosure “would cause a reasonable person to be in fear of physical injury to himself or herself, or to his or her immediate family member or household member” and when the disclosure is made “with the intent to intimidate, abuse, threaten, harass, or frighten.” PII encompassed by the law, in addition to home address, also includes a person’s school or work location. Id. § 525.085(1)(d). The statute defines “dissemination” to mean “electronically publishing, posting, or otherwise disclosing information to a public Internet site or public forum.” Id. § 525.085(1)(a).

Minnesota. Minn. Stat. Ann. § 609.5151 applies to information only about law enforcement officers or their family members, and to a relatively narrow scope of personal information: “a home address, directions to a home, or photographs of a home.” The state prohibition applies to making such information “publicly available” in any medium and does not limit itself to online dissemination. Id. § 609.5151 Subd. 2. The requisite mental state for conviction is the same as that in Colorado: the existence of “an imminent and serious threat” to safety that the speaker “knows or reasonably should know of.” Id.

Oklahoma. Okla. Stat. Ann. tit. 21, § 1176(A) makes it a crime to “knowingly publish, post or otherwise make publicly available … [PII] of a peace officer, public official, or crime victim,” if the intent is to threaten, harass, or intimidate, and the publication in fact causes the individual to reasonably fear “death or serious bodily injury.” The information that cannot be lawfully disseminated includes not just enumerated classes of confidential information, such as date of birth or SSN, but also “any other information that is linked or linkable to an individual, such as medical, educational, financial, or employment information.” Id. § 1176(B)(5). For purposes of this statute, the term “publish” means to “circulate, deliver, distribute, disseminate, transmit or otherwise make available to another person.” Id. § 1176(B)(7).

Oregon. Unlike the other “doxing” statutes listed above, Or. Rev. Stat. Ann. § 30.835 is enforceable by way of civil rather than criminal remedies. A plaintiff can obtain money damages if the defendant, “with the intent to stalk, harass or injure the plaintiff, knowingly caused personal information to be disclosed,” if the harm actually occurs, and if a reasonable person would have suffered harm. Id. § 30.835(2)(a).

Protected personal information includes, among other things, the home address, email address, phone number, or plaintiff’s employer’s employer contact information. Id. § 30.835(1)(d). The law defines “disclose” to include, “but is not limited to, transfer, publish, distribute, exhibit, advertise and offer.” Id. § 30.835(1)(a).

Washington. In 2023, Washington passed its anti-doxxing law, Ch. 381, Laws 2023.