Doxing is illegal in California. Penal Code 653.2 makes it a misdemeanor to use an electronic device to share someone’s personal information with the intent to put them in fear and provoke harassment or violence from others, and a conviction carries up to one year in county jail and a fine of up to $1,000.1California Legislative Information. California Penal Code 653.2 When the conduct is part of a broader pattern, prosecutors can reach for the stalking statute instead, which carries prison time. Victims also have their own tools: civil lawsuits for damages and restraining orders that can last five years.
What Penal Code 653.2 Requires
California’s statutes don’t use the word “doxing.” Penal Code 653.2 is the law that covers the conduct, and it targets a specific combination of elements. A prosecutor has to prove all of them.
The defendant must have used an electronic communication device, a term the statute defines broadly to include phones, computers, websites, and similar technology.1California Legislative Information. California Penal Code 653.2 They must have shared personal identifying information or a harassing message about someone without that person’s consent. They must have done it intending to put the target in reasonable fear for their own safety or the safety of an immediate family member. The purpose must have been to imminently cause unwanted physical contact, injury, or harassment by a third party. And the information itself must have been likely to actually produce that kind of unlawful response.
That last element matters. It isn’t enough that someone intended harm. The information they posted has to be the kind of thing that would realistically provoke a third party to harass, threaten, or physically confront the target. Posting someone’s name in a heated argument, while ugly, may not clear that bar. Posting a home address alongside language urging others to “pay them a visit” almost certainly does.
The statute defines “harassment” as a knowing and willful course of conduct directed at a specific person that a reasonable person would consider seriously alarming, tormenting, or terrorizing, and that serves no legitimate purpose.1California Legislative Information. California Penal Code 653.2 The “no legitimate purpose” language becomes important when defenses come up.
Penalties Under Penal Code 653.2
Doxing under 653.2 is a misdemeanor. A conviction can result in up to one year in county jail, a fine of up to $1,000, or both.1California Legislative Information. California Penal Code 653.2 Those penalties sit at the higher end of the misdemeanor scale, and a conviction produces a criminal record that shows up on background checks for jobs, housing, and licensing.
The practical consequences often outlast the sentence. A misdemeanor conviction can affect professional licenses, immigration status for non-citizens, and custody disputes. For someone who doxed a person in a fit of online rage, the record itself frequently hurts more than the jail time or the fine.
When Doxing Becomes Stalking
If doxing is one piece of a larger pattern of harassment, prosecutors can charge stalking under Penal Code 646.9 instead of, or in addition to, the doxing charge. Stalking requires willfully and maliciously harassing or repeatedly following someone while making a credible threat that puts them in reasonable fear for their safety or the safety of their immediate family.2California Legislative Information. California Penal Code 646.9
A “credible threat” under the stalking statute explicitly includes threats made through electronic communication devices and threats implied by a pattern of conduct.2California Legislative Information. California Penal Code 646.9 Someone who repeatedly posts a target’s personal details across multiple platforms, escalating over time, could face stalking charges even if no single post contained an explicit threat.
Stalking is a wobbler, meaning prosecutors can charge it as a misdemeanor or a felony. As a misdemeanor, it carries up to one year in county jail and a $1,000 fine. As a felony, it carries state prison time. The penalties jump in specific situations:
- Stalking someone while a restraining order, injunction, or other protective court order is in effect carries two, three, or four years in state prison.2California Legislative Information. California Penal Code 646.9
- A stalking conviction paired with a prior felony conviction for domestic violence, violating a protective order, or making criminal threats carries two, three, or five years in state prison.2California Legislative Information. California Penal Code 646.9
The gap between a $1,000 fine under 653.2 and a potential five-year prison sentence under 646.9 is where the real stakes lie for persistent doxers. Prosecutors tend to reach for the stalking statute when the behavior shows a pattern rather than a one-time post.
Federal Cyberstalking Exposure
Doxing that uses interstate communication systems can also trigger federal prosecution under 18 U.S.C. § 2261A, the federal stalking and cyberstalking statute. Because most internet activity crosses state lines, the reach is broad. The law applies to anyone who uses the mail, an interactive computer service, or any facility of interstate commerce to engage in conduct that places another person in reasonable fear of death or serious bodily injury, or that causes or would reasonably be expected to cause substantial emotional distress.3Office of the Law Revision Counsel. 18 U.S. Code 2261A – Stalking
Federal penalties are far harsher than the state misdemeanor. The baseline sentence for a cyberstalking conviction is up to five years in federal prison. If the victim suffers serious bodily injury, the maximum rises to ten years. If the victim is permanently disfigured or suffers a life-threatening injury, it rises to twenty. If the victim dies as a result of the conduct, the defendant faces life. Anyone who stalks in violation of an existing protective order faces a mandatory minimum of one year.4Office of the Law Revision Counsel. 18 U.S. Code 2261 – Interstate Domestic Violence
Federal prosecutors generally save these charges for severe cases: organized harassment campaigns, swatting incidents driven by doxing, or situations where the victim has documented harm. But the jurisdictional hook is low enough that any doxing done over the internet technically falls within federal reach.
Defenses to a Doxing Charge
Not every disclosure of personal information is a crime, and 653.2 has real limits.
No Intent to Cause Fear
Penal Code 653.2 requires specific intent. Accidentally sharing someone’s information, or sharing it for a reason unrelated to putting the person in fear, doesn’t meet the threshold. Context matters. Forwarding an old contact list is not the same as posting someone’s home address in a comment thread urging retaliation.
No Realistic Likelihood of Third-Party Harm
Even where some degree of ill will exists, the prosecution still has to prove the posted information was likely to incite or produce unwanted physical contact, injury, or harassment by a third party.1California Legislative Information. California Penal Code 653.2 Sharing a name without other identifying details, or posting to a small private group rather than a hostile public forum, may not meet that objective test.
Legitimate Purpose and Free Speech
The statutory definition of harassment excludes conduct that serves a legitimate purpose.1California Legislative Information. California Penal Code 653.2 Journalists reporting on public officials, activists documenting corporate misconduct, or researchers publishing findings that happen to identify individuals can argue their disclosures fall outside the statute. The First Amendment reinforces this: the government generally cannot punish truthful publication of information about matters of genuine public concern absent a state interest of the highest order.
Public interest is not a magic phrase, though. Courts look at whether the information actually informed the public about something meaningful or targeted a private individual for harassment dressed up as commentary. Posting a public official’s voting record is journalism. Posting a private citizen’s home address because you disagree with their social media opinions is not.
Civil Remedies for Victims
Criminal prosecution is the government’s decision. Victims have their own path.
Suing for Damages
A person who has been doxed can file a civil lawsuit seeking money damages for emotional distress, reputational harm, lost income, and out-of-pocket costs like relocating or upgrading security. The civil standard of proof is a preponderance of the evidence, lower than the criminal standard of beyond a reasonable doubt, which makes it easier for victims to prevail. Common theories include the tort of public disclosure of private facts, and, where the conduct rises to the level of stalking, a private cause of action under California Civil Code 1708.7.
Civil Harassment Restraining Orders
California Code of Civil Procedure 527.6 lets anyone who has suffered harassment petition for a civil harassment restraining order. The statute defines harassment to include a knowing and willful course of conduct directed at a specific person that seriously alarms, annoys, or harasses them, serves no legitimate purpose, and would cause a reasonable person substantial emotional distress.5California Legislative Information. California Code of Civil Procedure CCP 527.6 Persistent doxing fits.
A judge can issue a temporary order on an emergency basis before the other side appears. After a full hearing, if the judge finds harassment by clear and convincing evidence, the court can issue an injunction lasting up to five years, renewable for another five.5California Legislative Information. California Code of Civil Procedure CCP 527.6 A restraining order can bar direct or indirect contact, require a stay-away distance, and prohibit further online activity aimed at the victim. Violating one is a separate crime, and stalking someone while an order is in effect turns a potential misdemeanor into a guaranteed felony.
What to Do If You’ve Been Doxed
Knowing the law matters less if you don’t know what to do when it happens. The first hours after your information appears publicly are the ones that count.
Document everything before it disappears. Take screenshots of every post, comment, and profile that shared your information, with timestamps and URLs visible. Save the page source or use a web archive tool where you can. Content gets deleted, edited, or moved constantly, and once it’s gone, proving what was posted becomes far harder.
File a police report. Even if officers don’t act immediately, the report creates an official record that becomes important later if you seek a restraining order or push for criminal charges. Reference Penal Code 653.2 by name — not every officer is familiar with the statute — and bring your screenshots.
Request removal from the platforms where the material was posted. Most major services have policies against sharing private information and will take down posts that violate their terms. If your own copyrighted photos were reposted without permission, a DMCA takedown notice to the host is another route.
If the doxing is ongoing or you believe you’re in danger, consider petitioning for a civil harassment restraining order under CCP 527.6. Courts can issue a temporary order within days, and the process is designed to be accessible without an attorney, though having one helps. If the situation involves a credible threat of violence, call law enforcement immediately rather than waiting for the court process.
Finally, talk to an attorney about your civil options. The criminal system moves on its own timeline and at the prosecutor’s discretion. A civil lawsuit puts you in control, and the lower burden of proof means you may recover damages even if no criminal charges are ever filed.