Doxxing is a federal crime in certain cases

Rappers Megan Thee Stallion and Nicki Minaj have had a long standing-feud, referenced in their new songs “Hiss” and “Bigfoot.” Recently, reports online claim the beef between the two has taken a turn for the worse, this time involving Minaj’s fans. 

According to TMZ, Minaj’s fans shared the location of Megan Thee Stallion’s mother’s gravesite in Texas. The people who released the information are now being accused of doxxing.

Doxxing is the practice of gathering private or identifying information and sharing it with the public without permission. Oftentimes, people who dox others are trying to harass, threaten or shame them, or exact some form of revenge. 

Some people on social media have claimed doxxing is illegal, while others say it isn’t. Google searches about doxxing have also recently spiked. 

THE QUESTION

Is there a federal law against doxxing?

THE SOURCES

• 18 U.S.C. § 119 (2021)
• Interstate Doxxing Prevention Act
• Social Media Victims Law Center
• Various state laws on doxxing
• MalwareBytes, a cybersecurity company
• Spokesperson with the Anti-Defamation League (ADL)
• UC Berkeley Office of Ethics
• FBI public service announcement on doxxing released in April 2015

THE ANSWER

Yes, there is a federal law against doxxing. But it only protects certain people, not everyone in the U.S. 

WHAT WE FOUND

While the word “doxxing” isn’t used in the U.S. federal criminal code, it is a federal crime to make “restricted personal information” of certain individuals publicly available if it was done with an intent to threaten, intimidate or in an act of violence. 

“Restricted personal information” can include the social security number, home address, home phone number, cell phone number, personal email address or home fax number, the law says. 

The federal law applies to the following individuals and their immediate family members:

• An elected official or employee of the U.S. government or military servicemember
• Jurors, witnesses or any other officer of any federal court in the U.S. 
• An informant or witness in a federal criminal investigation or prosecution
• State or local worker or elected official whose restricted personal information is made available because of participating in, or assistance provided to, a federal criminal investigation.

The punishment for doxxing someone in any of those categories is up to five years in prison and a fine.

Legislation that would make doxxing a federal crime if committed against anyone in the U.S. – not just certain individuals or groups – was introduced in 2016, but it hasn’t made it out of committee.

Regarding the allegations of doxxing conducted by Minaj’s fans against Megan Thee Stallion, if charged, those wouldn't be federal offenses. But that doesn’t mean it’s not against the law in specific states. 

Many states have their own doxxing laws; some apply to broader groups of people and others allow for civil litigation. In civil cases, a victim of doxxing could sue in a civil court for monetary damages. 

According to the Social Media Victims Law Center (SMVLC), a law firm that works with victims of social media abuse, some states have laws generally criminalizing doxxing, but “most [states] focus on protecting people in specific occupations, such as health care workers, law enforcement and government employees.” 

For example, in Colorado, it is a criminal offense to dox healthcare workers, educators, child protection workers, code enforcement officers and other public-facing workers like animal control officers. It's a misdemeanor offense punishable by up to 18 months in jail and a fine.

In New Jersey, the doxxing laws are similar to the federal law. Under “Daniel’s Law,” doxxing active, formerly active and retired local or state judicial officers, prosecutors or law enforcement officers and their family members is a third or fourth-degree crime. Depending on the severity of the crime, a person can face up to five years in prison and fines. A victim of doxxing can also take civil action in New Jersey under this law.

In Illinois, doxxing is not a state crime, but a victim can take civil action if the information was published with the intent to cause harm, or if the publishing of information caused mental, economical harm or life disruption.

A spokesperson with the Anti-Defamation League, an organization that specializes in civil rights laws, told VERIFY someone could be charged with doxxing in a state that prohibits it, even if they commit the crime in a state where doxxing isn't illegal, but it would require jurisdictions to work together.

“A lot of state legislation specifically notes the ability to hold someone accountable in a state where any part of the doxing occurred or where the perpetrator or target resides. However, that state’s enforcement powers are limited to its own jurisdiction, and without the perpetrator entering the state, local law enforcement would need to seek the cooperation of the state in which the perpetrator resides in order to seek an arrest and extradition. This is unlikely to occur in misdemeanor cases, and is seen more frequently in situations involving felony charges,” the ADL spokesperson said in an email.

Doxxing as an isolated act might not be illegal in all states, but when it’s done in connection with another crime like stalking, cyberstalking or harassment, someone could be charged with that crime, according to MalwareBytes, a cybersecurity company.  

To find out whether your state has anti-doxxing laws, contact your local police department or search for your state’s name and “anti-doxxing law.” 

To protect yourself from doxxing, UC Berkeley Office of Ethics and a 2015 public service announcement from the FBI offers these tips:

• Adjust your social media settings and advise family members to do the same:
  • Ensure that your profiles, usernames/handles are kept private.
  • Remove any addresses, places of work, and specific locations from your accounts.
  • Set your posts to “friends only."
  • Avoid discussing personal information that could be used against you, as well as anything that can identify your address, workplace or contact information.

• Use a Virtual Private Network (VPN).

  • If you must use public wi-fi, turn off the public network sharing functionality on your device.

• Use strong passwords or two-factor authentication on your personal email accounts.
• Vary usernames and passwords across platforms.
• Hide domain registration information from WHOIS (a database of all registered domain names on the web).
• Pay close attention to all work and personal emails, especially those containing attachments or links to other websites. Some links could be phishing attempts to receive or gather personal information.
• Routinely conduct online searches of your name to identify what public information is already available.