Table of Contents
Is doxxing illegal?
By David L. Hudson, Jr.
Doxxing (sometimes spelled “doxing”) generally refers to the intentional release of an individual’s personal identifying information without the person’s permission, usually with the intent to retaliate or intimidate. This personal information could include home addresses, social security numbers, and names of employers.
This explainer briefly discusses the history and meaning of the term, identifies some state anti-doxxing laws, and then examines how these laws can conflict with fundamental First Amendment principles. It also shows how much of the concerns underlying anti-doxxing laws are covered by existing law.
The term doxxing arose from the computer hacker world in the 1990s, during the early years of the World Wide Web, and applied when a group of hackers exposed the identity of a fellow hacker who violated the norms of the hacker community, destroying their anonymity.
But now, the term has taken on a broader, even amorphous meaning. Much of what gets labeled “doxxing” today constitutes protected counter-speech or otherwise lawful conduct.
When, for example, a digital billboard truck circled Harvard Square showing the names and photos of students belonging to student organizations that signed a public letter holding Israel “entirely responsible” for the Oct. 7 Hamas attack, the act was widely referred to as “doxxing.” But, like the letter that prompted it, the truck’s message was protected speech, however distasteful, ineffective, or counterproductive some may have found the means of expressing it.
Consider also the following real case of alleged doxxing.
In Newberg, Oregon, three school board members voted to direct the school superintendent to remove all Black Lives Matter and Pride symbols from the local schools. Upset with these votes, several parents who were members of the Newberg Equity in Education group posted information about the school board members and contact information for their employers online. The three school board members sued under an Oregon anti-doxxing law that barred certain publications of personal identifying information of another with the knowledge that the doxxed individual would be stalked, harassed, or injured. In other words, the three school board members claimed that they were “doxxed.”
State laws addressing doxxing
Several states, like Oregon, have enacted so-called “anti-doxxing” laws. Some state laws actually use the term “doxxing.” Others do not. These laws differ in definition, application, and scope. For example, some laws criminalize the act of doxxing, while other state anti-doxxing laws, such as Illinois’ law, focus on civil liability.
Washington’s law defines doxxing as the “unauthorized publication of personal identifying information with intent or knowledge that the information will be used to harm the individual whose information is published, or with reckless disregard for the risk the information will be used to harm the individual whose information is published.”
Existing law already covers much of the unprotected expressive conduct often associated with doxxing via statutory protections against true threats, incitement to imminent lawless action, harassment, and the privacy tort of public disclosure of private facts.
Alabama defines doxxing as “electronically publish[ing] or provid[ing] personal identifying information of another individual, with the intent that others will use that information to harass or harm that other individual and the other individual is actually harassed or harmed,” and its law has a special section that applies to doxxing firefighters and police officers.
Defenders of these laws claim they are necessary to protect privacy and redress the emotional distress and harm caused by those who reveal personal information. Opponents point out that much of the unsavory conduct is covered by other existing laws. Meanwhile, free speech advocates argue that the push to pass anti-doxxing legislation can raise serious First Amendment issues.
Is doxxing illegal?
Doxxing laws sometimes run headlong into three fundamental First Amendment principles.
First, anti-doxxing laws often criminalize or impose civil liability for the publication of truthful information. This conflicts with a line of Supreme Court precedent establishing that the First Amendment generally protects the publication of truthful information. These cases involved newspapers, but the principle from these decisions also applies to bloggers and other publishers and speakers.
For example, in Smith v. Daily Mail Publishing Co. (1979), the Court held that “state action to punish the publication of truthful information seldom can satisfy constitutional standards.” This so-called “Daily Mail principle” ensures the press, or others who post truthful information, cannot face punishment for publishing the names of rape victims and juvenile offenders, as well as other sensitive information obtained lawfully. “Lawfully obtained” means the publisher obtained the information from, for example, a public record or material in the public domain, rather than intercepting the material illegally.
The First Amendment also protects publication of truthful information received from a human source. As the Supreme Court explained in Bartnicki v. Vopper (2001), it doesn’t matter if the source obtained the material unlawfully, as long as the publisher did not participate in the illegal action and merely received the information from the source.
Second, many anti-doxxing laws ignore the free speech principle that the First Amendment protects much offensive, obnoxious, and even repugnant speech. Justice William Brennan famously referred to this as “the bedrock principle” of the first freedom in the flag-burning case Texas v. Johnson (1989). Current Chief Justice John Roberts expressed this principle poignantly in Snyder v. Phelps (2011), stating that even the inflammatory rhetoric of the Westboro Baptist Church — known for picketing military funerals with signs that read “God hates fags” and “Thank God for dead soldiers” — was protected:
Speech is powerful. It can stir people to action, move them to tears of both joy and sorrow, and — as it did here — inflict great pain. On the facts before us, we cannot react to that pain by punishing the speaker. As a Nation we have chosen a different course — to protect even hurtful speech on public issues to ensure that we do not stifle public debate.
Finally, anti-doxxing laws fit uncomfortably with arguably the most important of all First Amendment principles, a concept from the celebrated libel law decision New York Times Co. v. Sullivan (1964): Namely, the “profound national commitment to the principle that debate on public issues should be uninhibited, robust, and wide-open, and that it may well include vehement, caustic, and sometimes unpleasantly sharp attacks on government and public officials.”
Some doxxers, for example, have exposed vitriolic online racism spewed by members of police departments. Other doxxers identified persons who participated in unlawful activities at the United States Capitol building on Jan. 6, 2021.
Let’s return to the school board case out of Oregon mentioned earlier, DeHart v. Tofte (2023). The ban on BLM and Pride symbols was a matter of public concern and significant public debate. For this reason, the Oregon Court of Appeals dismissed the school board members’ claims under the doxxing law as an impermissible strategic lawsuit against public participation (or SLAPP) suit. The appeals court explained each of the school board members had themselves published information about their employers, and held that a reasonable person in the position of a school board member would not suffer severe emotional distress under these circumstances. Furthermore, the First Amendment protects hurtful and even hateful speech that doesn’t fall into an established exception like true threats or incitement.
Conduct already covered by existing laws
Existing law already covers much of the unprotected expressive conduct often associated with doxxing via statutory protections against true threats, incitement to imminent lawless action, harassment, and the privacy tort of public disclosure of private facts.
Commentators Frank D. LoMonte and Paola Fiku explain in their 2022 article “Thinking Outside the Dox: The First Amendment and the Right to Disclose Personal Information” that “[h]arassment and threat laws already exist to penalize people who cross the line from disclosing information to actually acting on the information” and engaging in unprotected conduct such as stalking.
Why New York Times v. Sullivan matters more than ever
News
The 1964 Supreme Court case was a watershed moment in free speech law. Overturning it would be a disaster for free expression and democratic debate.
If doxxing falls into one of the other existing narrow categories of unprotected speech, it is also not protected. For example, if a doxxer utters a true threat the doxxer is not protected by the First Amendment. Likewise, if a doxxer incites imminent lawless action — intentionally provoking others to engage in immediate unlawful action — the doxxer is not protected by the First Amendment.
However, some state anti-doxxing laws punish individuals for providing information, such as the anti-doxxing law in Colorado, which stipulates that it is a misdemeanor to “to knowingly make available on the internet personal information about a protected person or the protected person’s immediate family” if the disclosure poses a threat to the person or the person’s immediate family. Although these anti-doxxing laws often require that the doxxer intend or have knowledge that others will use the information to cause harm, such laws are vulnerable to First Amendment challenges, as they appear to cover a broad range of unprotected speech.
Certain types of personal identifying information are confidential and should be kept private. Some private information must be kept confidential by law, such as medical records. And sometimes individuals engage in illegal or fraudulent activity to obtain the private information of another. Generally speaking, such illegal and fraudulent activity should be punished. But existing law already does this.
Furthermore, there already exists an invasion of privacy sub-tort called “public disclosure of private facts.” For example, Wisconsin’s privacy law defines this tort as “Publicity given to a matter concerning the private life of another, of a kind highly offensive to a reasonable person, if the defendant has acted either unreasonably or recklessly as to whether there was a legitimate public interest in the matter involved, or with actual knowledge that none existed.”
This tort, envisioned originally by Samuel Warren and Louis Brandeis (before he joined the Supreme Court) in their historic 1890 article in the Harvard Law Review, applies when a person discloses truly private information that would be highly offensive to a reasonable person and not of legitimate concern to the public. (To be fair, Brandeis and Warren did not use the specific term “public disclosure of private facts.” That honor goes to Dean William Prosser.)
Conclusion
Doxxing may appear unseemly and unsavory. It may cause some discomfort and/or distress. But, the rush to enact anti-doxxing legislation presents serious constitutional concerns. Many of the laws are too broad, potentially covering whistleblower activity and speech on matters of public concern, and don’t comport with fundamental First Amendment principles. And much of the offending conduct is already covered by existing law.
Last updated Feb. 28, 2024.