Doxxing is a specific crime in Australia but not, as such, in the UK, the US or Canada. Under the Privacy and Other Legislation Amendment Act 2024, it has been an offence since 11 December 2024 to use a carriage service to publish someone's personal data in a way reasonable people would regard as menacing or harassing, with up to 6 years' imprisonment. In the other three countries, publishing someone's details becomes illegal when it amounts to harassment, stalking, threats or a data-protection offence, and some US states, such as California and Washington, also let the person targeted sue.
This page answers the legal-status question only, as general information rather than legal advice. Reducing what can be found about you is covered in the doxxing exposure audit, the first hour, day and week after a dox are covered in the doxxing response plan, and suing over a privacy invasion in Australia is covered in the privacy tort guide.
What the law treats as doxxing
Most laws never use the word. Australia's is the exception, and its note gives the classic example: publishing someone's name, image and telephone number on a website and encouraging others to repeatedly contact them with violent or threatening messages. The offence defines personal data as information that lets a person be identified, contacted or located, and lists name, photograph or other image, phone number, email address, online account, home address, work or business address, place of education and place of worship.
Two features of that list matter for creators. An online account counts as personal data, so tying your creator profile to your personal profile can be part of the conduct even if no address is posted. And the test is objective: the question is whether reasonable persons would see the publication as menacing or harassing in all the circumstances, not whether the poster says they meant it as a joke. A second offence, section 474.17D, covers the same conduct aimed at members of a group because of a belief about race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality, or national or ethnic origin, and the amending Act sets its maximum at 7 years.
Jurisdiction table
Each row is a law that can apply to publishing someone's details, not a promise that it applies to yours. The linked text is where the elements and exceptions live.
| Jurisdiction and law | Conduct covered | Where to report |
|---|---|---|
| Australia: Criminal Code section 474.17C | Using a carriage service to publish or distribute personal data in a way reasonable people would regard as menacing or harassing | State or territory police; eSafety's adult cyber abuse scheme for removal once the platform has had a chance to act |
| Australia: Criminal Code section 474.17D | The same conduct aimed at members of a group because of a belief about a protected attribute | Police, mentioning any hateful language in the posts |
| England and Wales: Protection from Harassment Act 1997, ss 2 and 2A | A course of conduct amounting to harassment or stalking, where publishing material about a person is one listed stalking behaviour | Police; the same Act also allows a civil claim for damages and an injunction |
| England and Wales: Protection from Harassment Act 1997, s 4A | Stalking that causes fear of violence on at least two occasions, or serious alarm or distress that substantially disrupts daily life | Police, or 999 if someone has come to your home |
| England, Wales and Northern Ireland: Online Safety Act 2023, s 181 | Sending a message that conveys a threat of death or serious harm, intending or reckless as to the recipient's fear | Police, with the message preserved in its original form |
| United Kingdom: Data Protection Act 2018, s 170 | Knowingly or recklessly obtaining or disclosing personal data without the consent of the organisation that controls it, such as a leak from a customer database | Police, and the organisation whose records were used |
| United States: 18 U.S.C. 2261A | A course of conduct through an online service, with intent to harass or intimidate, that causes reasonable fear of death or serious bodily injury, or substantial emotional distress | Local police and the FBI |
| United States: 18 U.S.C. 119 | Publishing restricted personal information, such as a home address, of federal officials, jurors, witnesses and certain other covered people | Only relevant if you fall within a covered group |
| California: Penal Code 653.2 | Electronically distributing personal identifying information to put someone in reasonable fear, for the purpose of imminent harassment or injury by others; a misdemeanour carrying up to one year in county jail, a $1,000 fine, or both | Local police in California |
| California: Civil Code 1708.89 | A civil claim against a person who doxes you, effective from 1 January 2025, with statutory damages of $1,500 to $30,000 | A California lawyer; the plaintiff may sue under a pseudonym |
| Washington: RCW 4.24.792 | Publishing personal identifying information without consent, knowing or reckless about harm, causing injury, mental anguish, fear or a substantial life disruption; statutory damages of $5,000 per violation | A Washington lawyer, who can also seek an injunction |
| Canada: Criminal Code section 264 | Criminal harassment that causes reasonable fear for your safety, psychological safety included, with up to 10 years on indictment | Local police service |
Australia: a dedicated offence since December 2024
Sections 474.17C and 474.17D were inserted by Schedule 3 of the 2024 Act, which commenced the day after Royal Assent, on 11 December 2024. They sit beside the older offence of using a carriage service to menace, harass or cause offence, which can still apply. The criminal route punishes the poster; it does not remove the post. For removal, eSafety's adult cyber abuse page describes serious abuse as including someone sharing your personal details or encouraging others to pile on, and asks you to report it to the service first. If you want compensation or an injunction from the person responsible, the statutory privacy tort is the civil route.
United Kingdom: harassment, threats and data law
There is no offence called doxxing in UK law, so the question is which existing offence the facts fit. Harassment needs a course of conduct, which section 7 of the 1997 Act says means conduct on at least two occasions where one person is targeted. A single post of your address may therefore fall short, while repeated posts, a post plus messages, or a campaign that others are encouraged to join may not. Section 2A lists acts associated with stalking, including contacting a person, publishing material relating to them and monitoring their use of the internet.
Threats sent alongside the details can be charged under section 181 of the Online Safety Act whether or not a course of conduct exists, and the Malicious Communications Act and section 127 of the Communications Act cover indecent, grossly offensive or menacing messages. Where the details came out of an organisation's records, for instance an employee looking you up, section 170 of the Data Protection Act may be the better fit. On the civil side, section 3 lets you claim damages for anxiety and financial loss and seek an injunction, and a breach of that injunction can lead to an arrest warrant. The harassment provisions apply in England and Wales only; Scotland and Northern Ireland have their own harassment laws.
United States: a federal gap and state patchwork
No federal statute makes doxxing a general crime. The federal stalking law reaches online courses of conduct intended to harass or intimidate, and 18 U.S.C. 119 protects only covered people such as federal officials, jurors and witnesses. States fill the gap unevenly. California has both a criminal provision and, since 2025, a civil claim that lets a plaintiff proceed as Jane or John Doe and redact identifying details from court filings, which matters to anyone who keeps a stage name separate from a legal name. Washington's civil doxing statute adds that it is no defence that the information was previously public or easy to find, while also stating that it must not be read to prohibit constitutionally protected activity.
Canada: criminal harassment does the work
Canada's Criminal Code has no offence named doxxing, but section 264 covers repeatedly communicating with you or anyone known to you, monitoring your location, movements, actions or social interactions, watching your home or workplace, and threatening conduct, where it could reasonably make you fear for your safety. The current text says safety includes psychological safety, which suits doxxing cases where nobody has turned up yet but the fear is real. Publishing details once, with nothing more, may not meet the test on its own.
Evidence log built around the legal tests
An incident log records where copies appear. This log records why the conduct may be unlawful, so police or a lawyer can see each element covered. Fill in one row per element and keep updating it.
| What the law looks at | What to record | Laws it supports |
|---|---|---|
| Personal data exposed | Each item published: legal name, suburb or address, workplace, phone, email, linked accounts, photos of your home or car | The Australian personal data list and the US state definitions |
| How it was published | The service, the exact link, and whether it was a post, message, document, map pin or stream | Carriage service and electronic communication elements |
| Menacing or threatening context | Calls to visit, contact or expose you, and any threat, copied word for word | The Australian objective test, UK threats offence and California's criminal provision |
| Repetition | Every occasion with its date and time, including reposts and new accounts run by the same person | UK course of conduct, US federal stalking and Canadian harassment |
| Intent or knowledge | Anything the poster said about what they wanted to happen, or that shows they knew it would frighten you | UK ought-to-know test, US intent elements and Washington's recklessness standard |
| Effect on you | Fear, sleep or routine changes, security costs, time off work, moving or staying elsewhere | UK serious alarm or distress, Canadian psychological safety and US damages claims |
| Consent | A dated note that you never agreed to the details being shared, and where you had kept them private | Washington and California civil claims, and Australia's privacy tort |
| Reports made | Platform, police and regulator reference numbers, dates and outcomes | Every route, since each body asks what you have already tried |
When to call police or a lawyer
- Someone is at your door, following you or threatening violence: call 000, 999 or 911 straight away.
- Your details are posted with threats or calls for people to visit you: report to police the same day, then use the threat triage guide.
- The same person keeps finding new ways to reach you: treat it as stalking and follow the stalking safety plan, which covers protection orders.
- You know who did it and want it to stop for good: a lawyer can advise on injunctions, harassment claims and the privacy tort or US state statutes above.
- The details came from a business that holds your data: ask a lawyer whether a data-protection complaint or offence fits, and tell the business in writing.
Limitations of this comparison
This is general information drawn from legislation read on 1 October 2026, not legal advice, and it covers a small selection of laws. Many other US states have their own statutes, Scotland and Northern Ireland have separate rules, and courts interpret phrases like menacing or harassing according to the facts. Police and prosecutors also decide which matters to take on. If you are in danger, call emergency services; otherwise report to police and speak to a lawyer, community legal centre or legal aid service in your jurisdiction about your own situation.