Most people don't think twice about the trail of personal information they leave online. But in the wrong hands, those scattered breadcrumbs become a weapon. Doxxing — the deliberate exposure of someone's personal information to invite harassment from strangers on the internet — has ruined careers, forced families from their homes, and in extreme cases, led to physical violence.
Until recently, California law offered victims few good options. That changed on January 1, 2025, when Civil Code Section 1708.89 — the Doxing Victims Recourse Act — took effect, giving victims a direct path to hold perpetrators accountable in civil court.
Before this law, victims of doxxing had to rely on ill-fitting traditional torts. Intentional infliction of emotional distress requires proof of conduct so "outrageous" it exceeds all bounds of decency — a notoriously difficult standard to meet. Public disclosure of private facts often failed because the information disclosed (like a home address) might be technically available in public records, even though no reasonable person would expect it to be compiled and broadcast to a hostile audience.
California did have a criminal statute — Penal Code Section 653.2 — that criminalizes electronic distribution of personal information with intent to cause harassment. But criminal prosecution requires a high burden of proof, depends on police resources and interest, and offers no financial compensation to the victim.
The Doxing Victims Recourse Act fills this gap with a direct civil remedy and robust damages provisions designed to make litigation viable even for victims who struggle to prove quantifiable financial loss.
To prevail on a claim under Section 1708.89, a plaintiff must establish several elements. The defendant must have acted with intent to place the victim or their immediate family in reasonable fear for their safety. The information must have been distributed electronically. The victim must not have consented to the disclosure. The defendant must have acted for the purpose of imminently causing unwanted physical contact, injury, or harassment by a third party. And the disclosure must be objectively likely to incite or produce that harm.
The statute defines this broadly. It explicitly includes a person's name or any part of it — meaning that simply revealing someone's identity can form the basis of a claim if the other elements are satisfied. It also covers home addresses, phone numbers, email addresses, places of employment, photographs, financial account information, information about family members, and anything that ties a person to an online account.
One of the most significant features of the statute is its damages provisions.
Statutory damages between $1,500 and $30,000 are available without proof of out-of-pocket losses. This is crucial because many doxxing victims suffer harm — fear, anxiety, disruption to their lives — that is difficult to quantify in dollar terms.
General and special damages are uncapped. Economic damages may include lost business, costs of relocating, and enhanced security expenses. Non-economic damages may include compensation for emotional distress, anxiety, and loss of enjoyment of life.
Punitive damages are available where the defendant's conduct demonstrates malice, oppression, or fraud.
Attorney's fees and costs go to the prevailing plaintiff, which incentivizes attorneys to take these cases on behalf of victims who might not otherwise afford representation.
Injunctive relief allows courts to issue restraining orders and injunctions to stop the dissemination of personal information.
The statute also authorizes courts to let plaintiffs proceed using a pseudonym, recognizing the irony of forcing a doxxing victim to further publicize their identity through public litigation.
Defendants may raise the litigation privilege under Civil Code Section 47(b) for communications made in connection with judicial proceedings — though courts have held that doxxing information "entirely extraneous to court proceedings" falls outside this protection. The fair reporting privilege under Section 47(d) may apply to accurate reports of judicial proceedings, but not to disclosures that go beyond the judicial record. First Amendment defenses may also arise, but the statute navigates these concerns by requiring specific malicious intent rather than targeting speech itself.
If you've been the target of doxxing, there are immediate steps you should take: preserve screenshots and metadata before posts are deleted, make social media accounts private, alert local law enforcement, and consult with an attorney experienced in privacy torts and online harassment.
At Arns Davis Law, we can help evaluate whether your situation fits within the statute's requirements. Call us at (415) 495-7800 for a consultation.
Free consultation. No fees unless we win your case. When you call, you’ll speak with a real person — not a call center.
Call (415) 495-7800