California's Doxxing Law: A Civil Remedy for Online Harassment
Understanding Civil Code Section 1708.89, the Doxing Victims Recourse Act
Most people don't think twice about the trail of personal information they leave online: a name here, an employer there, a photo tagged at a favorite restaurant. But in the wrong hands, these scattered breadcrumbs become a weapon. Doxxing—the deliberate exposure of someone's personal information to invite harassment from strangers on the internet—has ruined careers, forced families from their homes, and in extreme cases, led to physical violence. Until recently, California law offered victims few good options. Traditional privacy torts were a poor fit, and criminal statutes depended on prosecutorial interest. That changed on January 1, 2025, when Civil Code Section 1708.89—the Doxing Victims Recourse Act—took effect, giving victims a direct path to hold perpetrators accountable in civil court.
Recognizing this growing threat, California enacted Civil Code Section 1708.89, known as the Doxing Victims Recourse Act (Assembly Bill 1979). Signed by Governor Newsom in September 2024 and effective January 1, 2025, this statute provides victims of doxxing with a specific private right of action—a meaningful civil remedy to hold perpetrators accountable. For a California-based attorney, the key takeaway is that this statute fills a critical gap in civil litigation by allowing victims to sue for statutory damages without proving actual damages, while also providing for uncapped economic and non-economic damages, punitive damages, and attorney's fees.
If you or someone you know has been the target of doxxing, or if you're an attorney advising clients on these emerging issues, understanding this law is essential.
What Is Doxxing?
The term "doxxing" (sometimes spelled "doxing") derives from the hacker community's shorthand for "dropping documents." It refers to the act of publicly revealing previously private or semi-private personal information about an individual, typically through onlinechannels, with malicious intent to encourage harassment by third parties.
What makes doxxing so dangerous is that the person publishing the information doesn't need to lift a finger against the victim directly. Instead, they effectively paint a target on the victim's back and rely on the predictable behavior of malicious third parties—internet trolls, ideological opponents, or simply cruel strangers—to carry out the harassment. The doxxer creates the conditions for harm while maintaining plausible deniability about the consequences.
Doxxing can take many forms. Common methods include data aggregation (compiling scattered public records like voter logs and property records to reveal a home address), social engineering (tricking service providers into releasing account details), Who is queries to identify website owners who failed to use privacy guards, and outright hacking to access private databases or accounts. According to a 2021 Pew Research Center study, approximately 41 percent of Americans have experienced some form of online harassment. The legislative history of California's doxxing statute cites this research and notes that “as our society becomes ever more dependent on technology and the internet, this issue will continue to exist."
Why Was a New Statute Needed?
Before the Doxing Victims Recourse Act, victims seeking civil remedies were forced to rely on ill-fitting traditional torts. Claims for intentional infliction of emotional distress (IIED) require proof of conduct so "outrageous" that it exceeds all bounds of decency—a notoriously difficult standard to meet. Claims for public disclosure of private facts often failed because the information disclosed (such as a home address) might be technically available in public records, even though no reasonable person would expect it to be compiled and broadcast to a hostile audience.
California did have a criminal statute addressing similar conduct—Penal Code Section 653.2 criminalizes electronic distribution of personal information with intent to cause harassment. However, criminal prosecution requires a high burden of proof, depends on police interest and resources, and offers no financial compensation to the victim. The Doxing Victims Recourse Act fills this gap by providing a direct civil remedy with robust damages provisions designed to make litigation viable even for victims who struggle to prove quantifiable financial loss.
Elements of a Doxxing Claim Under Section 1708.89
Civil Code Section 1708.89 provides a precise definition of actionable doxxing. To prevail on a claim, a plaintiff must establish each of the following elements:
1. Intent to Place the Victim in Fear
The defendant must have acted with the intent to place the victim (or the victim's immediate family) in reasonable fear for their safety. This is a subjective intent requirement—the plaintiff must demonstrate that the defendant actually intended to cause fear, not merely that fear was a foreseeable consequence of their actions. However, as with most intent elements, this can often be proven through circumstantial evidence and reasonable inferences drawn from the defendant's conduct. This specific intent requirement is important: it helps the statute navigate First Amendment concerns by targeting malicious conduct rather than protected speech.
2. Use of an Electronic Communication Device
The information must have been distributed "by means of an electronic communication device." In practice, this element is easily satisfied given that virtually all modern dissemination of information—whether through email, social media, websites, text messages, or press releases distributed electronically—involves electronic communication devices. The statute is drafted broadly to capture the full range of digital communication methods.
3. Lack of Consent
The victim must not have consented to the disclosure of their personal information. While some personal information is publicly available, that does not mean an individual has consented to having that information weaponized and broadcast to a hostile audience for the purpose of facilitating harassment.
4. Purpose of Causing Imminent Harm or Harassment
The defendant must have acted "for the purpose of imminently causing" the victim unwanted physical contact, injury, or harassment by a third party. This element distinguishes malicious doxxing from legitimate disclosures of information. The inquiry focuses on the purpose behind the disclosure—was the information released to facilitate harm, or for some legitimate reason?
5. Electronic Distribution of Personal Identifying Information
The defendant must have "electronically distributes, publishes, emails, hyperlinks, or makes available for downloading" the victim's personal identifying information. This includes, but is not limited to: a digital image of the victim; an electronic message of a harassing nature about the victim; or any other information that would be likely to incite or produce the unlawful conduct.
6. Likelihood of Inciting Harassment or Harm
Finally, the disclosure must be "likely to incite or produce" unwanted physical contact, injury, or harassment by third parties. This is an objective standard—the question is whether a reasonable person would recognize that the disclosure was likely to result in harm to the victim. Courts will consider the context of the disclosure, the nature of the information revealed, and the foreseeable reaction of those receiving the information.
What Constitutes "Personal Identifying Information"?
The statute defines "personally identifying information" broadly. Section 1708.89(a)(5) explicitly includes a person's "name or any part thereof." This is significant because it means that simply revealing someone's identity—even without their address, phone number, or other traditional identifiers—can form the basis of a doxxing claim if the other elements are satisfied.
Additionally, Section 1708.89(a)(7) covers any information that would tie a person to an online account. In today's social media landscape, a person's name alone is often sufficient to locate their online accounts, which in turn provide a direct channel for harassment through comments, direct messages, and other interactions. The statute recognizes this modern reality.
Other examples of personally identifying information include: home addresses; phone numbers; email addresses; places of employment; photographs; social security numbers; financial account information; and information about family members. Any information that could enable a bad actor to locate, contact, or target the victim may qualify.
Available Damages and Remedies
One of the most significant features of Section 1708.89 is its robust remedies provision, designed to make litigation viable for victims who might otherwise struggle to prove quantifiable financial loss:
Statutory Damages
The statute provides for statutory damages between $1,500 and $30,000. This is a crucial provision because it allows recovery even without proof of out-of-pocket losses. Many doxxing victims suffer profound harm—fear, anxiety, disruption to their lives—that is difficult to quantify in dollar terms. Statutory damages ensure that victims can obtain meaningful compensation and that defendants face real consequences for their conduct.
General and Special Damages
In addition to or instead of statutory damages, victims may recover uncapped economic and non-economic damages. Economic damages may include lost business, costs of relocating, expenses for enhanced security measures, and lost wages. Non-economic damages may include compensation for emotional distress, anxiety, fear, and loss of enjoyment of life.
Punitive Damages
Where the defendant's conduct is sufficiently egregious—demonstrating malice, oppression, or fraud—punitive damages may be awarded to punish the wrongdoer and deter similar conduct by others.
Attorney's Fees and Costs
The prevailing plaintiff is entitled to reasonable attorney's fees and costs. This provision is critical because it incentivizes attorneys to take these cases on behalf of victims who might not otherwise be able to afford legal representation. It also provides significant leverage in settlement negotiations.
Injunctive Relief
Courts may issue temporary restraining orders (TROs), preliminary injunctions, and permanent injunctions to stop the dissemination of personal information and prevent ongoing or future doxxing conduct.
Procedural Protections for Victims
The statute includes an important procedural protection: it explicitly authorizes courts to allow plaintiffs to proceed using a pseudonym (such as "Jane Doe" or "John Doe"). This provision recognizes the cruel irony that would otherwise exist—a victim seeking redress for having their identity maliciously exposed would be forced to further publicize that identity through the public litigation process. By permitting pseudonymous litigation, the statute helps prevent further re-victimization.
Potential Defenses and Privileges
Defendants facing doxxing claims may raise various defenses and privileges. Understanding these potential defenses is important for both plaintiffs considering litigation and attorneys advising potential defendants.
The Litigation Privilege
California Civil Code Section 47(b) provides a broad privilege for communications made in connection with judicial proceedings. Defendants may argue that statements made about pending litigation are protected by this privilege. However, courts have recognized important limitations.
In Dziubla v. Piazza (2020) 59 Cal.App.5th 140, the Court of Appeal held that while statements about a person's character in connection with litigation may be privileged, “doxing information" that is "entirely extraneous to the court proceedings" falls outside the privilege's protection. The test is whether the personal information served any legitimate litigation-related purpose.
Additionally, at least one appellate court has held that "the litigation privilege does not apply to publications to the general public through the press" because the press lacks the substantial interest in the litigation that would trigger the privilege's protections. (Abuemeira v. Stephens (2016) 246 Cal.App.4th 1291, 1299.)
The Fair Reporting Privilege
Civil Code Section 47(d) provides a privilege for "fair and true" reports of judicial proceedings. Defendants may argue that their statements accurately reported on court filings or proceedings. However, this privilege protects accurate reporting of what was said in court proceedings—it does not provide blanket protection for any statement made about litigation. If a defendant discloses information that goes beyond what was actually contained in court filings, or reveals information that was not part of the judicial record, the fair reporting privilege may not apply.
First Amendment Considerations
Defendants may also raise First Amendment defenses, arguing that the disclosure of information was protected speech. The Supreme Court has recognized that publication of truthful, lawfully obtained, public information is generally protected. (Florida Star v. B.J.F. (1989) 491 U.S. 524.) Because doxxing claims often arise from statements made in connection with matters of public interest, defendants may file anti-SLAPP motions (Special Motions to Strike under Code of Civil Procedure Section 425.16), arguing that the claim targets constitutionally protected activity.
The Doxing Victims Recourse Act navigates these constitutional concerns by requiring specific malicious intent and proof of harm. The statute targets conduct—the purposeful weaponization of personal information to facilitate harassment—rather than speech itself. Under California's anti-SLAPP framework, if the defendant shows the claim arises from protected activity, the burden shifts to the plaintiff to demonstrate a probability of prevailing on the merits at an early stage of litigation.
Practical Considerations for Victims
If you believe you have been the victim of doxxing, there are several immediate steps you should consider taking. First, document everything. Preserve screenshots, URLs, and copies of the offending posts or communications before they can be removed or modified—doxxing posts are often deleted quickly once the perpetrator realizes there may be legal consequences. Be sure to capture metadata where possible, including timestamps and the URL of the offending content.
Second, take steps to protect yourself—this may include making social media accounts private, alerting local law enforcement, changing phone numbers if necessary, and considering whether enhanced security measures are warranted. Third, consult with an attorney experienced in privacy torts and online harassment to evaluate your legal options.
It is important to understand that the statute requires proof of specific intent and purpose—general negligence or carelessness in handling personal information, while potentially actionable under other legal theories, may not satisfy the elements of a Section 1708.89 claim. An experienced attorney can help you assess whether your situation fits within the statute's requirements.
Conclusion
California's Doxing Victims Recourse Act represents an important step forward in providing legal recourse for victims of a distinctly modern form of harassment. By creating a private right of action with meaningful statutory damages, attorney's fees provisions, and procedural protections for victims, the statute acknowledges that in the digital age, revealing someone's personal information to a hostile audience can be just as harmful as direct threats or harassment.
At the same time, the statute's specific intent and purpose requirements, combined with the availability of privilege defenses and First Amendment protections, ensure that legitimate speech and reporting are not chilled. The law targets bad actors who weaponize personal information to facilitate harm—not journalists reporting on matters of public concern, not litigants discussing their legal disputes, and not individuals engaged in protected commentary.
If you have questions about whether you may have a claim under Section 1708.89, or if you are facing a potential claim and need defense counsel, we encourage you to contact our office to discuss your situation.
Disclaimer: This blog post is provided for informational purposes only and does not constitute legal advice. The information contained herein should not be relied upon as a substitute for consultation with a qualified attorney regarding your specific situation. The law discussed in