There is no consistently applied federal doxing law, and it is unlikely that this issue can be effectively addressed on a national level.^[1] While a federal law could be created,^[2] it may not be the most effective way to combat doxing. States are better positioned to address the harm caused by doxing.^[3] The issue is often triggered by specific, localized events and can have severe economic consequences within particular communities.^[4] By addressing doxing on a state-by-state basis, statutes can be tailored to the unique concerns and circumstances of each state, allowing them to allocate resources based on local priorities. States have different interests, political landscapes, and cultures.Georgia, for example, can craft a doxing statute that directly responds to its specific needs without the risk of being overly broad or unclear. States should have the authority to define what behavior is tolerable within their borders.

Many scholars argue that laws against doxing are not only unnecessary, but constitutionally dangerous.^[5] Freedom of speech is one of our most cherished rights, and efforts to limit speech have not fared well in the Supreme Court.^[6] Although some may believe certain types of speech have no value, there is intrinsic value in the way we are allowed to speak freely in America. When speech is limited, there is a risk of chilling expression, as individuals may be deterred from speaking their minds out of fear of legal consequences.^[7] Opponents of doxing statutes suggest that doxing is already addressed through existing tort and criminal laws, and creating new laws would only have negative consequences for society.^[8]

This perspective assumes that courts will apply existing statutes without concern for the potential overreach of the law. Courts generally prefer to interpret statutes narrowly, avoiding the extension of laws to their absolute limits.^[9] Courts will construe statutes as narrowly as possible to avoid interfering with the other branches of government.^[10] This concept is referred to as judicial modesty and it is written into the constitution.^[11] When Congress enacts legislation, it aims to criminalize specific behaviors, which is why statutory interpretation relies on congressional findings, discussions, and definitions.^[12] Statutes are generally not intended to be read broadly.^[13] It is unrealistic to expect that a plaintiff can easily categorize doxing under other civil wrongs without encountering issues in a lawsuit.^[14] The harm caused by doxing goes far beyond what is typically covered by traditional causes of action. Doxing involves much more harm than a single threatening phone call or negative social media post.^[15] It is a deluge of thousands of threats through every means of contact available in the twenty-first century.^[16] Doxing can not only lead to someone losing her job, but it can also permanently damage her ability to secure employment in the future.^[17] Victims of doxing may also have deep personal violations inflicted upon them, such as the creation of AI-generated pornography that is shared not only with their closest friends and family, but also made publicly accessible.^[18] Doxing can involve threats of violence, sexual harassment, and death, leaving victims afraid to leave their homes.^[19] Although defamation and privacy torts are designed to protect individuals from reputational harm, they do not address the full scope of harm caused by doxing. Georgia did not pass defamation laws with the intention of addressing doxing, as defamation laws predate the invention of the computer and the digital age.^[20] In a civil court, someone trying to receive damages for doxing might not survive a motion to dismiss.^[21] Courts often interpret statutes in the strictest possible terms. By refusing to address doxing through specific legislation, we have created a situation where liability or guilt becomes a matter of uncertainty and speculation.^[22]

There is an underlying economic issue present in civil law as well. Litigation is expensive, and costs are only rising.^[23] Lawyers can charge more than $500 an hour.^[24] In Georgia, the average hourly wage is twenty-seven dollars.^[25] Litigation is often beyond the financial reach of the average person, and Georgia’s failure to criminalize doxing places is an unfair burden on its citizens. This effectively means that justice is determined by one’s ability to pay for it.

There is value in criminalizing doxing. Laws are enacted to deter harmful behavior. Even if no case is ever prosecuted, having such a law on the books can still have a meaningful impact.^[26] State-funded enforcement would help alleviate the financial burden on victims. Current privacy torts are insufficient to allow victims of doxing to recover damages. Legally, information such as home addresses have been treated as public record, making it difficult to seek redress under existing laws. A plaintiff seeking to pursue claims under public disclosure of private facts or intrusion upon seclusion would likely face an unviable claim, as the allegations would fail to meet the essential elements of any privacy tort.

In criminal cases, the court determines the meaning of words by looking to the context in which they were spoken. When someone publishes another person’s information online due to a disagreement, the message is not simply, “I am sharing publicly recorded information.” The intent is malicious, signaling others to attack and harass the individual involved. Georgia law recognizes exceptions for speech of this nature known as “fighting words.” These are statements intended to incite violence and are subject to legal punishment.^[27] The Supreme Court has consistently upheld certain forms of censorship, allowing the government to prohibit the publication of obscenity and pornography despite the right to free speech.^[28] While it takes a strong argument to overcome the presumption of freedom granted by the Constitution, as established in Schenck v. United States,^[29] there are limits. When speech is intended to incite a crime and poses a clear and present danger of that crime occurring, the First Amendment no longer protects the speaker from prosecution.^[30] The court must balance the right to free speech with the welfare of American citizens, and in some situations, public safety takes precedence.^[31] Courts have recognized that exposing a person’s personal information can constitute a true threat,^[32] a concept that, while not always obvious, is not as novel as it might seem.

The government should have a vested interest in protecting the well-being of its citizens. We encourage vigilantism in no other area of the law.^[33] Our justice system is built on the principle that people are innocent until proven guilty.^[34] Doxing directly undermines this principle, as it can ruin a person’s life regardless of their actual guilt or innocence.^[35] In this realm, the court of public opinion often prevails over established law. Livelihoods can be irreparably harmed simply because strangers on the internet decide to target someone.^[36] Georgia’s failure to legislate against doxing is a great disservice to its citizens. The state’s political climate, along with its growing significance in federal elections, places its residents at heightened risk of being doxed.^[37]

The argument that criminalizing doxing would undermine our freedom is a fallacy. Freedom of speech and the prohibition of doxing are not mutually exclusive concepts. The right to anonymity is integral to promoting free speech because it encourages people to engage in vital discourse without fear of reprisal.^[38] America was founded with an understanding of the value of anonymous speech.^[39] Thomas Paine did not sign his pamphlets, and Alexander Hamilton did not put his name on the Federalist Papers.^[40] The First Amendment protects more than speech; it also safeguards our right to assembly, which can be interpreted as the right to speak without association.^[41] Anonymity has power, and individuals should be able to express themselves online without fear of being doxed. Digital platforms, which have become the primary modes of communication, make it easier than ever to expose someone's private information on a massive scale.^[42] The threat of doxing forces people to self-censor, preventing them from speaking freely.^[43] There is a clear distinction between engaging in an online argument and doxing someone. Doxing is harassment. It can cause immense harm, and victims often fear for their lives. This represents a clear and present danger that people face every day.^[44] Georgia must act on behalf of its citizens to prevent these situations from escalating—because they are already escalating.

The quarterback for the University of Georgia was doxed after fans were upset with his performance in a recent game.^[45] Since November 5, 2024, there has been a documented and quantifiable rise in online harassment directed towards women, which has resulted in these victims being doxed and swatted.^[46] Georgia’s current Secretary of State, Brad Raffensperger, was doxed after he refused to find eleven thousand votes for President Donald Trump.^[47] Grand Jurors in Fulton County were doxed after indicting President Trump in April 2023.^[48] It can be assumed that incidents like these will continue to occur unless proactive measures are taken. Given Georgia's unique political climate and rising prominence in national elections, the state has compelling reasons to act.

The digitization of society over the past decade has amplified the potential harm of doxing. Society is more digitized than it has ever been, and the internet will remain an integral part of our lives for the foreseeable future.^[49] In 2023, the FBI received 880,418 cybercrime complaints from the public, a 10% increase from 2021. Roughly four-in-ten Americans have personally experienced online harassment.^[50] As a state, Georgia should be interested in getting ahead of this trend. Our detectives, police officers, and prosecutors should have the tools to pursue digital crime— we should not be forcing them to act on things they simply do not have the resources to manage. They should be versed in the type of investigation cybercrimes require. There does not need to be a catastrophic event that compels Georgia’s government to legislate—we can choose to act on this now. Current criminal law is insufficient to pursue doxing in Georgia.^[51] Using state law to punish doxing would involve stretching criminal statutes to cover activity far beyond what they were intended to criminalize.^[52] It would require Georgia’s prosecutors to invent new and increasingly creative ways to indict a defendant, while the federal government is hesitant to pursue crimes of this nature, period.^[53]

Georgia has tried to act on this issue before. The state senate introduced a bill to criminalize doxing in Georgia in February of 2023,^[54] and the state house introduced their own bill in February of 2024.^[55] Both of these bills failed to pass.^[56] A bill criminalizing the practice of swatting did, however, pass.^[57] This occurred after Representative Marjorie Taylor Greene, and a few of her constituents, personally experienced being swatted.^[58] They spoke about these experiences when advocating for the bill.^[59] There is no reason people in Georgia should have to wait for representatives in our government to experience something before the legislature chooses to act. Georgia’s legislature can act now.

I. Why and How a Statute Can be Effective

A doxing statute would likely survive a First Amendment challenge. Thirteen states have already adopted statutes to protect members of the public who work in specific professional occupations from doxing, and many states have laws that protect all members of the public from doxing.^[60] These statutes have elements in common that make them effective without encroaching into unconstitutional territory.

Many statues have a mens rea requirement, which means a defendant is only guilty if he acted with a certain mental state, such as specific intent or with reckless disregard.^[61] This ensures that there will be no improper prosecution for accidental doxing or minor infractions. Instead, these laws target true threats.^[62] Most statutes will define the more technical terms used within them, which gives courts regimented guidelines for determining if a case is proper. California’s criminal statute, for example, defines what an “electronic communication device” can be and what behavior is severe enough to be considered harassment attributable to doxing.^[63] This ensures the statute only punishes defendants who have caused significant harm to another person.

Some states, such as Kentucky, have categorized doxing into different degrees. In cases where the offense is considered a misdemeanor, the perpetrator may only face a fine. However, if doxing results in physical harm to the victim or their family, the charge can escalate to a felony.^[64] By distinguishing between what is felony versus misdemeanor doxing, a court is able to apply more nuanced rulings, rather than imposing a one-size-fits-all punishment for every case.

Arizona’s law against doxing has an exceptions clause.^[65] This clause outlines behaviors not considered doxing. It specifies that sharing content created by another person does not qualify as doxing. This exceptions clause helps prevent false convictions and offers legal protection to individuals who may have legitimate reasons for sharing certain information.^[66] Notably, Arizona's law holds only the original publisher of private information accountable for doxing, excluding others who share the information after its initial publication. This unique aspect of the law is worth considering, as it prevents other individuals who participated in harassment from being charged as accessories to the crime.^[67] The scope of a state's response to doxing is determined within the statute, with some states treating it as a more serious offense than others.

Some states have chosen to limit doxing statues to impose only civil penalties. Illinois has a statute that makes doxing a viable cause of action in the state.^[68] Plaintiffs there can seek an injunction forcing the defendant to delete a post containing identifying information or sue for damages caused by the doxing.^[69]

States can enact criminal laws against doxing that include a civil action provision, providing victims with multiple avenues for recourse.^[70] This approach allows individuals to sue for damages, regardless of whether a conviction is secured against the doxer. Such laws are not unprecedented, as criminal statutes often have corresponding civil provisions in other areas of law. For instance, a defendant may be acquitted of murder but still held liable in a wrongful death lawsuit.^[71] In Georgia, similar provisions exist within the RICO statute, which allows plaintiffs to sue for treble damages—up to three times the amount they originally lost—even if no criminal conviction is obtained.^[72] Our legal system is designed to encourage people to settle disputes outside of a courtroom.^[73] This framework encourages settlements outside of court while empowering plaintiffs to seek justice efficiently and effectively. If someone has lost a year’s worth of income but cannot necessarily prove doxing in a criminal court of law, it is comforting to know he or she could still find reprieve in a civil court. Even if a victim’s harasser is convicted, some victims might still need an avenue to reclaim the potential earnings they lost as a consequence of being doxed.

II. Georgia

Georgia’s state constitution is a unique document. Georgia, unlike most other states, specifically grants a fundamental right to privacy to its citizens which has been established through judicial precedence.^[74] The comprehensive body of privacy law in Georgia supports the legislation of doxing. Criminalizing the practice of doxing will require novel legislation, but Georgia has a history which supports the endeavor.^[75] It is within the legal tradition of Georgia to protect citizens in this manner.

Conclusion

Doxing is a prevalent issue today. It is occurring with increasing frequency as society becomes more digitized and as our politics become more polarized. People who work certain public-facing jobs in Georgia are at specific risk of getting doxed, as exhibited in recent elections. The political landscape of our state has become of national importance and has arguably become more volatile because of this. Doxing is commonly a politically motivated attack, and it is going to keep happening in Georgia unless something is done.

The Georgia legislature should recognize doxing and criminalize it in the next legislative session. This will allow the state to prosecute malicious actors and become more versed in the type of investigations cybercrimes require. It would also allow victims of doxing who have been harmed to pursue damages from their attacker in a civil suit. Having a statute against doxing is not going to stop the practice altogether, but it could impact substantial change and benefit the state considerably. By enacting a clear and comprehensive doxing statute, Georgia can protect its citizens, uphold public safety, and set a standard for addressing emerging digital threats in the modern era.