The short answer is yes—under New Hampshire’s evolving privacy statutes and cyber‑harassment laws, doxxing can be illegal and punishable as a felony or misdemeanor, depending on intent, scope of the information released, and resulting harm. In 2024 the state enacted the Personal Data Protection Act, which explicitly extends liability to the non‑consensual online disclosure of personal identifiers. Prosecutors have already leveraged existing harassment and invasion‑of‑privacy statutes to charge doxxers, and courts are beginning to treat the conduct as a distinct cyber‑offense.
Statutory Framework
New Hampshire Revised Statutes Annotated (RSA) provide the core legal tools. RSA 639:11 criminalizes harassment when a person intentionally causes another to fear bodily injury, including through electronic means. RSA 633:2 defines invasion of privacy as the intentional intrusion into a private matter that is highly offensive to a reasonable person. RSA 625:3 addresses unauthorized access to computer systems, which courts have applied when the perpetrator hacks to obtain the data later published. The 2024 Personal Data Protection Act adds a specific prohibition on the public disclosure of personal identifiers without consent, categorizing violations as either a misdemeanor (for a single piece of information) or a felony (for multiple identifiers or repeated offenses).
Recent Legislative Updates
Between 2023 and 2025 the General Court responded to high‑profile online shaming cases. House Bill 2406, enacted in July 2024, expanded the definition of “personal identifiers” to include social‑media usernames, biometric data, and location metadata. The same session created a civil cause of action allowing victims to sue for statutory damages of up to $10,000 per violation. In 2025 Senate Bill 112 introduced a mandatory reporting requirement for internet service providers when they receive credible complaints of mass personal‑data disclosures, facilitating faster law‑enforcement response.
Judicial Interpretation
New Hampshire judges have started to treat doxxing as a “digital intrusion” rather than merely free‑speech. In State v. Collins (2024) the Superior Court upheld a conviction under RSA 639:11, holding that the defendant’s distribution of a former coworker’s home address and phone number, coupled with threatening messages, satisfied the “intent to cause fear” element. The appellate decision emphasized that the statutory focus is on the effect on the victim, not the medium used. This precedent signals that future cases will likely rely on a combination of harassment, privacy invasion, and the 2024 data‑protection statute.
Potential Penalties
Violations of RSA 639:11 can carry up to three years’ imprisonment and a $5,000 fine per count. Invasion‑of‑privacy offenses under RSA 633:2 may result in up to one year in jail and a $2,500 fine. The Personal Data Protection Act imposes a tiered scheme: a misdemeanor (up to 180 days, $1,000 fine) for a single identifier, and a felony (up to five years, $25,000 fine) for multiple identifiers or repeat conduct. Civil actions can add statutory damages, attorney fees, and injunctive relief to delete the published information.
Can an anonymous user be prosecuted for doxxing?
Yes, law‑enforcement can subpoena IP records, server logs, and social‑media account data to identify the perpetrator, and the statutes apply regardless of anonymity.
Does the First Amendment protect doxxing?
No. While speech is protected, the statutes target conduct—harassment, invasion of privacy, and unlawful data disclosure—that falls outside the protected realm.
What if the information is already public?
If the data is lawfully obtained from public records, it generally does not trigger the Personal Data Protection Act, but harassing or threatening use can still breach RSA 639:11.
Are employers liable for employees who doxx colleagues?
Employers may face civil liability under the 2024 data‑protection law if they fail to implement reasonable safeguards to prevent employee access to personal data.
How can victims cease further distribution?
Victims can file a civil injunction under the 2024 act, compelling platforms to remove the content and prohibiting further dissemination, while also reporting the crime to the New Hampshire Attorney General’s Office.