The short answer is yes – Rhode Island’s 2026 legislation makes doxxing illegal when it involves the intentional, public disclosure of personal information with the purpose of harassing, intimidating, or causing harm. The law, enacted on January 1 2026, expands the state’s cyber‑harassment statutes to specifically criminalize the non‑consensual release of private data such as home addresses, phone numbers, Social Security numbers, or employer details, when used to threaten or coerce a victim. Violators face felony charges, up to five years in prison, and civil remedies for damages. Understanding the new provisions is essential for individuals, businesses, and online platforms operating in Rhode Island.
Scope of the 2026 Doxxing Statute
Rhode Island’s updated code (R.I. Gen. Laws §§ 13‑3‑3.2 and 13‑3‑3.3) defines doxxing as the willful acquisition or dissemination of “identifying personal information” about another person without consent, coupled with the intent to cause emotional distress, physical harm, or economic loss. The statute applies to any medium—social media, forums, email, or text messaging—and covers both one‑time disclosures and repeated postings. It also criminalizes the use of automated tools to harvest data for later publication.
Core Elements Required for a Conviction
To secure a conviction, prosecutors must prove:
- The defendant intentionally obtained or shared the victim’s personal data.
- The information was not already in the public domain or the defendant lacked a lawful reason to share it.
- The defendant acted with the purpose of harassing, intimidating, or causing measurable harm.
- The victim suffered actual injury, such as threats, stalking, identity theft, or loss of employment.
The “public domain” exception is narrow; data that is merely searchable online does not automatically exempt the actor if it was aggregated from private sources.
Potential Defenses and Penalties
Defendants may argue lack of intent—for example, sharing information for journalistic or whistleblowing purposes under the Rhode Island Shield Law. A good‑faith mistake of identity or reliance on publicly available records can mitigate culpability, though courts frequently view reckless disregard as sufficient mens rea.
Penalties range from misdemeanor charges for first‑time, low‑impact cases to Class C felonies for aggravated conduct, carrying up to five years imprisonment, a $10,000 fine, and mandatory restitution to victims. Civil actions allow victims to seek damages, injunctive relief, and attorney fees.
Impact on Online Platforms and Users
The law obliges social‑media companies, forum operators, and hosting services to implement “reasonable” takedown mechanisms within 48 hours of a verified complainant request. Failure to comply may result in state‑level civil penalties of $2,500 per incident. Users must now review privacy settings, avoid posting personal data about others, and be prepared for swift legal consequences if they cross the line.
Frequently Asked Questions
Is sharing a public figure’s birthdate considered doxxing?
Only if the information is used to threaten or harass the individual. Simple factual data already in the public record, without malicious intent, typically falls outside the statute.
Does the law apply to data obtained from data‑broker websites?
Yes. Even if the information is purchased from a third‑party aggregator, disseminating it with harmful intent satisfies the “willful acquisition” element.
Can a victim pursue civil damages without filing criminal charges?
Absolutely. Rhode Island’s civil remedies allow victims to file a lawsuit for invasion of privacy, intentional infliction of emotional distress, and related claims, independent of any criminal prosecution.
How does the Shield Law affect doxxing cases involving journalists?
Journalists may be protected when disclosing information in the public interest, provided they follow ethical standards and do not aim to intimidate. Courts will balance First Amendment rights against the victim’s privacy interests.
What are the penalties for a first‑time offender who merely posted an address online?
A first‑time, non‑aggravated offense is typically charged as a misdemeanor, punishable by up to one year in jail and a $5,000 fine, plus mandatory community service and a civil injunction against further disclosure.