Doxxing In Australia: What's The Law?

Doxxing, or the malicious release of personal data online, is an emerging form of cyber-harassment that has gained significant attention in Australia. While it is not currently a standalone offence in the country, the Australian government has taken steps to address this issue by proposing legal reforms and introducing new criminal offences that specifically target doxxing behaviours. The maximum penalty for doxxing is expected to include jail time, with considerations given to protecting public interest journalism and addressing challenges in enforcing these laws due to the anonymous nature of the internet.

Explore related products

To Catch a Fascist: The Fight to Expose the Radical Right

$30

The Doxxing of Clearwater High: A Novel

$9.13 $14.99

Doxxing Philosophy (The Marianas Web Book 15)

$0.99

People of Flipped Face: The Doxxing of the Flipped Face NFT Community

$29.99

Doxxing laws in Australia

Doxxing is an emerging form of cyber-harassment that involves unmasking someone who was previously anonymous or revealing specific details to allow someone to be located or contacted. While doxxing is not currently a standalone offence in Australia, the act of doxxing may fall under existing laws related to stalking, harassing, or intimidating another person.

In response to recent controversies involving the leaking of personal information of individuals and groups, the Australian government has proposed and passed new legislation to specifically address doxxing. The Privacy and Other Legislation Amendment Act 2024, which came into effect on December 10, 2024, criminalizes doxxing by imposing penalties for the malicious release of personal data online. The new law introduces a maximum penalty of up to seven years' imprisonment for doxxing offences, with additional penalties for targeting individuals or groups based on their race, religion, sex, sexual orientation, and other protected characteristics.

The new legislation also includes the creation of a statutory tort for serious invasions of privacy, allowing individuals to seek legal redress through civil action if they have been victims of doxxing. This tort provision addresses a previous gap in Australian law, empowering individuals to take legal action for serious privacy breaches.

While the new laws aim to protect individuals from the harmful effects of doxxing, challenges remain in enforcing these laws due to the anonymous nature of online perpetrators and the cross-jurisdictional complexities of the digital realm.

Doxxing as cyber-harassment

Doxxing is an emerging form of cyber-harassment that involves unmasking someone who was previously anonymous or revealing specific details to enable someone to be located or contacted. It is a standard tactic of online harassment and has been used by people associated with the Gamergate and vaccine controversies. Doxxing is often carried out for reasons such as online shaming, extortion, and vigilante aid to law enforcement. It can also be used for cyberstalking, which could result in making someone fear for their safety.

In Australia, doxxing is not currently a standalone offence, but there are calls to create one. Under current laws across Australia, doxxing could constitute a criminal offence, particularly when done for the purposes of stalking, harassing, or intimidating another. This would fall under Section 474.15 of the Federal Criminal Code Act 1995, which applies throughout Australia and makes it an offence to use a 'carriage service' (including the internet) to menace, harass, or cause offence to another. The term 'harass' is not defined under the Code but likely overlaps with behaviours generally considered stalking or intimidation. The Federal eSafety Commissioner defines 'doxxing' as the 'intentional online exposure of an individual's identity, private information, or personal details without their consent'.

In February 2024, the Australian government announced that it would reform laws to better tackle doxxing behaviours. The government will introduce a statutory tort to provide redress for doxxing victims and hinted at introducing fresh criminal laws to address doxxing behaviours. The new laws will deal with the 'malicious disclosure of personal information' as part of a new offence within the Federal Criminal Code. This will likely include the disclosure of private information to harm a person's reputation or with the intent to cause distress or embarrassment. The maximum penalty for this offence is expected to be six to seven years' imprisonment.

The enforcement of laws related to online misconduct presents practical challenges. Perpetrators often use anonymous accounts, VPNs, and other tools to hide their identities, making it difficult for law enforcement agencies to trace the source of the harmful conduct. However, some existing powers may assist in limiting the spread of doxxing content.

Doxxing and free speech

Doxxing, or the "intentional online exposure of an individual's identity, private information or personal details without their consent", is an emerging form of cyber-harassment. While it is not currently a standalone offence in Australia, the act of doxxing can constitute a criminal offence under existing laws when done for the purposes of stalking, harassing, or intimidating another.

In recognition of the harm caused by online harassment and cyberhate, the Australian government has proposed reforms to specifically criminalise doxxing. This includes the introduction of a statutory tort for serious invasions of privacy, which would allow victims of doxxing to seek redress through the courts. The proposed reforms also include the creation of new criminal offences for the malicious release of personal data online, with penalties of up to seven years' imprisonment.

While these reforms aim to balance privacy protections with free speech, there are concerns about their potential impact on public interest journalism. Exemptions for journalism are expected to be included in the new laws, but the definition of journalism may be broad and could potentially include individuals running small blog websites.

Additionally, the enforcement of laws related to online misconduct presents practical challenges due to the anonymous nature of the internet and the use of tools such as VPNs to obfuscate identities. International cooperation may be necessary to effectively address doxxing when perpetrators are located in different jurisdictions.

Overall, while the criminalisation of doxxing in Australia seeks to protect individuals' privacy and safety, it is important to consider the potential implications for free speech and the practical challenges of enforcing such laws in the digital realm.

Doxxing and privacy laws

Doxxing, or the "intentional online exposure of an individual's identity, private information or personal details without their consent", is an emerging form of cyber-harassment. While it is not currently a standalone offence in Australia, the act of doxxing could constitute a criminal offence under existing laws, particularly when done for the purposes of stalking, harassing, or intimidating another.

In response to the rise of doxxing and large-scale data breaches, the Australian government has proposed reforms to enhance privacy protections for individuals. This includes the introduction of a statutory tort for serious invasions of privacy, which would allow individuals to seek redress through the courts if they have been victims of doxxing. The government has also hinted at introducing fresh criminal laws to address doxxing behaviours, with penalties including jail time.

On November 29, 2024, Australia's Parliament passed the Privacy and Other Legislation Amendment Act 2024, which criminalizes doxxing and amends the Privacy Act 1988 and other relevant laws. The new law introduces two new criminal offences to the Criminal Code Act 1995 (Cth) regarding the release of personal data in a manner that a "reasonable person" would consider menacing or harassing. The penalty for this offence is up to six years of imprisonment.

The new doxxing laws will include exemptions for public interest journalism, such as reporting on public figures. However, there are concerns that the proposed laws could have unintended consequences, such as clogging up the courts with matters that do not meet the criminal standard. Additionally, there will need to be strong consideration given to what exceptions apply, as publicly responding to a victim of a crime on the internet or social media to provide the details of a perpetrator could fall under the new doxxing laws.

Doxxing and hate speech

Doxxing refers to the intentional release of an individual's personal identifying information without their permission, usually with the intent to retaliate or intimidate. The term arose from the computer hacker world in the 1990s, where a group of hackers exposed the identity of a fellow hacker who violated their community's norms, destroying their anonymity. Doxxing often carries a negative connotation because it can be a means of revenge via the violation of privacy.

In Australia, doxxing is not currently a standalone offence, but there are calls to create one. Under current laws across Australia, doxxing could constitute a criminal offence, particularly when done for the purposes of stalking, harassing, or intimidating another. For example, under Section 474.15 of the Federal Criminal Code Act 1995 (Cth), which applies throughout Australia, it is an offence to use a 'carriage service' (including the internet) to menace, harass, or cause offence to another. This offence carries a maximum penalty of three years' imprisonment.

The Australian government has recently announced that it will introduce new laws to tackle doxxing in the community. The malicious release of personal data online, known as doxxing, will be outlawed and will attract up to seven years in jail under new legislation being introduced to federal parliament. This legislation will also introduce a hate speech bill, which is expected to be weaker than initially proposed.

Doxxing has been linked to hate speech, particularly in the context of transphobic hate speech. Transphobic hate speech remains underexamined as an example of privacy abuse and a form of doxxing. Speech acts that intimidate, misgender, and out trans people online are more than just words; they are targeting forms of doxxing designed to erode and diminish the informational autonomy of trans people in digital spaces. The convergence of transphobic hate speech and doxxing has been observed in the self-styled 'gender-critical' movement, with examples including the mass 'trans-vestigation' of Olympic boxer Imane Khelif and Elon Musk's public misgendering and harassment of his own child.

Frequently asked questions