If you have an argument with someone online, then follow their username to track down their real name, home address, phone number, workplace and similar details, and post that material online so that other people will contact or harass them, in Australia that conduct may be more than an online dispute — it may also involve criminal liability.
From 10 December 2024, Australian federal law has included a criminal offence directed specifically at Doxxing. The law does not prohibit all online exposure; it focuses on conduct that distributes personal information through the internet, social media or messaging applications where the manner of distribution is menacing or harassing.
Merely searching for someone’s information does not necessarily amount to Doxxing
Simply looking up a person’s publicly available information online generally does not mean the Doxxing offence has already been committed.
What the law is more concerned with is whether that material is then uploaded, published, supplied or forwarded to other people.
The scope of personal information is also not limited to identity card numbers, passport numbers or home addresses.
Real names, photographs, phone numbers, email addresses, social media accounts, workplaces, schools and other information capable of allowing someone to identify, contact or locate the person concerned may all be included.
Some information may not look sensitive on its own, but once combined it may be enough to pin down a person’s real-world identity.
For example, a username, a workplace photograph and a company name taken together may already allow other people to find the particular person concerned.
Publicly available information can still be distributed unlawfully
After an online argument, many people take the view that the other person’s information was already on LinkedIn, a company website or Google, so there can be no problem in collating and posting it again themselves.
But whether Doxxing is involved does not turn only on whether the source of the information was public; what matters more is how the person posting it uses that material.
If the two sides have just had a heated argument and one of them then publishes the other’s real name, private phone number, workplace and even working hours, adding remarks such as “everyone go and say hello” or “let everyone at his company get to know him”, that conduct may already go beyond the bounds of ordinary expression or rebuttal.
What the law is more concerned with is whether the distribution has begun to use the person’s real-world identity to pressure, threaten or mobilise harassment against them.
When can a “call-out post” amount to a criminal case?
Deciding whether the conduct may amount to Doxxing usually requires several factors to be considered together.
First, it is necessary to look at whether the person posting distributed the material through the internet, a social platform or a messaging application.
Secondly, it must be assessed whether that material could allow other people to identify, contact or locate the person concerned.
More importantly, the earlier argument between the parties, the language used in the post, the interaction in the comments and the manner of distribution must also be considered together in deciding whether a reasonable person would regard the conduct as menacing or harassing.
The person posting does not necessarily have to write out “everyone go and harass him” in express terms.
Clearly suggestive phrasing, such as “people who live nearby should know what to do” or “everyone can deal with the rest yourselves”, may also be considered together with the post as a whole and with what follows.
The general Doxxing offence carries a maximum penalty of 6 years’ imprisonment. If the conduct is directed at members of a group because of a statutory group characteristic such as race, religion, sex or nationality, the maximum penalty may rise to 7 years’ imprisonment.
Posting in a WeChat group or a private group may also amount to distribution
The law does not require personal information to be made public to every internet user.
Sending another person’s home address, phone number, company address or similar material in a WeChat group, a fan group, a private forum or another chat group may also constitute distributing personal information.
At the same time, the criminal risk does not necessarily attach only to the person who first found the information.
If someone else has already collated the information and you then forward that material to another group, or add further details such as a company, a school or contact details, that may also attract police attention.
However, forwarding does not by itself mean that an offence has been committed.
Providing material to police, a lawyer or another professional body for verification is plainly different in legal character from forwarding it into a group chat and encouraging other people to contact or harass the person concerned.
Deleting the post does not automatically remove the risk
Some people realise the risk soon after posting and delete the content.
But once the material has been uploaded or distributed, the conduct may already have taken place.
Even if the post existed only for a very short time, and in the end nobody actually contacted, followed or harmed the person concerned, screenshots, forwarding records and platform back-end data may still exist.
Whether serious practical consequences resulted will be an important factor for police and the courts in assessing how serious the case is, but it does not automatically negate the earlier distribution.
How should you preserve evidence after being doxxed?
If you find that your personal information is being published or distributed, you should preserve as complete a body of evidence as possible.
Rather than keeping only a few screenshots, it is more important to record the account that posted the material, the time of posting, the link to the post, the full text, the content of the comments, how it was forwarded, and the background of the earlier online argument between the parties.
If someone later telephones you, sends threatening messages, or contacts your family, friends or employer, you should also record the numbers involved, the content of those messages and when they occurred.
A complete timeline can help police work out how an online argument developed into real-world harassment.
If there is already a risk to personal safety, you should report the matter to police promptly. If someone is coming to your door or following you, or has made a specific threat of violence, call 000 immediately.
The material can also be reported to the social media platform. If it has already caused serious harm and the platform has not dealt with it promptly, you may also consider making a report to Australia’s eSafety Commissioner.
The line between an online argument and criminal Doxxing
Whether an online argument has developed into criminal Doxxing cannot be judged solely by whether a home address or phone number appears in the post.
The courts and police will usually consider as a whole the content of the material, how widely it was distributed, the language used when it was posted, the earlier conflict between the parties, and whether there was any conduct encouraging, hinting at or mobilising other people to harass the person concerned.
If police have contacted you over “doxxing and calling someone out”, publishing personal information or forwarding such content, the NS Legal criminal law team can help review the complete post, the chat records and the way the material was distributed, and assess whether the conduct may meet the threshold for a criminal offence.
If your personal information is being used by other people to harass you, you should also preserve evidence as early as possible and, depending on the circumstances, consider reporting the matter to police, complaining to the platform and taking other legal measures, in order to reduce the risk of the material spreading further and of real-world harassment.
FAQ
I only collated the other person’s Xiaohongshu, LinkedIn and company web pages in one place and did not publish any secret information. Can that still be unlawful?
It can be. Whether the material is secret is not the only test. If the combined information already allows other people to find the person concerned, and the post as a whole is menacing or mobilises harassment, there may be a Doxxing risk.
I did not directly tell anyone to harass them and only wrote “judge for yourselves”. Does that make the risk lower?
Not necessarily. Police will not look at a single sentence alone; they will form an overall view taking in the earlier argument between the parties, suggestive language, the interaction in the comments and whether further material was added afterwards.
Other members of the group had already doxxed the person and I only added the company name. Can I be liable?
You may still be investigated. That depends on whether you knew what the material was being used for, and on whether your addition further helped other people to identify or locate the person concerned.
The post existed for only a few minutes before it was deleted, and nobody actually contacted the other person. Can action still be taken?
It still can. The posting and distribution may already be complete, and whether actual harm resulted is not the only test. Police may also look at screenshots, forwarding records and platform data in assessing the case.
Disclaimer: This article provides general legal information only and does not constitute legal advice for any individual’s circumstances.
