Online harassment and cyberstalking

How the law usually works

If there is an immediate threat of violence, a risk that someone is coming to your home, or another urgent safety concern, contact emergency services first.

“Cyberstalking” is not defined identically everywhere. It commonly includes repeated unwanted contact, monitoring, threats, impersonation, publishing private information, tracking someone’s location, contacting relatives or employers, or using multiple accounts after being blocked. A single serious threat may also be criminal, even if repeated conduct is not required.

Possible legal responses include:

• Criminal investigation: Police may investigate threats, stalking, harassment, extortion, unauthorized access, identity-related offenses, intimate-image sharing, or communications intended to menace or harass.
• Protection or restraining orders: A court may restrict contact, surveillance, threats, or approaching particular places. Breaching the order can itself be an offense.
• Civil claims: Depending on local law, claims may involve harassment, invasion of privacy, misuse of private information, intentional infliction of emotional distress, negligence, or related wrongs.
• Defamation: False statements that harm reputation may support a defamation claim. Truth, honest opinion, privilege, and other defenses often matter. Defamation usually does not cover merely insulting or abusive opinions.
• Data and privacy law: Publishing personal data, obtaining account information without permission, or misusing confidential information may violate privacy or data-protection rules.
• Platform enforcement: A website or service may remove content, suspend accounts, preserve information, or disclose information under valid legal process. Platform rules are separate from legal rights.

Legal protection is not automatic just because conduct is upsetting. Authorities and courts commonly consider whether the conduct was repeated, threatening, targeted, credible, and likely to cause fear or substantial distress. Context, intent, the relationship between the people, and the available evidence can matter.

Common processes

1. Make a safety plan. People commonly tell trusted family, friends, workplace security, or school officials. They may review location sharing, change passwords from a safe device, use multifactor authentication, and check account-recovery settings. They generally avoid meeting or confronting a suspected harasser alone.

1. Preserve evidence. Useful records can include screenshots showing the full account name, URL, date, time, messages, threats, and surrounding context. People often keep original emails, call logs, voicemail, payment records, and a dated incident log. Evidence is strongest when it shows the sequence of events rather than isolated screenshots.

1. Avoid escalation. People commonly avoid prolonged arguments, public accusations, threats, or reposting harmful material. They may send one clear request to stop when safe, then stop responding. They also avoid trying to hack an account, secretly access devices, or obtain private information unlawfully.

1. Use platform and service tools. Reporting, blocking, muting, restricting, and privacy settings can reduce contact. Some services have separate procedures for impersonation, intimate images, threats, doxxing, or account compromise. A report may remove content but does not necessarily preserve evidence, so records are commonly saved first.

1. Report to authorities. People may report threats or stalking to local police, specialist cybercrime units, or another appropriate agency. They can provide a concise chronology and explain why they believe the conduct is connected. Police may decide whether to investigate, seek records, make a warning, or refer the matter elsewhere.

1. Consider a protection order. Courts commonly ask for evidence of harassment, threats, fear, or repeated unwanted contact. A temporary order may be available quickly in some places, followed by a hearing where both sides can be heard.

1. Consider civil or reputation remedies. A lawyer may assess a demand to stop, a takedown request, a privacy claim, a harassment claim, or defamation proceedings. The practical value of a lawsuit depends on identifying the person, proving the legal elements, and determining whether the person or platform can satisfy a judgment.

Deadlines and time limits

Criminal reports often do not have one simple deadline, but delay can affect evidence, platform retention, and the ability to identify an anonymous account.

Civil limitation periods vary substantially. Sources commonly describe periods of roughly one to several years for personal-injury, harassment, privacy, or related claims, depending on the jurisdiction and claim. Defamation periods can be particularly short: England and Wales generally uses a one-year limitation period, while Australian defamation law generally uses one year, subject to limited extensions. Canadian and U.S. periods differ by province, state, and the type of claim.

A new repost, republication, or continuing course of conduct may or may not create a new deadline. Online publication rules can be technical. People commonly confirm the applicable deadline promptly with the court or a licensed lawyer where they live.

Documents that usually matter

• Screenshots, screen recordings, URLs, usernames, and account identifiers
• Original emails, headers, direct messages, voicemails, and call records
• A dated incident chronology identifying witnesses and effects on daily life
• Copies of reports to platforms, employers, schools, police, or other agencies
• Medical or counseling records documenting harm, where relevant
• Evidence of account compromise, unauthorized access, location tracking, or financial loss
• Existing protection orders, warnings, settlement communications, or court papers
• Information showing whether a statement was presented as fact, opinion, satire, or a report of an allegation

How it differs by jurisdiction

United States. Federal law includes a cyberstalking offense covering certain conduct using electronic communication services, but state stalking, harassment, threats, privacy, and defamation laws are often the main practical route. The First Amendment can protect speech, including some offensive speech, while true threats, targeted stalking, and other unlawful conduct may not receive the same protection. State rules differ on protective orders, recording communications, limitation periods, and platform liability. Section 230 of the Communications Decency Act often limits treating an online service as the publisher of user content, although it does not prevent every possible claim.

England and Wales. The Protection from Harassment Act 1997 addresses a course of conduct amounting to harassment and provides criminal and civil routes. The Communications Act 2003 can apply to certain grossly offensive, indecent, obscene, or menacing communications. The Online Safety Act 2023 mainly imposes duties on regulated services; it is not a general private right to sue someone for online abuse. Defamation and misuse-of-private-information claims have their own tests and short or complex deadlines.

Canada. Criminal harassment under the Criminal Code can cover repeated communication, watching or following, or threatening conduct that causes a person reasonably to fear for safety. Other offenses may apply to threats, intimate images, unauthorized computer use, or identity-related conduct. Privacy and data rules differ between federal and provincial law, and civil limitation periods are usually provincial or territorial. Defamation and protection-order procedures also vary.

Australia. The federal Criminal Code includes offenses involving use of a carriage service to menace, harass, or cause offense, while state and territory laws address stalking, intimidation, threats, and intervention orders. The Online Safety Act 2021 gives the eSafety Commissioner powers concerning certain harmful online material and image-based abuse. Australian defamation law is substantially uniform but still has a generally short limitation period, commonly one year, with possible extensions in limited cases.

When people consult a lawyer

Legal advice is especially useful when:

• threats suggest immediate or escalating danger;
• the harasser is known to you, an employer, former partner, or family member;
• personal information, intimate images, or financial information has been published;
• you need a protection order or the other person has applied for one;
• the conduct affects employment, education, immigration, housing, or professional licensing;
• you are considering a defamation, privacy, or harassment claim;
• the person is anonymous, overseas, or using several accounts; or
• police, a platform, or a court has contacted you.

A lawyer can help identify the correct jurisdiction, preserve evidence, assess defences and risks, and choose between reporting, a court order, and civil proceedings.