03 9070 9810

Someone Published Your Personal Details Online

Australian doxxing legal action under the statutory tort for serious invasion of privacy. Urgent injunctions. Damages claims. Anonymous defendants identified.

Book a Confidential Assessment ($770)

Max file size: 20MB

Doxxing Is Now Actionable Under Australian Law

If someone has published your home address, phone number, workplace, or other identifying details online without your consent, you may have a civil claim under the statutory tort for serious invasion of privacy (Schedule 2, Privacy Act 1988 (Cth)), which commenced on 10 June 2025.

Doxxing falls squarely within the misuse of personal information pathway of the tort. It does not matter whether the information published was true. Truth is not a defence. What matters is that a person intentionally or recklessly made your private information available in circumstances where you had a reasonable expectation of privacy, and the invasion was serious.

The law now provides two practical remedies that did not previously exist in Australia: urgent injunctions to compel the removal of published information and restrain further publication, and damages of up to approximately $478,550 for non-economic loss (with exemplary damages available in exceptional cases). No proof of financial loss is required. The tort is actionable per se.

The clock is ticking. You may have as little as 12 months to act. The limitation period runs from the date you became aware of the invasion.

Your personal details are still online. Every hour matters.

Urgent doxxing injunctions can be sought to restrain ongoing publication. Contact us for a confidential initial assessment.

How We Act on Doxxing Claims

Three distinct legal tools are available depending on the urgency and your objectives.

Urgent injunction proceedings to stop doxxing publication

Urgent Injunctions to Stop Publication

<p>Where your personal details remain online and the risk of harm is ongoing, an urgent privacy injunction may be the most effective first step. The court has power under clause 9 of Schedule 2 to order the removal of published material and restrain further dissemination.</p><p>Injunctive relief can be sought on short notice, including outside ordinary court hours in appropriate cases. The strength of an injunction application depends on the nature of the information published, the risk of ongoing harm, and the absence of any countervailing public interest in the publication.</p><p>Not every case warrants an injunction. We assess the facts before recommending this step.</p>

Legal process to identify anonymous defendants in doxxing cases

Identifying Anonymous Defendants

<p>Doxxing is often carried out by anonymous accounts. This does not prevent legal action. Preliminary discovery and other interlocutory procedures allow the court to order platforms and internet service providers to disclose information that identifies the person behind an anonymous account.</p><p>This process has been used successfully in Australian defamation proceedings and is directly applicable to claims under the statutory tort. Once the defendant is identified, a substantive claim for damages and injunctive relief can proceed.</p><p>The identity of the person responsible is a factual question, not a barrier to action. It simply affects the sequence of steps.</p>

Damages compensation for doxxing privacy invasion

Damages and Compensation

<p>The statutory tort provides for compensatory damages (capped at approximately $478,550 for non-economic loss), aggravated damages, and exemplary damages in cases involving a deliberate and outrageous disregard for the plaintiff's privacy. An account of profits is also available where the defendant has profited from the invasion.</p><p>Doxxing compensation claims do not require proof of financial loss. The court assesses damages by reference to the seriousness of the invasion, the conduct of the defendant, and the effect on the plaintiff. In overseas jurisdictions with comparable torts, publication of home addresses and identifying details has attracted meaningful awards.</p><p>The court may also order the defendant to apologise, retract the material, or take steps to prevent recurrence.</p>

Doxxing Legal Action: What the Law Covers

What constitutes doxxing under the statutory tort

The statutory tort for serious invasion of privacy covers the misuse of personal information where a person had a reasonable expectation of privacy in that information. Doxxing typically involves the deliberate publication of identifying details: home addresses, phone numbers, email addresses, workplaces, vehicle registration numbers, school locations of children, or other information that allows the plaintiff to be located or contacted.

The tort does not require the information to have been obtained unlawfully. Even information sourced from public records or social media may give rise to a claim if its collation and republication in a new context constitutes a serious invasion of privacy. The English Court of Appeal in Murray v Express Newspapers [2008] EWCA Civ 446 recognised that information may be private in context even where individual elements are publicly accessible. Australian courts are likely to consider this principle when applying the seriousness threshold under clause 7(1)(d) of Schedule 2.

Who can be sued

The statutory tort permits claims against any person, corporation, or government body. This is broader than the OAIC complaint pathway, which only covers APP entities (organisations with an annual turnover of more than $3 million, or certain other bodies). Doxxing is frequently carried out by individuals, and the statutory tort is the only federal civil remedy available against them.

Where doxxing is carried out by multiple people (for example, as part of a coordinated harassment campaign), each person who publishes or republishes the information may be liable. Platform operators may also face claims depending on their knowledge and conduct, although this area of the law remains untested.

The OAIC complaint pathway

If the person or organisation that published your information is an APP entity, you may also have the option of lodging a complaint with the Office of the Australian Information Commissioner (OAIC). This pathway is free and does not require a lawyer. However, it has significant limitations: the OAIC cannot award exemplary damages, cannot grant urgent injunctions, and complaint resolution is often slow. The OAIC pathway and the statutory tort are separate regimes. A person may pursue both, but the statutory tort is the stronger avenue where the invasion is serious and urgent relief is needed.

Overlap with defamation

Doxxing sometimes accompanies defamatory statements. Where private information is published alongside false and damaging allegations, a person may have both a privacy claim and a defamation claim. These are distinct causes of action with different elements, defences, and remedies. We act in both areas. Further information on the intersection of privacy and defamation law is available at defamationlawyer.au and on our invasion of privacy vs defamation page.

The limitation period

Claims under the statutory tort must be commenced within one year of the date the plaintiff became aware (or ought reasonably to have become aware) of the invasion, or three years from the date of the invasion, whichever is earlier. Extensions are available in limited circumstances, to a maximum of six years. If your personal details have been published online, the limitation period may already be running. Early legal advice is important. Further detail is on our time limits page.

Confidential Initial Assessment: $770 Fixed Fee

We review the facts, identify your legal options, and advise on the most effective course of action. No obligation to proceed further.

Why Doxxing Victims Instruct Us

Practical reasons clients choose to act through our firm.

Urgent Capacity

Doxxing causes immediate harm. We are structured to move on injunction applications promptly when the facts warrant it.

Anonymous Defendant Experience

We have direct experience with preliminary discovery applications to compel platforms to identify anonymous publishers.

Fixed Fee Entry Points

Initial assessment ($770) and pre-action demand letters ($990) are offered at fixed fees so the cost of the first steps is clear from the outset.

Privacy and Defamation Practice

The statutory tort borrows heavily from defamation law. Our depth in both areas means claims are assessed across every available cause of action.

Federal Jurisdiction, National Reach

The statutory tort operates under federal law. We act for clients across Australia, with a primary presence in Melbourne and Sydney.

Discretion

Doxxing claims involve sensitive personal information. All matters are handled with appropriate confidentiality from first contact.

Frequently Asked Questions: Doxxing and the Law

The Online Safety Act 2021 (Cth) contains provisions addressing menacing or harassing conduct online, and the Criminal Code includes offences for using a carriage service to menace, harass, or cause offence. Some state criminal laws may also apply depending on the circumstances. However, doxxing has not been the subject of a standalone criminal offence in most Australian jurisdictions. What has changed is the civil position: since 10 June 2025, the statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) provides a civil right of action for individuals whose personal information has been published without consent, where the invasion was intentional or reckless and serious. This means you can now bring a court claim for injunctions, damages, and other remedies.

Preserve the evidence. Take screenshots that capture the full URL, the date and time, the content of the post, and the identity (or username) of the publisher. If the material is on a platform with a reporting mechanism, you may wish to report it, but do not rely solely on the platform to act. If there is an immediate risk to your physical safety, contact the police. For legal action, the most effective first step is a confidential initial assessment with a privacy solicitor who can advise on whether an urgent injunction, a pre-action demand letter, or a damages claim is appropriate.

Yes. Where the defendant is anonymous, preliminary discovery procedures allow the court to order social media platforms, website hosts, and internet service providers to disclose information identifying the person behind an account. This is a well-established procedure in Australian defamation litigation and applies with equal force to privacy claims. The process adds a step to the proceedings, but it does not prevent a claim from being brought.

No. The statutory tort is actionable per se. This means the court can award damages for the invasion of privacy itself, without proof of financial harm. Damages are assessed by reference to the seriousness of the invasion, the conduct of the defendant, and the effect on the plaintiff. Where financial loss has occurred (for example, security costs or relocation expenses), those losses may also be recoverable as part of a damages claim.

Truth is not a defence to a claim under the statutory tort. This is one of the key distinctions between privacy law and defamation law. In defamation, truth (or 'justification') is a complete defence. In privacy, the question is not whether the information was accurate but whether the plaintiff had a reasonable expectation of privacy in that information and whether the invasion was serious. The publication of a true home address without consent can be just as actionable as the publication of false information.

Non-economic loss damages are capped at approximately $478,550 (indexed annually, aligned with the defamation damages cap). Aggravated damages may be awarded where the defendant's conduct was particularly egregious. Exemplary damages are available in exceptional cases. An account of profits may also be ordered where the defendant profited from the publication. The court may additionally order the defendant to remove the material, apologise, or refrain from further publication. There is no established scale of doxxing compensation in Australia as the tort is new, but comparable overseas jurisdictions have awarded meaningful damages for the publication of private identifying details.

The limitation period is one year from the date you became aware (or ought reasonably to have become aware) of the invasion, or three years from the date of the invasion, whichever expires first. Extensions may be granted in limited circumstances, to a maximum of six years. If your personal information has been published online and you are aware of it, the clock is already running. Early legal advice is important. Further detail is available on our time limits page.

If the entity that published your information is an APP entity (generally, an organisation with annual turnover exceeding $3 million, or a Commonwealth agency), you may lodge a complaint with the Office of the Australian Information Commissioner. The OAIC pathway is free and does not require a lawyer. However, it has limitations: it does not cover individuals or small businesses as respondents, it cannot grant urgent injunctions, and resolution can be slow. The statutory tort and the OAIC complaint pathway are separate regimes. Both may be pursued, but the statutory tort provides significantly stronger remedies for serious doxxing. Further comparison is on our OAIC complaint vs statutory tort page.

Where doxxing is accompanied by defamatory statements (for example, false allegations published alongside your personal details), you may have both a privacy claim and a defamation claim. These are separate causes of action with different elements and defences. We practise in both areas. For further information, see our invasion of privacy vs defamation page or visit defamationlawyer.au.

The limitation period may already be running.

If your personal details have been published online, you may have as little as 12 months from the date you became aware to commence proceedings. Contact us for a confidential initial assessment.

Call