Doxxing Laws in Australia: Sections 474.17C and 474.17D Explained

Australia gained dedicated federal doxxing offences on 11 December 2024, when two new Criminal Code sections took effect. Using a carriage service to publish someone's personal data in a menacing or harassing way now carries up to six years' imprisonment, or seven where the conduct targets a protected group.

Doxxing was not beyond the reach of Commonwealth law before that date. The general carriage-service offence in section 474.17, enacted in 2004 and in force since 1 March 2005, already covered using a carriage service in a way reasonable persons would regard as menacing, harassing or offensive. It carried a maximum of three years' imprisonment until 23 January 2022, when the Online Safety (Transitional Provisions and Consequential Amendments) Act 2021 raised it to five years. What changed on 11 December 2024 is that Parliament created offences aimed at doxxing specifically, carrying higher maximum penalties.

This article explains the two Commonwealth criminal doxxing offences inserted into the Criminal Code by the Privacy and Other Legislation Amendment Act 2024 (Cth): what conduct they cover, what counts as personal data, their penalties, and when they commenced. It also explains how a doxxing incident relates to the separate civil statutory tort for serious invasions of privacy, how to report doxxing to the eSafety Commissioner, and how state and territory stalking and harassment law can separately apply to the same conduct. It does not set out the operative wording of any state offence; those provisions differ by jurisdiction and are outside this article's scope.

What Are Australia's Doxxing Offences, and Where Do They Come From?

Australia's doxxing offences are sections 474.17C and 474.17D of the Criminal Code (Cth), inserted by Schedule 3 of the Privacy and Other Legislation Amendment Act 2024 (Cth), the same Act that later inserted the Schedule 2 statutory privacy tort into the Privacy Act 1988 (Cth). Both new offences sit in Subdivision C of Division 474, the Code's general offences relating to the use of telecommunications, alongside the existing offence of using a carriage service to menace, harass or cause offence (section 474.17). They were not inserted directly after section 474.17. In the current compilation they follow sections 474.17A to 474.17B, which deal with transmitting sexual material without consent.

Section 474.17C creates a base offence covering doxxing of one or more individuals. Section 474.17D creates a more serious, aggravated version of the same conduct where it is motivated by a protected attribute of the targeted group. Both offences commenced on 11 December 2024, the day after the amending Act received Royal Assent, well before the separate civil privacy tort, which did not take effect until 10 June 2025.

Parliament also built in a check on how the offences work in practice. Section 4 of the amending Act requires the Minister to cause an independent review of the operation of the Schedule 3 amendments, and that review must commence as soon as practicable after the 24-month period ending 10 December 2026, that is, on or after 11 December 2026. The reviewers must give the Minister a written report within six months of the review commencing, and the Minister must table it in each House of Parliament within 15 sitting days.

The Base Offence: Section 474.17C

Section 474.17C(1) creates an offence where a person uses a carriage service to make available, publish or otherwise distribute information, the information is personal data of one or more individuals, and the person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those individuals. The section's own note gives an example: publishing the name, image and telephone number of an individual on a website and encouraging others to repeatedly contact the individual with violent or threatening messages, conduct commonly referred to as doxxing. The maximum penalty is imprisonment for six years.

The offence does not require the defendant to have contacted the victim directly. Making the personal data available, publishing it, or distributing it in a menacing or harassing manner is enough, and the "reasonable persons" wording sets an objective standard rather than turning only on what the defendant subjectively intended.

The Aggravated Offence: Section 474.17D

Section 474.17D(1) mirrors section 474.17C's structure, with one added element: the person must engage in the conduct in whole or in part because of a belief that the targeted group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality, or national or ethnic origin. The section's note illustrates this with publishing the names, images and residential addresses of members of a private online religious discussion group across multiple websites, and encouraging others to attend those addresses or otherwise harass the group's members.

Section 474.17D(3) provides that it is immaterial whether the group is actually distinguished by the relevant attribute; a defendant's belief that it was is enough to engage the aggravated offence. The maximum penalty rises to imprisonment for seven years, one year higher than the base offence.

What Counts as "Personal Data" Under These Offences

Both offences use an equivalent definition of personal data: at section 474.17C(2), information about an individual that enables the individual to be identified, contacted or located, and at section 474.17D(2), the same test applied to members of a targeted group. Each subsection then lists examples without limiting the general definition: a name; a photograph or other image; a telephone number; an email address; an online account; a residential address; a work or business address; a place of education; and a place of worship. Because the definition is inclusive rather than exhaustive, information not on this list can still qualify if it enables a person to be identified, contacted or located.

Why the Doxxing Offences and the Privacy Tort Have Different Start Dates

The doxxing offences and the civil privacy tort were both inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), which received Royal Assent on 10 December 2024, but Parliament gave them different commencement mechanisms. Schedule 3, containing sections 474.17C and 474.17D, commenced the day after Royal Assent, on 11 December 2024. Schedule 2, containing the statutory privacy tort, commenced six months after Assent, on 10 June 2025.

For roughly six months, the criminal doxxing offences were in force while the civil privacy tort was not yet available. A doxxing incident that occurred in, for example, January 2025 could have been prosecuted under section 474.17C or 474.17D from the outset, but a plaintiff could not have relied on the Schedule 2 tort for that same incident, because it had not yet commenced. Do not assume the two reforms took effect together; the date of the conduct needs to be checked against each commencement date separately.

The Civil Route: How the Statutory Privacy Tort Can Apply to Doxxing Too

A doxxing incident that meets the elements of section 474.17C or 474.17D is a criminal matter for police and prosecutors, and it can separately give a victim a civil cause of action under the Schedule 2 statutory privacy tort in the Privacy Act 1988 (Cth). The two are not mutually exclusive. The criminal offence targets the defendant's menacing or harassing conduct in publishing personal data, while the civil tort asks whether the same publication invaded the plaintiff's privacy under the five-element test at clause 7(1): an invasion by intrusion or misuse of information, a reasonable expectation of privacy, an intentional or reckless invasion, seriousness, and a public interest balance favouring the plaintiff's privacy.

A victim does not have to wait for, or rely on, a criminal prosecution or conviction to bring a civil claim, and a criminal conviction is not a precondition to suing. For the elements, defences and remedies of that civil action, see Australia's Statutory Tort for Serious Invasions of Privacy.

Reporting Doxxing to the eSafety Commissioner

The eSafety Commissioner is Australia's national online safety regulator, and it operates two schemes a doxxing victim can use alongside a police report: the Adult Cyber Abuse Scheme, for a person aged 18 or older who ordinarily lives in Australia, and the Cyberbullying Scheme, for a child or young person under 18 who ordinarily lives in Australia. Neither is a shortcut past the platform, because both start there.

Report the material to the service or platform hosting it first. eSafety's own guidance states that for it to investigate either adult cyber abuse or cyberbullying, the harmful content must have first been reported to the service or platform used to send, post or share it, before it is reported to eSafety.

Only then does the Commissioner's removal power arise. Under section 88(1) of the Online Safety Act 2021 (Cth), a removal notice for adult cyber-abuse material can issue only where the material was the subject of a complaint made to the provider of the service, the provider did not remove it within 48 hours of that complaint or any longer period the Commissioner allows, and a complaint has then been made to the Commissioner under section 36. Section 65(1) sets out the same sequence for cyberbullying material targeted at an Australian child, following a complaint to the Commissioner under section 30. An adult cyber-abuse removal notice requires the provider to take all reasonable steps to ensure the material is removed within 24 hours of the notice, or any longer period the Commissioner allows.

The adult scheme is also narrower than the criminal offences, so do not assume that everything caught by section 474.17C can be removed through it. Section 7(1) of the Online Safety Act requires both that an ordinary reasonable person would conclude the material was likely intended to have an effect of causing serious harm to a particular Australian adult, and that an ordinary reasonable person in that adult's position would regard it as menacing, harassing or offensive. eSafety describes this as a "very high threshold" reserved for "the most severely abusive material", which is a higher bar than the criminal test of conduct reasonable persons would regard as menacing or harassing.

Reporting to the eSafety Commissioner does not require a criminal charge to have been laid, and it is not a substitute for reporting a suspected offence to police, who investigate section 474.17C and 474.17D matters, or for taking separate advice on a possible privacy tort claim. A person concerned about a specific incident should keep records of the material published, including URLs, screenshots and dates, before requesting removal, since that evidence can matter to a later police report, an eSafety report, or a civil claim.

State and Territory Stalking and Harassment Law

Doxxing conduct can also fall within a state or territory's separate stalking, harassment or intimidation offences, which exist alongside the Commonwealth doxxing offences rather than instead of them. Every state and territory has its own criminal offences addressing conduct such as repeated unwanted contact, surveillance of a person, or conduct intended to cause fear or harm, and the applicable provisions, definitions and penalties differ by jurisdiction.

Because the applicable state or territory offence, its elements and its penalty vary, a person affected by doxxing-related stalking or harassment should treat that question as separate from sections 474.17C and 474.17D, and should not assume the Commonwealth doxxing penalty describes the maximum exposure for the conduct as a whole. A legal practitioner admitted in the relevant state or territory can advise which offences apply on a given set of facts.

This article provides general legal information about Commonwealth doxxing offences in Australia. It does not constitute legal advice and does not account for your individual circumstances. Statutes referenced were verified against primary sources as at 10 September 2026 and are subject to amendment. Consult a legal practitioner admitted in the relevant Australian state or territory, or contact police or the eSafety Commissioner directly, for advice on a specific incident.

Related reading: Australia's Statutory Tort for Serious Invasions of Privacy covers the separate civil claim a doxxing victim may have. The Australia data privacy laws hub and The 13 Australian Privacy Principles (APPs) Explained cover the separate rules that bind organisations and agencies, Australia's Notifiable Data Breaches Scheme Explained covers an organisation's duty to report a data breach, and How to Make a Privacy Complaint to the OAIC explains that administrative complaint pathway. For state and territory surveillance and recording law, see Is It Legal to Record a Conversation in Australia? and CCTV and Home Security Camera Laws in Australia.

Frequently Asked Questions

What is doxxing under Australian federal law?

Using a carriage service, such as the internet or a phone network, to make available, publish or distribute someone's personal data in a way reasonable persons would regard as menacing or harassing, an offence under section 474.17C of the Criminal Code (Cth), with an aggravated version at section 474.17D where it targets a group because of a protected attribute.

When did Australia's doxxing offences come into effect?

Sections 474.17C and 474.17D commenced on 11 December 2024, the day after the Privacy and Other Legislation Amendment Act 2024 (Cth) received Royal Assent, months before the separate statutory privacy tort commenced on 10 June 2025.

What is the maximum penalty for doxxing in Australia?

The base offence under section 474.17C carries a maximum of six years' imprisonment. The aggravated offence under section 474.17D, where the conduct is motivated by the targeted group's race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin, carries a maximum of seven years.

What counts as personal data for the doxxing offences?

Information that enables a person to be identified, contacted or located, which the Criminal Code lists as including a name, photograph or image, telephone number, email address, online account, residential or work address, place of education, or place of worship, without limiting the definition to only those examples.

Can I sue someone for doxxing me, separately from a criminal charge?

Potentially, yes. Doxxing that meets the elements of the Schedule 2 statutory privacy tort in the Privacy Act 1988 (Cth), an intentional or reckless, serious invasion of privacy where the public interest balance favours the plaintiff, can support a civil claim regardless of whether police lay a criminal charge.

How do I report doxxing in Australia?

Report a suspected criminal offence to police. To get the material taken down, report it to the platform or service hosting it first, then to the eSafety Commissioner through the Adult Cyber Abuse Scheme or, for a child victim, the Cyberbullying Scheme. Under section 88(1) of the Online Safety Act 2021 (Cth), the Commissioner can issue a removal notice only where the platform received a complaint and did not remove the material within 48 hours, or any longer period the Commissioner allows, and a complaint has then been made to the Commissioner. The adult scheme also has a high threshold: the material must have been likely intended to cause serious harm to a particular Australian adult and be menacing, harassing or offensive.

Is doxxing also covered by state stalking or harassment laws?

It can be. Each state and territory has its own stalking, harassment or intimidation offences that can apply to the same conduct as sections 474.17C and 474.17D, with provisions and penalties that differ by jurisdiction, so a single national answer does not apply.

Does the aggravated doxxing offence require the victim to actually belong to the targeted group?

No. Section 474.17D(3) provides it is immaterial whether the group is actually distinguished by the relevant attribute; what matters is that the defendant engaged in the conduct because of a belief that it was.

Do the doxxing offences require the offender to contact the victim directly?

No. The offences turn on making available, publishing or distributing personal data in a way reasonable persons would regard as menacing or harassing; direct contact with the victim by the defendant is not an element.