Doxxing Laws in Australia: Sections 474.17C and 474.17D Explained

Doxxing became a federal crime in Australia on 11 December 2024, when new Criminal Code offences took effect. Using a carriage service to publish someone's personal data in a menacing or harassing way now carries up to six years' imprisonment, or seven where the conduct targets a protected group.

This article explains the two Commonwealth criminal doxxing offences inserted into the Criminal Code by the Privacy and Other Legislation Amendment Act 2024 (Cth): what conduct they cover, what counts as personal data, their penalties, and when they commenced. It also explains how a doxxing incident relates to the separate civil statutory tort for serious invasions of privacy, how to report doxxing to the eSafety Commissioner, and how state and territory stalking and harassment law can separately apply to the same conduct. It does not set out the operative wording of any state offence; those provisions differ by jurisdiction and are outside this article's scope.

What Are Australia's Doxxing Offences, and Where Do They Come From?

Australia's doxxing offences are sections 474.17C and 474.17D of the Criminal Code (Cth), inserted by Schedule 3 of the Privacy and Other Legislation Amendment Act 2024 (Cth), the same Act that later inserted the Schedule 2 statutory privacy tort into the Privacy Act 1988 (Cth). Both new offences sit immediately after the Criminal Code's existing offence of using a carriage service to menace, harass or cause offence (section 474.17), among the Code's telecommunications offences.

Section 474.17C creates a base offence covering doxxing of one or more individuals. Section 474.17D creates a more serious, aggravated version of the same conduct where it is motivated by a protected attribute of the targeted group. Both offences commenced on 11 December 2024, the day after the amending Act received Royal Assent, well before the separate civil privacy tort, which did not take effect until 10 June 2025.

The Base Offence: Section 474.17C

Section 474.17C(1) creates an offence where a person uses a carriage service to make available, publish or otherwise distribute information, the information is personal data of one or more individuals, and the person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those individuals. The section's own note gives an example: publishing the name, image and telephone number of an individual on a website and encouraging others to repeatedly contact the individual with violent or threatening messages, conduct commonly referred to as doxxing. The maximum penalty is imprisonment for six years.

The offence does not require the defendant to have contacted the victim directly. Making the personal data available, publishing it, or distributing it in a menacing or harassing manner is enough, and the "reasonable persons" wording sets an objective standard rather than turning only on what the defendant subjectively intended.

The Aggravated Offence: Section 474.17D

Section 474.17D(1) mirrors section 474.17C's structure, with one added element: the person must engage in the conduct in whole or in part because of a belief that the targeted group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality, or national or ethnic origin. The section's note illustrates this with publishing the names, images and residential addresses of members of a private online religious discussion group across multiple websites, and encouraging others to attend those addresses or otherwise harass the group's members.

Section 474.17D(3) provides that it is immaterial whether the group is actually distinguished by the relevant attribute; a defendant's belief that it was is enough to engage the aggravated offence. The maximum penalty rises to imprisonment for seven years, one year higher than the base offence.

What Counts as "Personal Data" Under These Offences

Both offences use an equivalent definition of personal data: at section 474.17C(2), information about an individual that enables the individual to be identified, contacted or located, and at section 474.17D(2), the same test applied to members of a targeted group. Each subsection then lists examples without limiting the general definition: a name; a photograph or other image; a telephone number; an email address; an online account; a residential address; a work or business address; a place of education; and a place of worship. Because the definition is inclusive rather than exhaustive, information not on this list can still qualify if it enables a person to be identified, contacted or located.

Why the Doxxing Offences and the Privacy Tort Have Different Start Dates

The doxxing offences and the civil privacy tort were both inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), which received Royal Assent on 10 December 2024, but Parliament gave them different commencement mechanisms. Schedule 3, containing sections 474.17C and 474.17D, commenced the day after Royal Assent, on 11 December 2024. Schedule 2, containing the statutory privacy tort, commenced six months after Assent, on 10 June 2025.

For roughly six months, the criminal doxxing offences were in force while the civil privacy tort was not yet available. A doxxing incident that occurred in, for example, January 2025 could have been prosecuted under section 474.17C or 474.17D from the outset, but a plaintiff could not have relied on the Schedule 2 tort for that same incident, because it had not yet commenced. Do not assume the two reforms took effect together; the date of the conduct needs to be checked against each commencement date separately.

The Civil Route: How the Statutory Privacy Tort Can Apply to Doxxing Too

A doxxing incident that meets the elements of section 474.17C or 474.17D is a criminal matter for police and prosecutors, and it can separately give a victim a civil cause of action under the Schedule 2 statutory privacy tort in the Privacy Act 1988 (Cth). The two are not mutually exclusive. The criminal offence targets the defendant's menacing or harassing conduct in publishing personal data, while the civil tort asks whether the same publication invaded the plaintiff's privacy under the five-element test at clause 7(1): an invasion by intrusion or misuse of information, a reasonable expectation of privacy, an intentional or reckless invasion, seriousness, and a public interest balance favouring the plaintiff's privacy.

A victim does not have to wait for, or rely on, a criminal prosecution or conviction to bring a civil claim, and a criminal conviction is not a precondition to suing. For the elements, defences and remedies of that civil action, see Australia's Statutory Tort for Serious Invasions of Privacy.

Reporting Doxxing to the eSafety Commissioner

The eSafety Commissioner is Australia's national online safety regulator, and it operates schemes a doxxing victim can use alongside, or instead of, a police report. Adults can report serious online abuse through the Adult Cyber Abuse Scheme, and children can report doxxing and other cyberbullying through the Cyberbullying Scheme; both let the Commissioner engage directly with a platform to seek removal of harmful material.

Reporting to the eSafety Commissioner does not require a criminal charge to have been laid, and it is not a substitute for reporting a suspected offence to police, who investigate section 474.17C and 474.17D matters, or for taking separate advice on a possible privacy tort claim. A person concerned about a specific incident should keep records of the material published, including URLs, screenshots and dates, before requesting removal, since that evidence can matter to a later police report, an eSafety report, or a civil claim.

State and Territory Stalking and Harassment Law

Doxxing conduct can also fall within a state or territory's separate stalking, harassment or intimidation offences, which exist alongside the Commonwealth doxxing offences rather than instead of them. Every state and territory has its own criminal offences addressing conduct such as repeated unwanted contact, surveillance of a person, or conduct intended to cause fear or harm, and the applicable provisions, definitions and penalties differ by jurisdiction.

Because the applicable state or territory offence, its elements and its penalty vary, a person affected by doxxing-related stalking or harassment should treat that question as separate from sections 474.17C and 474.17D, and should not assume the Commonwealth doxxing penalty describes the maximum exposure for the conduct as a whole. A legal practitioner admitted in the relevant state or territory can advise which offences apply on a given set of facts.

This article provides general legal information about Commonwealth doxxing offences in Australia. It does not constitute legal advice and does not account for your individual circumstances. Statutes referenced were verified against primary sources as at 19 July 2026 and are subject to amendment. Consult a legal practitioner admitted in the relevant Australian state or territory, or contact police or the eSafety Commissioner directly, for advice on a specific incident.

Related reading: Australia's Statutory Tort for Serious Invasions of Privacy covers the separate civil claim a doxxing victim may have. The Australia data privacy laws hub and The 13 Australian Privacy Principles (APPs) Explained cover the separate rules that bind organisations and agencies, Australia's Notifiable Data Breaches Scheme Explained covers an organisation's duty to report a data breach, and How to Make a Privacy Complaint to the OAIC explains that administrative complaint pathway. For state and territory surveillance and recording law, see Is It Legal to Record a Conversation in Australia? and CCTV and Home Security Camera Laws in Australia.