Doxing generally refers to the disclosure of another individual's personal information for the purpose of harming or harassing that individual.

Doxing is not specifically prohibited under Washington law.  Depending on the specific circumstances, information disclosed, and additional facts, the underlying conduct could qualify as a criminal offense (for example, harassment or stalking) or an actionable civil tort (for example, invasion of privacy or intentional infliction of emotional distress).

At least six other states have imposed various criminal or civil restrictions on doxing, with some states restricting doxing generally and others restricting doxing that targets specific individuals like peace officers, public officials, and health care workers.

Prohibition on Doxing.
No person may publish an individual's personal identifying information when:

• the publication is made without the express consent of the individual whose information is published;
• the publication is made with:
  • intent or knowledge that the personal identifying information will be used to harm the individual whose information is published; or
  • reckless disregard for the risk the personal identifying information will be used to harm the individual whose information is published; and

• the publication causes the individual whose information is published to suffer:
  • physical injury;
  • significant economic injury;
  • mental anguish;
  • fear of serious bodily injury or death for themself or a close relation to themself; or
  • a substantial life disruption.

Civil Action.
A person whose information is published in violation of this restriction may bring a civil action against:  (1) the person who published the information; and (2) any person who knowingly benefits from participation in a venture they knew or should have known has engaged in a violation of these restrictions.  An action may be brought in any county in which an element of the violation occurred or in which an individual whose information was published resides.
 
A prevailing claimant may recover compensatory damages, punitive damages, statutory damages of $5,000 per violation, costs and reasonable attorneys' fees, injunctive relief, and other relief deemed appropriate by the court.  Additionally, a court may issue a temporary restraining order, or temporary or permanent injunction, to prevent disclosure or continued disclosure of a party's personal identifying information.
 
Exceptions, Defenses, and Construction.

The foregoing restrictions are subject to exceptions.  A person does not violate the restrictions by:

• providing personal identifying information with the reporting of criminal activity, which the person making the report reasonably believes occurred, to an employee of a law enforcement, intelligence, or other government agency in the United States, or in connection with the existing activities of a law enforcement, intelligence, or other government agency in the United States, but only if the information is believed to be accurate and provided in good faith;
• providing personal identifying information in connection with an exercise of the right of freedom of speech or of the press, the right to assemble or petition, or the right of association, guaranteed by the United States Constitution or Washington Constitution;
• providing personal identifying information to, or in the course of acting as or on behalf of, "news media" as defined by Washington law;
• providing personal identifying information to a requestor in response to a request under the Public Records Act;
• providing personal identifying information when required to do so by any federal, state, or local law or regulation, or court rule or court order, but only if the information is believed to be accurate and provided in good faith;
• providing personal identifying information in connection with a lawful requirement for a court filing or recording;
• providing personal identifying information as permitted under the federal Gramm-Leach-Bliley act and Consumer Financial Protection Bureau Regulation P, consistent with privacy policy disclosures provided pursuant to such regulation;
• providing personal identifying information in compliance with the Fair Credit Reporting Act or Fair Debt Collection Practices Act;
• providing personal identifying information in a consumer alert or public notice arising from a regulatory, civil, or criminal investigation, complaint, or enforcement action, but only if the publication is made by a government agency;
• providing personal identifying information within or to a government agency, corporation, company, partnership, labor union, or another legal entity, or to any employees or agents thereof, but only if the information is provided for a legitimate and lawful purpose, through a private channel of communication and not to the public, and the provider reasonably believes the information to be accurate or has reasonable suspicion it is being used fraudulently, and the provider acts in good faith; or
• providing personal identifying information on behalf of a state agency, the health benefit exchange, a tribal nation, a contracted service provider of a state agency or the health benefit exchange, or the lead organization or a data vendor of the all-payer health care claims database, if the information was provided in a manner legally permitted under federal or state law or regulation.

It is not a defense that the information at issue was voluntarily given to the publisher, previously publicly disclosed, or readily discoverable through research or investigation.
 
The foregoing restrictions must not be construed to conflict with federal protections for private blocking and screening of offensive material or federal civil actions for deprivation of rights, or to prohibit constitutionally protected activities. 
 
The act must be liberally construed and applied to promote its purpose to deter doxing, protect persons from doxing, and provide adequate remedies to victims of doxing.

Defined Terms.
Several terms are expressly defined.  Examples include the following.

"Doxing" means unauthorized publication of personal identifying information with intent or knowledge that the information will be used to harm the individual whose information is published, or with reckless disregard for the risk the information will be used to harm the individual whose information is published.

"Harm" means bodily injury, death, harassment, or stalking.

"Mental anguish" means emotional distress or emotional suffering as evidenced by anxiety, fear, torment, or apprehension that may or may not result in a physical manifestation of mental anguish or a mental health diagnosis.  The mental anguish must be protracted and not merely trivial or transitory.

"Personal identifying information" means any information that can be used to distinguish or trace an individual's identity, including without limitation name, prior legal name, alias, mother's maiden name, or date or place of birth, in combination with any other information that is linked or linkable to an individual such as:

• social security number, home address, mailing address, phone number, email address, social media accounts, or biometric data;
• medical, financial, education, consumer, or employment information, data, or records;
• any other sensitive private information that is linked or linkable to a specific identifiable individual, such as gender identity, sexual orientation, or any sexually intimate visual depiction; or
• any information, including without limitation usernames and passwords, that enables access to a person's email accounts, social media accounts, electronic forum accounts, chat or instant message accounts, cloud storage accounts, banking or financial accounts, computer networks, computers or phones, teleconferencing services, video-teleconferencing services, or other digital meeting rooms.

"Publish" means to circulate, deliver, distribute, disseminate, post, transmit, or otherwise make available to another person, through any oral, written, visual, or electronic communication.

"Substantial life disruption" means that a person significantly modifies their actions, routines, employment, residence, appearance, name, or contact information to avoid or protect against an actor who has obtained or is using the person's personal identifying information, or because of the course of conduct of an actor who has obtained or is using the person's personal identifying information.  Examples include, without limitation, changing a phone number, changing an electronic mail address, deleting personal electronic accounts, significantly decreasing use of the internet, moving from an established residence, changing daily routines, changing routes to and from work, changing employment or work schedule, or losing time from work or a job.