Cyberstalking is fundamentally an invasion of privacy. It often starts with information you share online voluntarily, from social media posts to tagged photos. 

About one in five women and one in 10 men(new window) in the US will experience stalking at some point in their lives, and a growing share of that stalking happens through a phone or a laptop rather than in person.

Most importantly, cyberstalking is a crime. But the laws that define it vary around the world. 

This guide covers what cyberstalking is and how it differs from other forms of online harassment. We also examine what the law says in major jurisdictions. And you’ll learn what you can do to recognize it, respond to it, and make yourself a harder target in the first place.

What is cyberstalking?

Cyberstalking is the repeated use of the internet, email, social media, or other electronic means to harass someone with the intent to intimidate or control them. As with offline stalkers, most cyberstalkers have had some prior relationship with their target, whether as a former partner, coworker, or acquaintance.

The kinds of harassment that can be considered cyberstalking are varied. In 2025, a man in the US used an AI chatbot(new window) to lure people to the home of his victim as part of a seven-year-long cyberstalking attack. In the UK, a woman was sentenced to 28 months in prison(new window) for posting harmful, false allegations online.

“Cyberstalking” gets used loosely alongside a few related terms:

  • Online harassment is broader than cyberstalking. Cyberstalking laws usually require proof that the behavior caused fear of physical danger; online harassment laws often only require that the person intended to annoy or alarm you, with no legitimate reason(new window) for the contact.
  • Cyberbullying is a related pattern of aggressive, unwanted contact, but the term is generally associated with minors and schools rather than adults.
  • Doxing is the act of publishing someone’s address, phone number, or other identifying details to scare or endanger them. It’s usually a tactic within a broader stalking or harassment case, and few countries treat it as a standalone crime.

Legally speaking, the distinctions matter if you’re trying to figure out what protections apply to you.

Cyberstalking laws around the world

Cyberstalking is seldom its own standalone offense. Instead, it’s typically prosecuted under general stalking or harassment laws. Nearly every legal system covered here also shares one requirement: proof of a repeated pattern of behavior, not a single incident.

United States

There’s no single federal “cyberstalking law.” Most prosecutions happen at the state level, under stalking or harassment statutes that have been extended to cover electronic communications.  California passed the first state law explicitly naming cyberstalking as an offense in 1999, and most other states have since followed(new window). 

At the federal level, 18 U.S.C. § 2261A(new window) criminalizes using interstate travel or electronic communications with intent to kill, injure, harass, intimidate, or surveil someone, when that conduct causes substantial emotional distress or a reasonable fear of serious harm. A conviction carries up to five years in prison as a base penalty.

United Kingdom

The UK prosecutes cyberstalking under Section 2A of the Protection from Harassment Act 1997(new window), the same law that covers offline stalking. A stalking conviction can carry up to 10 years in prison. For single threatening or grossly offensive messages that don’t meet the bar for an ongoing stalking pattern, prosecutors can instead use the Malicious Communications Act 1988(new window) or the Communications Act 2003(new window). More recently, the Online Safety Act 2023(new window) introduced statutory duties for platforms operating in the UK, naming stalking and harassment as among the kinds of illegal content that platforms are specifically required to address.

Germany

Germany criminalizes stalking under Section 238 of the Criminal Code(new window) (StGB), amended in 2017 specifically to strengthen protections. The law explicitly covers conduct carried out “by means of telecommunications or by using [a victim’s] personal data” — including impersonating the person — which is the direct bridge to cyberstalking. A conviction carries up to three years in prison, rising to five in severe cases. Cyberstalking cases in Germany are also often prosecuted alongside related offenses like online threats (Section 241 StGB) or insult and defamation (Sections 185–187 StGB).

France

France addresses cyberstalking under Article 222-33-2-2 of the Penal Code(new window), which defines a form of moral harassment as repeated behavior that degrades a person’s living conditions and harms their physical or mental health. A conviction carries up to one year in prison and a €15,000 fine. France’s 2016 Digital Republic Act strengthened the law with harsher penalties for “revenge porn,”(new window) doubling the jail time and increasing the fine to €60,000.

Canada

In Canada, online stalking is prosecuted under Section 264 of the Criminal Code(new window), the criminal harassment provision enacted in 1993. A conviction requires proving the behavior caused the victim to reasonably fear for their safety or the safety of someone they know, and it carries up to 10 years in prison. Cyberstalking can also be prosecuted under Bill C-13(new window) (Protecting Canadians from Online Crime Act), which stipulates that the “contact was both repetitive and unwanted” and that “victims must reasonably fear for their safety or the safety of someone known to them”.

Italy

Italy criminalizes stalking as “atti persecutori” (persecutory acts) under Article 612-bis of the Criminal Code(new window), introduced in 2009. The law covers repeated conduct that causes lasting anxiety or fear, a reasonable fear for someone’s safety, or forces a victim to change their daily habits. The provision specifically mentions email and text messages as examples. The base penalty ranges from one to six-and-a-half years in prison, and the law has been strengthened twice since, in 2019 and again in 2023. It’s necessary for the victim to file a charge within six months of the occurrence of the crime.

Brazil

Brazil made stalking a standalone crime relatively recently, through Law 14.132/2021(new window), which added Article 147-A to the Penal Code. It defines the offense as repeatedly pursuing someone, by any means, in a way that threatens their physical or psychological safety, restricts their freedom of movement, or invades their privacy. Brazilian legal commentary treats cyberstalking as squarely covered under “by any means”. The penalty is six months to two years in prison plus a fine, increased by half when the crime targets a child, someone elderly, or a woman because of her sex.

Australia

Australia prosecutes cyberstalking under Section 474.17 of the Criminal Code(new window), which criminalizes using a “carriage service” — any phone or internet service — to menace, harass, or cause offense, carrying up to five years in prison, and notably doesn’t require prosecutors to prove the victim actually feared physical harm.

India

India’s Section 354D of the Penal Code(new window), added in 2013, explicitly criminalizes a man monitoring a woman’s use of the internet, email, or other electronic communication as a form of stalking — one of the more direct statutory references to cyberstalking-style conduct found anywhere. Though the law protects women from men specifically rather than applying generally, men have protection under a separate law on intimidation(new window). A first conviction carries up to three years in prison, rising to five for a repeat offense.

The Philippines

The Philippines’ Safe Spaces Act of 2019(new window) goes further than most, naming “cyberstalking” outright as one of several forms of gender-based online sexual harassment, alongside unwanted sexual messaging and non-consensual sharing of images. This is possibly the most direct reference to cyberstalking as a standalone crime in the world.

Rest of the world

The legal picture is uneven and often incomplete internationally. A 2020 World Bank assessment(new window) found that only 30% of economies worldwide have legal protections addressing online harassment, and just 12% protect against cyber sexual harassment specifically. Only 21 out of the 190 economies analyzed have laws explicitly protecting children from online harassment. More recent research(new window) suggests the legislative coverage hasn’t dramatically improved.

Why cyberstalking is a privacy problem

Every form of cyberstalking depends on a stalker getting hold of some piece of digital information. But whatever the case, information is what they weaponize against their victim, and there are many possible sources:

  • Data brokers and people-search sites. These sites scrape and resell your address, phone number, workplace, and family details, often without your knowledge, and they’re frequently the easiest starting point for a stalker building a profile of you.
  • Photo and location metadata. Photos taken with location services turned on carry embedded GPS coordinates in their image metadata. Stalkers have used metadata from dating-app and social media photos to identify victims’ homes and workplaces.
  • Stalkerware. This is commercial monitoring software installed on a device, usually by someone who had physical access to it, that lets an abuser track messages, calls, browsing, and location.
  • Reused or weak passwords. A single breached password from an old, unrelated account can be the opening that lets someone take over your email or social media.

Cleaning up your digital footprint is the most effective thing you can do to stay safe.

Recognize cyberstalking, respond to it, protect yourself against it

If you notice these signs, someone may be cyberstalking you

If you notice these signs, someone may be cyberstalking you: 

  • Contact that’s excessive or arrives in sudden bursts
  • Engagement with old social media posts that would have taken real effort to dig up
  • Threats or blackmail, including threats to release private information or images
  • Attempts to access your accounts or devices, or a fake profile making contact after you’ve blocked the real one
  • Unwanted sexual messaging

The clearest signal that something has crossed from unwanted attention into stalking is if the contact continues after you’ve clearly said to stop. 

What to do if someone is cyberstalking you

If you’re being cyberstalked:

  1. Send one clear, written message saying the contact is unwanted, then stop engaging entirely.
  2. Document everything: dates, screenshots, descriptions of each incident.
  3. Report the person to the platform where the contact happened.
  4. Block them across every channel you use.
  5. Tell people you trust rather than handling it alone.
  6. If it continues, file a police report and consider a restraining or protective order.

A note on stalkerware: If you suspect stalkerware on your phone, removing it can alert whoever installed it and potentially escalate the situation. If you’re in an ongoing abusive relationship, it’s worth getting support from a domestic violence advocate before you act. 

See this in-depth explainer on stalkerware from the Coalition Against Stalkerware(new window).

To protect your privacy:

  • Search your own name to see what’s already findable, and opt out of data broker and people-search sites. (Note: This isn’t a one-time fix, since new listings resurface over time.)
  • Review your online privacy settings and turn off geolocation tagging on your camera and apps, so photos stop carrying GPS data.
  • Use a VPN(new window) to hide your IP address(new window), keeping your general location hidden from anyone trying to trace your connection back to you — but be aware that a VPN won’t hide GPS data or protect information you willingly enter into an account.
  • Use a password manager to generate unique passwords for every account, and turn on two-factor authentication for an extra layer of security.
  • Use email aliases instead of your real email address when signing up for anything, so services and data brokers never connect a new account back to your identity.
  • Watch your devices for signs of stalkerware: fast battery drain, unrecognized apps, or permission changes you didn’t make.

Privacy is your best defense against cyberstalking

Cyberstalking is a crime, and many countries give you a legal path to respond to it. But the law works after the fact; the more effective move is making your personal data harder to find in the first place. 

That starts with the basics: an email address that isn’t tied to your real name, passwords a stalker can’t guess or reuse from an old breach, and an internet connection that doesn’t broadcast your location to anyone watching.

Our mission at Proton is to help you protect your privacy from Big Tech surveillance. But doing so is also a good step toward protecting your personal safety.