Cyberstalking is fundamentally an invasion of privacy. It often starts with information you share online voluntarily, from social media posts to tagged photos.
About one in five women and one in 10 men(jendela baru) in the US will experience stalking at some point in their lives, and a growing share of that stalking happens through a phone or a laptop rather than in person.
Most importantly, cyberstalking is a crime. But the laws that define it vary around the world.
This guide covers what cyberstalking is and how it differs from other forms of online harassment. We also examine what the law says in major jurisdictions. And you’ll learn what you can do to recognize it, respond to it, and make yourself a harder target in the first place.
What is cyberstalking?
Cyberstalking is the repeated use of the internet, email, social media, or other electronic means to harass someone with the intent to intimidate or control them. As with offline stalkers, most cyberstalkers have had some prior relationship with their target, whether as a former partner, coworker, or acquaintance.
The kinds of harassment that can be considered cyberstalking are varied. In 2025, a man in the US used an AI chatbot(jendela baru) to lure people to the home of his victim as part of a seven-year-long cyberstalking attack. In the UK, a woman was sentenced to 28 months in prison(jendela baru) for posting harmful, false allegations online.
“Cyberstalking” gets used loosely alongside a few related terms:
- Online harassment is broader than cyberstalking. Cyberstalking laws usually require proof that the behavior caused fear of physical danger; online harassment laws often only require that the person intended to annoy or alarm you, with no legitimate reason(jendela baru) for the contact.
- Cyberbullying is a related pattern of aggressive, unwanted contact, but the term is generally associated with minors and schools rather than adults.
- Doxing is the act of publishing someone’s address, phone number, or other identifying details to scare or endanger them. It’s usually a tactic within a broader stalking or harassment case, and few countries treat it as a standalone crime.
Legally speaking, the distinctions matter if you’re trying to figure out what protections apply to you.
Cyberstalking laws around the world
Cyberstalking is seldom its own standalone offense. Instead, it’s typically prosecuted under general stalking or harassment laws. Nearly every legal system covered here also shares one requirement: proof of a repeated pattern of behavior, not a single incident.
United States
There’s no single federal “cyberstalking law.” Most prosecutions happen at the state level, under stalking or harassment statutes that have been extended to cover electronic communications. California passed the first state law explicitly naming cyberstalking as an offense in 1999, and most other states have since followed(jendela baru).
At the federal level, 18 U.S.C. § 2261A(jendela baru) criminalizes using interstate travel or electronic communications with intent to kill, injure, harass, intimidate, or surveil someone, when that conduct causes substantial emotional distress or a reasonable fear of serious harm. A conviction carries up to five years in prison as a base penalty.
United Kingdom
The UK prosecutes cyberstalking under Section 2A of the Protection from Harassment Act 1997(jendela baru), the same law that covers offline stalking. A stalking conviction can carry up to 10 years in prison. For single threatening or grossly offensive messages that don’t meet the bar for an ongoing stalking pattern, prosecutors can instead use the Malicious Communications Act 1988(jendela baru) or the Communications Act 2003(jendela baru). More recently, the Online Safety Act 2023(jendela baru) introduced statutory duties for platforms operating in the UK, naming stalking and harassment as among the kinds of illegal content that platforms are specifically required to address.
Germany
Germany criminalizes stalking under Section 238 of the Criminal Code(jendela baru) (StGB), amended in 2017 specifically to strengthen protections. The law explicitly covers conduct carried out “by means of telecommunications or by using [a victim’s] personal data” — including impersonating the person — which is the direct bridge to cyberstalking. A conviction carries up to three years in prison, rising to five in severe cases. Cyberstalking cases in Germany are also often prosecuted alongside related offenses like online threats (Section 241 StGB) or insult and defamation (Sections 185–187 StGB).
France
France addresses cyberstalking under Article 222-33-2-2 of the Penal Code(jendela baru), which defines a form of moral harassment as repeated behavior that degrades a person’s living conditions and harms their physical or mental health. A conviction carries up to one year in prison and a €15,000 fine. France’s 2016 Digital Republic Act strengthened the law with harsher penalties for “revenge porn,”(jendela baru) doubling the jail time and increasing the fine to €60,000.
Canada
In Canada, online stalking is prosecuted under Section 264 of the Criminal Code(jendela baru), the criminal harassment provision enacted in 1993. A conviction requires proving the behavior caused the victim to reasonably fear for their safety or the safety of someone they know, and it carries up to 10 years in prison. Cyberstalking can also be prosecuted under Bill C-13(jendela baru) (Protecting Canadians from Online Crime Act), which stipulates that the “contact was both repetitive and unwanted” and that “victims must reasonably fear for their safety or the safety of someone known to them”.
Italy
Italy criminalizes stalking as “atti persecutori” (persecutory acts) under Article 612-bis of the Criminal Code(jendela baru), introduced in 2009. The law covers repeated conduct that causes lasting anxiety or fear, a reasonable fear for someone’s safety, or forces a victim to change their daily habits. The provision specifically mentions email and text messages as examples. The base penalty ranges from one to six-and-a-half years in prison, and the law has been strengthened twice since, in 2019 and again in 2023. It’s necessary for the victim to file a charge within six months of the occurrence of the crime.
Brazil
Brazil made stalking a standalone crime relatively recently, through Law 14.132/2021(jendela baru), which added Article 147-A to the Penal Code. It defines the offense as repeatedly pursuing someone, by any means, in a way that threatens their physical or psychological safety, restricts their freedom of movement, or invades their privacy. Brazilian legal commentary treats cyberstalking as squarely covered under “by any means”. The penalty is six months to two years in prison plus a fine, increased by half when the crime targets a child, someone elderly, or a woman because of her sex.
Australia
Australia prosecutes cyberstalking under Section 474.17 of the Criminal Code(jendela baru), which criminalizes using a “carriage service” — any phone or internet service — to menace, harass, or cause offense, carrying up to five years in prison, and notably doesn’t require prosecutors to prove the victim actually feared physical harm.
India
India’s Section 354D of the Penal Code(jendela baru), added in 2013, explicitly criminalizes a man monitoring a woman’s use of the internet, email, or other electronic communication as a form of stalking — one of the more direct statutory references to cyberstalking-style conduct found anywhere. Though the law protects women from men specifically rather than applying generally, men have protection under a separate law on intimidation(jendela baru). A first conviction carries up to three years in prison, rising to five for a repeat offense.
The Philippines
The Philippines’ Safe Spaces Act of 2019(jendela baru) goes further than most, naming “cyberstalking” outright as one of several forms of gender-based online sexual harassment, alongside unwanted sexual messaging and non-consensual sharing of images. This is possibly the most direct reference to cyberstalking as a standalone crime in the world.
Rest of the world
The legal picture is uneven and often incomplete internationally. A 2020 World Bank assessment(jendela baru) found that only 30% of economies worldwide have legal protections addressing online harassment, and just 12% protect against cyber sexual harassment specifically. Only 21 out of the 190 economies analyzed have laws explicitly protecting children from online harassment. More recent research(jendela baru) suggests the legislative coverage hasn’t dramatically improved.
Why cyberstalking is a privacy problem
Every form of cyberstalking depends on a stalker getting hold of some piece of digital information. But whatever the case, information is what they weaponize against their victim, and there are many possible sources:
- Data brokers and people-search sites. These sites scrape and resell your address, phone number, workplace, and family details, often without your knowledge, and they’re frequently the easiest starting point for a stalker building a profile of you.
- Photo and location metadata. Photos taken with location services turned on carry embedded GPS coordinates in their image metadata. Stalkers have used metadata from dating-app and social media photos to identify victims’ homes and workplaces.
- Stalkerware. This is commercial monitoring software installed on a device, usually by someone who had physical access to it, that lets an abuser track messages, calls, browsing, and location.
- Reused or weak passwords. A single breached password from an old, unrelated account can be the opening that lets someone take over your email or social media.
Cleaning up your digital footprint is the most effective thing you can do to stay safe.
Recognize cyberstalking, respond to it, protect yourself against it
If you notice these signs, someone may be cyberstalking you:
- Contact that’s excessive or arrives in sudden bursts
- Engagement with old social media posts that would have taken real effort to dig up
- Threats or blackmail, including threats to release private information or images
- Attempts to access your accounts or devices, or a fake profile making contact after you’ve blocked the real one
- Unwanted sexual messaging
The clearest signal that something has crossed from unwanted attention into stalking is if the contact continues after you’ve clearly said to stop.
If you’re being cyberstalked:
- Send one clear, written message saying the contact is unwanted, then stop engaging entirely.
- Document everything: dates, screenshots, descriptions of each incident.
- Report the person to the platform where the contact happened.
- Block them across every channel you use.
- Tell people you trust rather than handling it alone.
- If it continues, file a police report and consider a restraining or protective order.
A note on stalkerware: If you suspect stalkerware on your phone, removing it can alert whoever installed it and potentially escalate the situation. If you’re in an ongoing abusive relationship, it’s worth getting support from a domestic violence advocate before you act.
See this in-depth explainer on stalkerware from the Coalition Against Stalkerware(jendela baru).
To protect your privacy:
- Search your own name to see what’s already findable, and opt out of data broker and people-search sites. (Note: This isn’t a one-time fix, since new listings resurface over time.)
- Review your online privacy settings and turn off geolocation tagging on your camera and apps, so photos stop carrying GPS data.
- Use a VPN(jendela baru) to hide your IP address(jendela baru), keeping your general location hidden from anyone trying to trace your connection back to you — but be aware that a VPN won’t hide GPS data or protect information you willingly enter into an account.
- Use a password manager to generate unique passwords for every account, and turn on two-factor authentication for an extra layer of security.
- Use email aliases instead of your real email address when signing up for anything, so services and data brokers never connect a new account back to your identity.
- Watch your devices for signs of stalkerware: fast battery drain, unrecognized apps, or permission changes you didn’t make.
Privacy is your best defense against cyberstalking
Cyberstalking is a crime, and many countries give you a legal path to respond to it. But the law works after the fact; the more effective move is making your personal data harder to find in the first place.
That starts with the basics: an email address that isn’t tied to your real name, passwords a stalker can’t guess or reuse from an old breach, and an internet connection that doesn’t broadcast your location to anyone watching.
Our mission at Proton is to help you protect your privacy from Big Tech surveillance. But doing so is also a good step toward protecting your personal safety.
