Cyberstalking laws and penalties reach anyone who uses the internet, email, texts, social media, or other electronic communication to carry out a repeated course of conduct that puts another person in fear of serious harm or causes substantial emotional distress. A standard federal conviction carries up to five years in prison and a $250,000 fine, and the sentence rises with the harm caused, reaching life imprisonment if the victim dies. States prosecute most cases on their own, with penalties ranging from a year in jail for a misdemeanor to felony prison time when threats, minors, or prior convictions are involved.
What Counts as Cyberstalking
A single ugly message is not cyberstalking. Prosecutors have to show a repeated pattern of behavior directed at a specific person through electronic channels such as email, social media, texts, or messaging apps. The conduct has to be intentional, meaning the sender acted with the purpose of harassing, intimidating, or surveilling the target.
The conduct also has to produce a specific harm. Either it placed the victim in reasonable fear of death or serious physical injury, or it caused, or could reasonably be expected to cause, substantial emotional distress. That distress standard extends to the victim’s immediate family, spouse, or intimate partner. Courts evaluate the fear or distress from the perspective of a reasonable person in the victim’s position.
State laws share the same core structure: intentional conduct, a repeated pattern, and a harmful impact on the target. Some statutes emphasize the defendant’s intent, requiring proof the person meant to harass or frighten. Others focus on whether the conduct would cause a reasonable person to feel threatened. That difference can matter a great deal at trial.
Federal Cyberstalking Under 18 U.S.C. 2261A
The federal cyberstalking statute, 18 U.S.C. 2261A, covers two situations. The first is physically traveling across state lines or through Indian country with intent to harass or intimidate, then engaging in conduct that causes fear or emotional distress. The second is using the mail, an interactive computer service, or any electronic communication system tied to interstate commerce to carry out the same course of conduct.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
The second scenario is what applies to most cyberstalking cases. The internet counts as a facility of interstate commerce, so federal jurisdiction can attach even when the stalker and the victim live in the same state. In practice, federal prosecutors tend to concentrate on cases that cross state or international lines, involve severe threats, or accompany other federal offenses. Cases contained within one state are usually handled by state prosecutors.
The statute protects the direct victim and also their immediate family, spouse, intimate partner, and pets or service animals. Credible threats against a victim’s animals can support federal charges.1Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Federal Penalties
Sentences for federal cyberstalking are set out in 18 U.S.C. 2261(b), and they escalate with the harm caused:
- Up to 5 years in prison for a standard conviction with no aggravating physical harm.
- Up to 10 years if the victim suffers serious bodily injury or the offender uses a dangerous weapon.
- Up to 20 years if the victim suffers permanent disfigurement or life-threatening bodily injury.
- Life imprisonment if the victim dies as a result of the conduct.
- A minimum of 1 year if the cyberstalking violates an existing civil or criminal protection order.
Each tier also carries a fine of up to $250,000 for an individual.2Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence3Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine The FBI has confirmed that a standard federal cyberstalking conviction is punishable by up to five years and a $250,000 fine, with a life sentence possible when a victim’s death results.4Federal Bureau of Investigation. Sentences in Separate Cyberstalking Cases
State Charges and Penalties
All 50 states and the District of Columbia criminalize stalking, and most have updated their statutes to cover electronic conduct. Some states have standalone cyberstalking offenses with their own penalty ranges. Others fold electronic harassment into a general stalking statute. The specific language varies widely, but the elements are consistent: intentional conduct, a pattern of repeated behavior, and a harmful impact on the target such as fear or emotional distress. Many statutes specifically list the qualifying conduct, including emails, texts, social media posts, and publishing someone’s personal information online without consent.
Many states classify basic cyberstalking as a misdemeanor punishable by up to one year in jail. Charges are elevated to a felony when the conduct involves credible threats of violence, targets a minor, or the defendant has prior stalking convictions. Courts at either level may also impose restraining orders, mandatory counseling, probation with electronic monitoring, and restrictions on internet use as conditions of sentencing.
How Long Prosecutors Have to File Charges
Under federal law, the general statute of limitations for non-capital criminal offenses is five years from when the offense was committed. Cyberstalking under 18 U.S.C. 2261A is not on the list of federal offenses with an extended limitations period, so the standard five-year window applies.5United States Department of Justice Archives. Criminal Resource Manual 650 – Length of Limitations Period
State windows differ. Some states set shorter limits of two or three years for misdemeanor stalking, while felony charges usually carry longer time limits. Because cyberstalking typically involves an ongoing course of conduct, the clock may not start until the last act in the pattern rather than the first. Waiting too long to report can still cost a victim the ability to pursue criminal charges, which is one reason early documentation matters.
Defenses and the First Amendment Limit
The most significant defense in cyberstalking cases comes from the First Amendment. Not everything unpleasant said online is a crime, and cyberstalking statutes have to be narrow enough to avoid punishing protected speech.
In Counterman v. Colorado, decided in 2023, the Supreme Court held that the First Amendment requires prosecutors to prove the defendant had some subjective awareness that their statements could be perceived as threatening. A purely objective test, asking only whether a reasonable person would view the statements as threats, is not enough. The Court settled on a recklessness standard: the government has to show the defendant consciously disregarded a substantial risk that their communications would be viewed as threatening, and sent them anyway.6Supreme Court of the United States. Counterman v Colorado, 600 US 66 (2023)
The ruling raised the bar for cyberstalking prosecutions nationwide. State statutes that use a purely objective “reasonable person” test for true threats are now constitutionally vulnerable. Prosecutors must present evidence about the defendant’s mental state, not just the content of the messages.
Beyond the First Amendment, defendants commonly raise several other arguments:
- Lack of intent. The statute requires proof the defendant acted with purpose to harass or intimidate. Communications tied to a legitimate purpose, such as a custody dispute or a business matter, may not meet that standard.
- No course of conduct. A single angry message, however ugly, does not add up to the repeated pattern the law requires.
- Consent or mutual engagement. If both parties were voluntarily participating in heated exchanges, the defense may argue the communications were not unwanted.
- Mistaken identity. Anonymous accounts, spoofed numbers, and VPNs can make it hard to prove who actually sent the messages. The defense may challenge whether the evidence sufficiently ties the defendant to the conduct.
Protection Orders and Civil Claims
Criminal charges are not the only legal option. A person being cyberstalked can petition a court for a civil restraining order requiring the stalker to stop contact and stay a specified distance away. If criminal charges are filed, the judge may also issue a criminal protective order while the case is pending, and a conviction can lead to a protection order lasting up to ten years. Violating either type of order is itself a criminal offense and, under federal law, triggers a mandatory minimum of one year in prison if the underlying conduct also violates the federal stalking statute.2Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
Under the Violence Against Women Act, states that receive federal VAWA funding must allow victims of stalking, domestic violence, sexual assault, and dating violence to file for protection orders at no cost. Filing fees, service fees, and other associated costs cannot be charged.7Office of the Law Revision Counsel. 34 USC 10450 – Costs for Criminal Charges and Protection Orders Harassment protection orders between people without a domestic or dating relationship may still carry fees in some jurisdictions, but stalking-specific orders should be free under VAWA.
Civil lawsuits are a separate route. The two most common claims are intentional infliction of emotional distress and defamation. An emotional distress claim requires showing the conduct was extreme and outrageous and caused severe emotional harm. Defamation applies when the stalker published false statements about the victim to third parties. Successful civil claims can recover compensatory damages for therapy costs, lost income, and emotional suffering, plus punitive damages if the court finds the defendant acted with willful disregard for the law.
If You Are Being Cyberstalked
Evidence disappears fast online. Messages get deleted, accounts get deactivated, and platform data retention policies vary. Start preserving evidence before doing anything else.
For every incident, take screenshots that capture the sender’s name or username, the message content, and the date and time. For text messages, tap or slide on individual messages to reveal timestamps if they aren’t visible by default. If the harassment spans long conversations, record a video scrolling through the full exchange. When content appears on a website or social media profile, capture the full URL alongside the page content.
Keep a written log with the date, time, location, and description of each incident. Note any witnesses and attach copies of preserved evidence. If you report an incident to police or a platform, record the name and badge or case number of whoever took the report.
Secure your devices. Change passwords on all accounts, enable two-factor authentication, and review every app on your phone for anything you didn’t install. Check location-sharing settings and turn off Bluetooth and geotagging when not in use. If the stalker has had physical access to your computer, run malware and spyware scans and consider using a different device for sensitive communications. Do not factory-reset a phone that contains evidence until law enforcement has had the chance to preserve it.
To report cyberstalking, contact your local police department and file a report. If the conduct crosses state lines or involves the internet, you can also file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.8Internet Crime Complaint Center. IC3 Home Page Bring your evidence log and screenshots when you report.