1. What Cyberbullying Covers Legally and Where the First Amendment Draws the Line
Cyberbullying is not a single federal cause of action but a category of online conduct that can give rise to civil tort claims, criminal charges, administrative school proceedings, and platform-level enforcement, with the applicable legal framework determined by who the victim is, what the perpetrator did, and what platform hosted the conduct.
The First Amendment protects a broad range of online speech including opinions, hyperbole, and statements on matters of public concern, but it does not protect statements of fact that are false and defamatory, true threats that communicate a serious intent to commit violence, harassment that serves no communicative purpose other than to terrorize or demean, and speech that is part of a pattern of conduct designed to cause severe distress. The distinction between protected expression and actionable cyberbullying depends on whether the specific content conveys a verifiable false fact, constitutes a genuine threat, or forms part of a targeted harassment campaign rather than a comment on a matter of public interest.
Non-consensual intimate image conduct, in which a perpetrator shares or threatens to share private sexual images of a victim without consent, is criminalized in most states as revenge pornography or image-based sexual abuse, and most state statutes apply regardless of whether the perpetrator originally obtained the images with the victim's consent. This category of cyberbullying conduct produces some of the most severe and rapid legal consequences available because it involves both criminal liability and civil claims for damages.
When Cyberbullying Conduct Meets the Threshold for Criminal Harassment or Cyberstalking
Federal cyberstalking under 18 U.S.C. § 2261A is committed when a person, using any facility of interstate commerce including the internet or any electronic communication service, engages in a course of conduct that causes substantial emotional distress to a specific person or places that person in reasonable fear of death or serious bodily injury, or targets that person's immediate family.
The course of conduct requirement means that a single harassing message typically does not satisfy the federal statute, but a pattern of repeated messages, posts, and contact across platforms can constitute a course of conduct even when each individual communication might appear minor in isolation. State cyberstalking and harassment statutes typically have lower thresholds than the federal statute and can reach single incidents of severe harassment, doxxing that exposes a victim's personal information to enable others to harass or threaten them, and impersonation of a victim online to damage their reputation or solicit unwanted contact.
Criminal charges for cyberbullying are investigated by local law enforcement, the FBI's Internet Crime Complaint Center, and in some cases the U.S. Attorney's Office when the conduct crosses state lines or involves a federal statute. An attorney who handles cyberstalking and criminal harassment matters can evaluate whether the documented conduct meets the applicable criminal threshold and assist in preparing a comprehensive law enforcement referral that presents the evidence in the most compelling format.
| Legal Remedy | Who Pursues It | Standard Required | What It Produces |
|---|---|---|---|
| Criminal cyberstalking | State or federal prosecutors | Proof beyond a reasonable doubt | Conviction, probation, restraining order, prison |
| Civil harassment protective order | Victim through civil court | Credible threat or course of harassment | No-contact order, contempt for violation |
| Defamation lawsuit | Victim through civil court | False statement of fact, damages | Money damages, injunction against further publication |
| School disciplinary proceeding | School administration | Substantial disruption or violation of policy | Suspension, expulsion, mandatory counseling |
2. What Civil Claims Cyberbullying Victims Can Bring against Perpetrators
Civil litigation against cyberbullying perpetrators provides a path to money damages and court orders that criminal prosecution cannot produce, and the civil standard of proof, preponderance of the evidence, is significantly lower than the criminal standard that governs prosecution decisions.
Intentional infliction of emotional distress requires proof that the defendant's conduct was extreme and outrageous, that the defendant intended to cause severe emotional distress or acted with reckless disregard of the probability of doing so, and that the plaintiff suffered severe emotional distress as a result. Courts apply the extreme and outrageous standard rigorously in the cyberbullying context, distinguishing between conduct that is offensive or hurtful and conduct that exceeds all bounds of decency. A sustained campaign of harassment targeting a specific individual with threats, humiliation, and deliberate interference with the victim's social relationships is more likely to satisfy this standard than isolated offensive comments.
Defamation claims are available when the cyberbullying involves publication of false statements of fact that damage the victim's reputation, and they provide access to both actual damages for economic losses and presumed damages for reputational harm in some jurisdictions. An attorney who handles online defamation and internet defamation matters can evaluate whether specific posts contain verifiable false statements of fact or protected opinion and whether the damage to the victim's reputation is sufficient to support a viable claim.
How Section 230 Limits Platform Liability but Does Not End Every Civil Option
Section 230 of the Communications Decency Act, 47 U.S.C. § 230, immunizes online platforms from civil liability for content posted by users, which typically means that social media companies, comment sections, and other hosting platforms cannot be sued for the cyberbullying content their users post.
The Section 230 immunity protects platforms from being held liable as publishers or speakers of third-party content, but it does not protect platforms from liability for their own conduct, including their own editorial decisions about content, and it does not apply to federal criminal claims. Courts have recognized that platforms lose Section 230 immunity when they become sufficiently involved in creating or developing the specific harmful content, but this exception is narrow and most cases involving user-posted cyberbullying content will not overcome Section 230.
Despite Section 230, most major platforms operate terms of service that prohibit harassment, threats, and non-consensual intimate image sharing, and they maintain reporting mechanisms through which victims can request removal of content. DMCA takedown notices under 17 U.S.C. § 512 are available to remove non-consensual intimate images and other content that reproduces copyrighted material without authorization, requiring platforms to remove content promptly upon receiving a valid notice. An attorney who handles internet and social media and online harassment matters can submit platform reports and takedown notices simultaneously with civil litigation to minimize the duration of harmful content's online presence.
Anonymous cyberbullying, in which the perpetrator operates behind a pseudonym or fake account, does not prevent civil litigation but requires an additional procedural step before the defendant can be identified and served. A plaintiff can file a Doe lawsuit naming the unknown defendant and then subpoena the platform for the account holder's identifying information, including the IP address used to create the account, the email address associated with the account, and any payment information linked to premium features. Courts generally grant these subpoenas when the plaintiff demonstrates a prima facie valid claim and the requested information is the only practical means of identifying the defendant.
3. How Cyberbullying Targeting Students Creates School Liability and Federal Obligations
Schools have specific legal obligations when cyberbullying targets students, including mandatory reporting requirements under state anti-bullying statutes, Title IX obligations when the harassment is based on sex, and potential civil liability when school administrators knew about the harassment and failed to respond adequately.
Every state has enacted a student cyberbullying or anti-bullying law that defines cyberbullying, requires schools to adopt policies addressing it, establishes investigation and response procedures, and in many states mandates that schools address off-campus cyberbullying when it substantially disrupts the school environment or infringes on a student's rights at school. The substantial disruption standard, drawn from Tinker v. Des Moines Independent Community School District, 393 U.S. 503 (1969), determines the extent of a school's authority to discipline students for off-campus speech including social media posts.
Title IX of the Education Amendments of 1972 requires schools that receive federal funding to respond promptly and effectively to sex-based harassment, including cyberbullying that targets a student because of their sex or gender identity. A school that has actual knowledge of sex-based cyberbullying and responds with deliberate indifference faces federal Title IX liability for the student victim's educational losses. An attorney who handles Title IX and school-based harassment matters can evaluate whether the school's response to reported cyberbullying satisfied its legal obligations and whether the student victim has a viable federal claim.
How Victims Identify Anonymous Cyberbullies through Doe Subpoenas
A Doe subpoena is a court order compelling a platform, internet service provider, or other third party to disclose the identifying information associated with an anonymous online account used to conduct cyberbullying or harassment.
To obtain a Doe subpoena, the plaintiff must typically file a lawsuit naming the unknown defendant as John Doe, file a motion explaining the legal basis for the claim and the need for the identifying information, and demonstrate to the court that the requested disclosure is narrowly tailored to what is needed to identify the specific defendant. Courts balance the plaintiff's right to identify their harasser against the defendant's First Amendment right to anonymous speech, applying tests that require the plaintiff to demonstrate a prima facie valid cause of action before the anonymous speaker's identity is disclosed.
Once a platform receives the subpoena, it typically notifies the account holder, who has an opportunity to object to the disclosure before the platform produces the information. The timeframe from Doe lawsuit filing to defendant identification can range from several weeks to several months depending on the court's schedule, the platform's response time, and whether the account holder contests the subpoena. An attorney who handles social media defamation and online harassment identification matters can structure the Doe subpoena motion to satisfy the applicable court's standard while minimizing the time the harassment continues uncontested.
Sextortion and non-consensual intimate image sharing represent the most severe form of image-based cyberbullying, and they trigger the most rapid and powerful legal responses available. Most states have enacted specific criminal statutes making non-consensual sharing of intimate images a felony, with mandatory registration as a sex offender in some jurisdictions for repeat offenders. Federal law under 15 U.S.C. § 6851, the SHIELD Act, provides a federal civil claim for victims that allows suit in federal court, recovery of actual damages and statutory damages up to one hundred fifty thousand dollars per violation, and attorney's fees. An attorney who handles sextortion and video blackmail matters can pursue emergency relief to remove images and simultaneously pursue the civil and criminal remedies available for this conduct.
4. Frequently Asked Questions about Cyberbullying
Cyberbullying legal questions come from parents of students being targeted at school, from adults experiencing workplace online harassment, and from victims who do not know whether the law provides any remedy for conduct that is causing them serious harm. The questions that arise in those situations most consistently are answered here.
What Is Cyberbullying and When Does It Become Legally Actionable?
Cyberbullying is a pattern of online conduct designed to harm, intimidate, humiliate, or threaten a specific individual, using digital communications including social media, text messages, email, gaming platforms, or any other electronic medium. It becomes legally actionable when it crosses specific thresholds: false statements of fact that damage reputation satisfy defamation, extreme and outrageous conduct causing severe distress satisfies IIED, a course of conduct causing fear or severe distress satisfies cyberstalking under 18 U.S.C. § 2261A, and sex-based harassment targeting a student satisfies Title IX obligations. A single severe incident can be actionable; a sustained campaign almost always is.
Can I Sue Someone for Cyberbullying Me Online?
Yes. Civil claims available for cyberbullying include defamation for false statements of fact published online, intentional infliction of emotional distress for extreme and outrageous harassment, civil harassment for a course of conduct justifying a protective order, and in some states a specific civil cause of action for non-consensual intimate image sharing. Money damages, injunctive relief requiring the perpetrator to cease conduct, and court orders requiring removal of posted content are each available depending on the specific claims. If the perpetrator is anonymous, a Doe subpoena can be used to identify them before or after filing suit.
Is Cyberbullying a Crime?
Yes, in most circumstances. Federal cyberstalking under 18 U.S.C. § 2261A applies when harassment using electronic communication causes substantial emotional distress or places a person in reasonable fear of serious bodily injury, with penalties including up to five years in federal prison for first offenses. All 50 states have enacted criminal cyberbullying, cyberstalking, or criminal harassment statutes that reach online conduct, with penalties ranging from misdemeanor fines to felony imprisonment depending on the severity and the victim's characteristics. Non-consensual intimate image sharing is a felony in most states. Reports can be made to local law enforcement, state authorities, and the FBI's Internet Crime Complaint Center.
What Can Schools Be Required to Do When a Student Is Cyberbullied?
Every state requires schools to adopt anti-bullying policies that address cyberbullying, establish investigation procedures, and respond to reported incidents with appropriate disciplinary action. When cyberbullying is based on the victim's sex or gender identity, Title IX requires the school to respond promptly and effectively to prevent and address the harassment. A school that receives a report of cyberbullying and fails to investigate, continues to fail to act after learning the harassment is ongoing, or responds in a way that is clearly unreasonable faces potential liability under Title IX and state anti-bullying laws. Parents of student victims should document all reports made to school administrators with dates, content, and the administrators' responses.
Can the Platform Hosting Cyberbullying Content Be Held Responsible?
Generally no. Section 230 of the Communications Decency Act, 47 U.S.C. § 230, immunizes online platforms from civil liability for content posted by users, which protects social media companies, websites, and other hosting services from lawsuits based on what their users post. Platforms can be required to remove content through DMCA takedown notices, court orders, and their own terms of service enforcement, but they are typically not liable in civil damages for the harm that user-posted cyberbullying caused. The perpetrator who posted the content, not the platform that hosted it, is the primary civil defendant.
What Should Someone Do Immediately after Discovering They Are Being Cyberbullied?
Document everything before anything can be deleted: take screenshots of every harassing post, message, or communication, including the perpetrator's account information, timestamps, and any identifying details visible in the content. Save all electronic records and do not delete any communications with the perpetrator. Report the conduct to the platform through its abuse reporting mechanism and preserve the report confirmation. If the content includes threats or non-consensual intimate images, contact law enforcement immediately while also consulting an attorney about emergency civil remedies including temporary restraining orders. An attorney who handles internet and social media harassment matters can evaluate the documented evidence and identify which remedies are available and which should be pursued first.
29 May, 2026
