Yes, leaking someone’s numbers can be illegal in the United States, and in many cases it is a criminal offense. Whether it’s a phone number, a bank account number, or a Social Security number, the law treats each one differently, and the consequences range from civil lawsuits to federal felony charges.
This question matters more in 2026 than it ever has before. States have been passing new doxxing and data privacy laws at a rapid pace. What was a gray area three years ago may now carry a real criminal penalty.
This article breaks down exactly which types of numbers are protected, which laws apply at the state and federal level, what penalties look like, and what your rights are if someone exposes your private information.
Is It Illegal to Leak Numbers?
Leaking someone’s private numbers is often illegal, but the answer depends heavily on what type of number was shared and the intent behind sharing it.
The United States does not have one single federal law that covers all forms of number leaking. Instead, a patchwork of federal statutes and state laws addresses specific types of numbers in specific contexts. A phone number leaked to harass someone falls under harassment and stalking statutes. A bank account number leaked to commit fraud falls under financial fraud laws. A Social Security number disclosed without authorization can trigger federal identity theft statutes.
The common thread across all of these is intent and harm. Courts and prosecutors look at whether the person who leaked the number intended to cause harm, whether they did cause harm, and whether the information was protected under any specific statute.
Quick Facts:
- No single federal “number leaking” law exists
- Multiple statutes cover different types of numbers
- Intent and resulting harm are key legal factors
- Both criminal and civil liability can apply
Is Leaking Someone’s Phone Number Illegal?
Leaking someone’s phone number can be illegal, particularly when it is done to facilitate harassment, stalking, or threats.
At the federal level, the Computer Fraud and Abuse Act (CFAA) can apply if someone obtains a phone number through unauthorized computer access and then publishes it. The Electronic Communications Privacy Act (ECPA) also has provisions that restrict unauthorized interception and disclosure of private communications-related information.
At the state level, many states have enacted specific doxxing statutes that explicitly cover the publication of phone numbers with intent to harass. California’s AB 1732, signed into law in 2022, made it a crime to publish someone’s personal information, including their phone number, with the intent to cause imminent fear or incite harassment. Texas, Florida, and Virginia have similar statutes already in place.
Simply sharing a phone number that is already publicly listed, like one found in a business directory, is generally not illegal. The legal line gets crossed when the disclosure is combined with intent to cause harm or when it enables someone to stalk or threaten another person.
| Scenario | Likely Legal Outcome |
|---|---|
| Sharing a number from a public directory | Generally legal |
| Posting a number to encourage harassment | Potentially criminal |
| Leaking a number obtained through hacking | Federal crime under CFAA |
| Sharing an ex-partner’s number with threats | Criminal under stalking/doxxing laws |
| Accidentally forwarding a number in a group chat | Likely not criminal |
Is It Illegal to Leak Bank Account Numbers?
Leaking bank account numbers is a serious federal crime in most circumstances, especially when financial fraud or identity theft results.
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customers’ nonpublic personal information, including account numbers. Unauthorized disclosure of this information by a bank employee or affiliated party violates the GLBA and can result in civil penalties of up to $100,000 per violation. Individuals who knowingly and willfully access or disclose this information face criminal penalties of up to $10,000 in fines and five years in prison.
The Identity Theft Enforcement and Restitution Act of 2008 also applies when someone leaks bank account numbers to facilitate identity theft. Federal prosecutors use 18 U.S.C. Section 1028 and 1028A to charge individuals with aggravated identity theft, which carries mandatory prison time.
Bold Callout: Aggravated identity theft under 18 U.S.C. Section 1028A carries a mandatory minimum of 2 years in federal prison, consecutive to any other sentence.
It is not just individuals who face liability. Companies that fail to secure and leak bank account numbers face enforcement actions from the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). State attorneys general can also bring suits under state consumer protection statutes.
Is It Illegal to Share Social Security Numbers?
Sharing someone’s Social Security number without authorization is illegal under federal law and can lead to felony charges.
The Privacy Act of 1974 restricts government agencies from disclosing SSNs without consent. For private individuals and businesses, 18 U.S.C. Section 1028 governs the fraudulent use or transfer of identification documents, including Social Security numbers. The Social Security Number Protection Act also makes it illegal to display, sell, or purchase SSNs without authorization in specific commercial contexts.
Think of an SSN like a master key to someone’s entire financial life. Exposing it is treated by federal law almost like handing a stranger that key with full knowledge of what they can do with it.
The IRS independently investigates SSN theft, particularly when it is used to file fraudulent tax returns. The Federal Trade Commission handles consumer-facing cases of SSN misuse. Penalties at the federal level for SSN fraud can reach 15 years in prison under identity theft statutes.
| Offense | Governing Law | Maximum Penalty |
|---|---|---|
| Unauthorized SSN disclosure (commercial) | SSN Protection Act | Civil and criminal penalties |
| SSN used for identity fraud | 18 U.S.C. Section 1028 | Up to 15 years prison |
| Aggravated identity theft using SSN | 18 U.S.C. Section 1028A | Mandatory 2 years added |
| Government agency SSN disclosure | Privacy Act of 1974 | Civil damages, criminal referral |
| SSN used for tax fraud | IRS statutes | Up to 3 years prison per count |
Doxxing Laws by State 2026
As of 2026, at least 20 states have enacted laws specifically targeting doxxing, with more legislation pending in several others.
Doxxing refers to the act of publicly exposing someone’s private information, which frequently includes their phone number, home address, workplace, or financial details, typically with the intent to cause harm or incite others to act against that person. States have taken increasingly aggressive stances against this behavior over the past three years.
California leads the pack. Penal Code Section 653.2 makes electronic doxxing a misdemeanor punishable by up to one year in county jail and a $1,000 fine. Under AB 1732 (2022), doxxing that targets public officials carries enhanced penalties.
Virginia expanded its law in 2023 under Code Section 18.2-60 to include electronic transmission of personal information with intent to intimidate. Texas treats doxxing under its harassment statute, Texas Penal Code Section 42.07, where repeated or threatening online publication of personal details can become a Class A misdemeanor or a felony if the victim is a public servant.
| State | Key Statute | Classification | Max Penalty |
|---|---|---|---|
| California | Penal Code 653.2 | Misdemeanor | 1 year jail, $1,000 fine |
| Texas | Penal Code 42.07 | Class A Misdemeanor / Felony | Up to 2 years / up to 10 years |
| Florida | Statute 784.048 | Felony (3rd degree) | Up to 5 years prison |
| Virginia | Code 18.2-60 | Class 6 Felony | Up to 5 years prison |
| Washington | RCW 9A.90.120 | Gross Misdemeanor / Felony | Up to 1 year / up to 5 years |
| New York | Penal Law 240.30 | Class A Misdemeanor | Up to 1 year jail |
| Illinois | 720 ILCS 135 | Class 4 Felony | 1 to 3 years prison |
Key Takeaway: Over 20 states now have specific doxxing or personal information exposure laws, and the penalties range from misdemeanor fines to felony prison sentences depending on the state and circumstances.
Penalties for Leaking Personal Information
Penalties for leaking personal information vary widely based on what type of information was leaked, whether the act was criminal or civil, and which state or federal law governs.
On the criminal side, penalties range from a $500 fine for a minor misdemeanor doxxing offense in some states to a mandatory two-year federal prison term for aggravated identity theft. Financial number leaks that enable fraud consistently draw the heaviest sentences.
On the civil side, victims can sue for actual damages, meaning the financial losses they suffered as a result of the leak. In many states, courts can also award punitive damages if the conduct was egregious. Statutory damages under state consumer privacy laws like California’s CCPA range from $100 to $750 per consumer per incident, even without proving actual harm.
| Type of Leak | Criminal Exposure | Civil Exposure |
|---|---|---|
| Phone number with harassment intent | Misdemeanor to felony | Actual damages, emotional distress |
| Bank account number leaked to third party | Up to 5 years federal prison | GLBA damages, CFPB enforcement |
| Social Security number misuse | Up to 15 years federal prison | Statutory damages, restitution |
| Employer exposing customer data | FTC enforcement, state AG action | Class action, CCPA $100-$750/person |
| Doxxing a private individual | Misdemeanor to Class 4 felony | Actual and punitive damages |
Is It Illegal to Give Out Someone’s Number Without Permission?
Giving out someone’s phone number without their permission is not automatically illegal, but it can become illegal quickly depending on the context and outcome.
If you simply pass a friend’s number to another mutual friend who asked for it, that’s generally not a crime and would not form the basis of a civil lawsuit unless there was some specific harm. The law focuses on intent, context, and the harm that results.
The situation changes when the number is shared to enable harassment, stalking, or threats. It also changes when the number was obtained under conditions of confidentiality, such as from a medical provider’s records or from an employer’s private HR database. In those cases, sharing it can violate HIPAA, employment privacy laws, or state confidentiality statutes.
Quick Facts:
- Sharing a publicly listed number is generally not illegal
- Sharing a number obtained from confidential records may violate specific statutes
- Intent to cause harm converts a legal act into a potentially criminal one
- Context matters: who shared it, how they got it, and what happened next
Criminal Charges for Sharing Private Numbers
Criminal charges for sharing private numbers depend on the specific statute violated, the type of number exposed, and the outcome that followed.
At the federal level, charges most often arise under the CFAA (if hacking was involved), 18 U.S.C. Section 1028 (identity-related charges), or the ECPA (if communications were intercepted). State prosecutors use doxxing laws, harassment statutes, stalking statutes, and data breach notification laws to pursue criminal charges.
Prosecutors rarely charge a standalone “number sharing” offense. They build cases around the full picture: how the number was obtained, how it was used, what harm occurred, and whether there was clear intent. Someone who hacks a database, extracts phone numbers, and posts them online to incite harassment faces a much stronger criminal case than someone who accidentally sends the wrong contact information.
Bold Callout: Federal identity theft charges require prosecutors to prove knowing and intentional misuse of identifying information. Accidental exposure rarely leads to criminal prosecution.
State Laws on Leaking Personal Information
Every US state has some form of law that governs the unauthorized disclosure of personal information, though the scope and penalties vary significantly from state to state.
All 50 states have data breach notification laws. These laws require businesses and sometimes individuals to notify affected parties when personal information is compromised. Failure to notify can itself be a criminal or civil offense. California, New York, and Illinois have the most comprehensive notification requirements.
Beyond notification laws, states differ in whether they criminalize individual-to-individual disclosure. California, Florida, Texas, Virginia, and Washington treat personal information leaking as a criminal act under doxxing or harassment statutes when intent to harm is present. States like Wyoming, South Dakota, and Montana have more limited protections and rely primarily on existing harassment or stalking statutes.
Key Takeaway: Every state has data breach notification laws, but criminal penalties for individual acts of personal information leaking depend heavily on whether your state has a specific doxxing or privacy statute.
When Is It Legal to Share Someone’s Number?
Sharing someone’s phone number is legal in several specific situations, and understanding those boundaries helps clarify where the legal line actually sits.
Public figures, including politicians, business owners, and public officials, have reduced privacy expectations for their professional contact information. A politician’s office phone number or a business’s publicly listed contact number can be freely shared without legal concern.
Consent changes everything. If someone gives you their number and you share it with another person, that’s generally within the scope of normal social interaction. The person who provided the number implicitly understood it might be passed along.
Legal sharing scenarios:
- Sharing a business’s publicly listed phone number
- Passing along a contact number when the original person consented
- Sharing information in a court filing or legal proceeding
- Journalists reporting on matters of public concern using published contact info
- Emergency services sharing location-based contact information
The law does not protect someone who hides behind these exceptions while knowingly enabling harassment. Courts look at the actual purpose and effect of the disclosure.
Is It Illegal to Leak Numbers in the Workplace?
Leaking numbers in a workplace context carries some of the most specific and severe legal consequences, because employees typically have access to protected information under conditions of professional trust.
Employees who leak customer phone numbers, account numbers, or financial data can face criminal charges under state computer fraud laws, federal financial privacy statutes, and employment-specific regulations. HIPAA applies when healthcare-related phone or account numbers are involved. The GLBA applies when financial services employees expose client financial data.
Many states also recognize a civil cause of action for breach of fiduciary duty or breach of employment contract when an employee discloses confidential information without authorization. Employers can sue former employees who take or leak client data lists, including phone number databases.
Quick Facts:
- Leaking customer numbers at work can violate HIPAA, GLBA, or state computer fraud laws
- Employers can sue employees for civil damages from customer data leaks
- Retaliatory leaking of coworker information may violate state harassment statutes
- Whistleblowing protections do not cover unauthorized release of private numbers
Employer Data Breach Laws for Phone Numbers
Employers and businesses that expose customer phone numbers through negligence or a data breach face a separate set of legal obligations under both federal and state law.
All 50 states require businesses to notify customers when their personal information, including phone numbers in some states, is compromised in a data breach. The FTC Act Section 5 treats inadequate data security as an unfair business practice, which gives the FTC authority to pursue enforcement actions and fines.
California’s CCPA (California Consumer Privacy Act) and its 2020 expansion, the CPRA (California Privacy Rights Act), give consumers the right to sue companies for data breaches that expose their personal information, including phone numbers. Statutory damages range from $100 to $750 per consumer per incident without needing to prove specific harm.
Bold Callout: Under California’s CPRA, a business that exposes 10,000 customers’ phone numbers through negligent security could face statutory damages between $1 million and $7.5 million without any individual proving actual harm.
| Law | Applies To | Penalty for Violation |
|---|---|---|
| FTC Act Section 5 | All US businesses | Civil penalties, consent decrees |
| CCPA / CPRA | California businesses | $100-$750 per consumer, per incident |
| GLBA | Financial institutions | Up to $100,000 per violation |
| HIPAA | Healthcare entities | $100 to $50,000 per violation |
| State breach notification laws | All 50 states | Varies: civil fines, AG enforcement |
Key Takeaway: Businesses face a completely different and often harsher legal framework than individuals when it comes to exposing phone numbers or financial account data, with potential damages scaling into the millions for large-scale breaches.
Civil Lawsuit for Leaking Personal Information
You can file a civil lawsuit against someone who leaked your personal information, and several legal theories support that kind of case.
The most common legal theory is invasion of privacy, specifically the “public disclosure of private facts” tort. To win, you typically need to show that the information was private, that the disclosure was offensive to a reasonable person, and that there was no legitimate public interest served by the disclosure.
Intentional infliction of emotional distress (IIED) is another avenue when the leaking was done with clear malice and caused significant psychological harm. Harassment and stalking civil claims are available in most states when a phone number or other information was leaked as part of a pattern of threatening behavior.
In California, Washington, and Illinois, state privacy statutes provide additional statutory claims that do not require proving the same elements as common law torts. These statutes often provide minimum statutory damages, which makes it easier to pursue a case even when quantifying financial harm is difficult.
Quick Facts:
- Invasion of privacy (public disclosure of private facts) is the primary civil tort
- IIED claims apply when disclosure was malicious and caused emotional harm
- Stalking and harassment civil claims are available in most states
- Some state statutes provide statutory minimum damages
What to Do If Someone Leaks Your Number
If someone leaks your number, your first step is to document everything before anything gets deleted.
Take screenshots of every post, message, or platform where your number appears. Note the date, time, and URL of each. This documentation is your evidence base for any future criminal complaint or civil lawsuit.
Next, report the content to the platform where it was posted. Under Section 230 of the Communications Decency Act, platforms are not directly liable for user-posted content, but most major platforms have policies against doxxing and will remove content that violates those policies. Filing a report formally begins the paper trail.
Steps to take immediately:
- Screenshot all posts showing your leaked number with timestamps
- Report to the platform (Twitter/X, Reddit, Facebook, TikTok, etc.)
- File a police report, even if local police seem unfamiliar with the law
- Contact the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov if the leaking crossed state lines or involved hacking
- Reach out to your state attorney general’s consumer protection office
- If your financial numbers were leaked, contact your bank immediately and place a fraud alert with Equifax, Experian, and TransUnion
Can You Sue Someone for Leaking Your Phone Number?
Yes, you can sue someone for leaking your phone number, and courts in several states have awarded damages to plaintiffs in such cases.
The strength of your civil case depends on whether you can show the disclosure was unauthorized, whether it was combined with harassment or threatening behavior, and what harm you suffered as a result. Financial harm, reputational harm, and psychological distress all factor into damage calculations.
Small claims court is an option for cases seeking modest compensation. For larger damages, particularly when a pattern of harassment is involved or significant financial loss resulted, hiring a civil attorney to file in state superior court is the more appropriate path.
Bold Callout: California’s CCPA gives individual consumers a private right of action specifically for data breaches. If a business exposed your phone number due to failure to maintain reasonable security, you may not need to prove specific harm to recover $100 to $750 per incident.
State courts differ on how sympathetic they are to phone number invasion of privacy claims when no financial harm occurred. Illinois, California, and Washington tend to be the most plaintiff-friendly states for personal information civil suits.
Victim Rights When Personal Information Is Leaked
Victims of personal information leaks have concrete legal rights, and those rights have expanded significantly through 2025 and into 2026.
At the federal level, the Crime Victims’ Rights Act (42 U.S.C. Section 10606) gives crime victims the right to be notified of proceedings, to be present at public court proceedings, and to be heard at sentencing. When a phone number leak leads to a federal prosecution, victims can request restitution as part of the sentencing order.
State-level victim rights vary, but most states that have doxxing or privacy statutes also include victim notification rights and the ability to seek restraining orders or civil protective orders against the person who leaked their information. California allows doxxing victims to apply for a civil harassment restraining order under Code of Civil Procedure Section 527.6.
Quick Facts:
- Federal Crime Victims’ Rights Act covers victims of federal crimes
- Restitution can be ordered as part of federal sentencing
- Civil protective orders are available in most states
- State attorneys general can bring actions on behalf of victims in data breach cases
- FTC complaint filings create a record and may trigger agency investigation
The most practical right victims have in 2026 is the ability to reach multiple government agencies: the FTC, FBI IC3, state AG consumer protection offices, and local law enforcement. Filing with all of them builds a record and maximizes the chance of official action.
Frequently Asked Questions
Is it illegal to share someone’s phone number online without their permission?
It can be illegal, depending on the intent and outcome.
Sharing a publicly listed number is generally legal.
Posting a private number online to incite harassment or threats crosses into criminal territory under doxxing and stalking statutes in at least 20 states.
If the number was obtained through hacking or breach of confidentiality, sharing it may also violate federal law.
What is the penalty for leaking someone’s personal information in the US?
Penalties range from a $500 fine for misdemeanor doxxing in some states to 15 years in federal prison for identity theft-related disclosures.
Civil lawsuits can result in awards of actual damages, punitive damages, and statutory damages under state privacy laws.
California’s CPRA, for example, allows $100 to $750 per affected person per incident in statutory damages.
The severity depends on what type of information was leaked, how it was obtained, and what harm resulted.
Can you go to jail for leaking someone’s bank account number?
Yes, and the penalties are serious.
Under the Gramm-Leach-Bliley Act, individuals who knowingly and willfully disclose protected financial information face up to 5 years in federal prison.
If the leak enabled identity theft, aggravated identity theft charges under 18 U.S.C. Section 1028A add a mandatory 2-year consecutive prison sentence.
State fraud statutes may also apply depending on where the offense occurred.
Is it a federal crime to leak someone’s Social Security number?
Yes, in most circumstances.
Fraudulent use or transfer of a Social Security number violates 18 U.S.C. Section 1028, which carries penalties up to 15 years in federal prison.
The SSN Protection Act also restricts commercial display, sale, or purchase of SSNs.
The IRS and FTC both actively investigate SSN misuse, and federal prosecutions are common when tax fraud or financial fraud results.
What should you do if someone posts your personal number online?
Screenshot the post immediately with the date, time, and URL visible.
Report it to the platform where it appeared to request removal under their doxxing policies.
File a police report locally and a complaint with the FBI’s Internet Crime Complaint Center (ic3.gov).
Contact your state attorney general’s consumer protection office for additional support and to document the incident officially.
Closing
Leaking numbers in the US sits in a legal space where the type of number, the intent behind the leak, and your state’s specific statutes determine everything. The answer is rarely simple, but it is almost never “it’s totally fine.”
Knowing these laws puts you in a much stronger position, whether you are protecting yourself, documenting an offense, or understanding your exposure. Keep this article accessible; the legal landscape in this area is still evolving rapidly as states continue updating their privacy and doxxing statutes through 2026 and beyond.
