Colorado Anti-Doxxing Statute

What the statute does

Colorado's anti-doxxing law lives at CRS § 18-9-313. It makes it a crime to knowingly post a protected person's personal information online when the poster knows, or reasonably should know, that doing so poses an imminent and serious threat to that person or their family.

Personal information means details like a home address or phone number. The offense is a class 1 misdemeanor. It carries up to 364 days in jail, a fine of up to $1,000, or both.

The provision was first enacted in 2002 for law enforcement officers and for victims of domestic violence, sexual assault, and stalking. The legislature has expanded it repeatedly since. In 2021, HB 21-1107 added public health workers after pandemic-era threats against them. Later amendments added firefighters, health-care workers, human services and child protection staff, code enforcement officers, educators, judges, prosecutors, and public defenders.

Who it covers

The current list is long and has grown several times. It includes:

• Peace officers, firefighters, and other public safety workers
• Public health and health-care workers
• Human services and child protection workers
• Code enforcement officers
• Educators and school staff
• Judges, prosecutors, and public defenders

The exact categories change as the statute is amended, so confirm that your role is currently covered before you rely on it.

If you are covered, the statute reaches the person who posts your information to threaten you. It does not reach the people-search site that already lists your address. Those are separate problems, and this law only addresses one of them.

What it lets you do

You can pursue two different things under Colorado law.

First, if someone posts your information to threaten you, save screenshots and links, then file a police report citing CRS § 18-9-313. Whether charges follow is up to the district attorney, not you. This is a criminal path against a person, not a way to force a website to take a listing down.

Second, if you are in a covered role, you can ask to have your personal information withheld from online government records. You do that by submitting a written request that attests, under penalty of perjury, that publishing the information poses an imminent and serious threat to your safety or your family's. This does not remove the information from private data broker sites.

The first conviction

In March 2026, a Denver jury convicted activist Regan Benson under the statute. It is the first reported conviction under this law.

On September 3, 2025, Benson livestreamed from outside a Denver Police Department station and asked viewers to find a commander's home address. She read it aloud on the stream and suggested followers hold a "pig roast" at the home. The commander testified about the effect on his family, and the department added patrols and a security camera at the house.

Benson's defense argued the statute violated the First Amendment. The jury rejected that argument. She was sentenced in May 2026 to 60 days in jail, two years of probation, and a $1,000 fine. Her lawyers have signaled an appeal on free-speech grounds. Coverage: Police1, Denver7, CBS Colorado, and Colorado Public Radio on sentencing.

Where the law is likely to be tested

The Benson appeal is not the end of the story, and the outcome is not settled.

Any prosecution that hinges on what a poster meant has to clear Counterman v. Colorado, 600 U.S. 66 (2023). In that case the Supreme Court held that true-threats prosecutions of online speech require proof the speaker had at least a reckless disregard for the threatening nature of the statement. That raises the bar for the state.

A March 2025 Vermont legislative memo flagged a separate risk: doxxing statutes that protect only specific occupations may draw equal protection challenges. Colorado's statute is built around enumerated categories, so that argument could surface here too.

The statute is still enforceable. But the criminal path is contested, and a first responder should not count on a prosecution as their only line of defense.

What the statute does not reach, and what we do

This law targets a person. It does not remove the underlying data that made the doxxing possible: the people-search sites that resell your home address from public records to anyone with a credit card.

That is a different legal layer. New Jersey's Daniel's Law attacks it directly, giving covered public servants a civil claim against data brokers that keep publishing their home address after a takedown request. Colorado does not have an equivalent broker-removal statute today.

So in Colorado the removal work runs through the opt-out process at each commercial site that lists where you live. Frontline Privacy finds those listings, files the removals, and keeps checking for records that come back. If your address has already been posted, we can start removing it from people-search sites while any criminal case runs its own course.

For the related case file, see the Denver police commander doxxing case. For a broader view of Colorado protections, see the Colorado state overview.