This month, we’re taking a look at the serious implications of doxxing – both for your child and for you as their parent.
What is doxxing?
Basically, dox is slang for ‘documents’ and doxxing (or doxing) means dropping documents online that disclose personal and identifying information about someone without their permission – usually to harass, humiliate or harm them.
In the business world, this is typically used to shame, embarrass or extort money from someone who does not want their identity linked to a group, an ideology or other ‘private’ activity. Of course, the practice of threatening to reveal personal information about individuals is not new – newspapers have made a multi-billion-dollar business out of it! But the area where this is very new and extremely troubling, is when it involves schoolchildren.
School is the place in which children learn many of life’s biggest and most difficult lessons. It’s where they learn the consequences of their actions, how they might unintentionally hurt someone they care about, and how to temper their emotions before they do something they can’t undo. Teenagers are emotionally and mentally undeveloped, and school is their space to find out how life works before being dropped into the big bad world.
Or so it was. Nowadays, however, the big bad world is rampant. So, what happens when kids have access to social media platforms plus the ability to create fully lifelike, false images of people using AI?
Deepfake doxxing.
Today, an emotionally immature teen, acting in the heat of the moment, can generate a highly damaging fake narrative about a fellow student or a teacher. (This could be in the form of a nude photo, an embarrassing act, or a cloned voice clip saying something highly offensive.) Doxxing on its own – revealing a person’s identity alongside personal or private information about them – is highly damaging to the victim. But doxxing accompanied by a deepfake image or video becomes more like a life sentence. For the victim, their image is now inextricably linked to a falsehood which some people will almost certainly believe as true.
Deepfakes and cyberbullying cause serious emotional, mental and psychological harm. Taking this to the next level, deepfake doxxing moves the play from online persecution to real-life harassment. In dropping the mockery plus the victim’s name and details onto a public group chat or community board, this false story is now catapulted into the real-world and the damage is about to snowball. Along with all the other forms of abuse, the threat of physical harm is also now a real and increasing concern.
Both doxxing and deepfake doxxing are criminal offences. This is as it should be, but do our children understand the serious consequences of acting upon their raw emotions?
Some kids might act with malicious intent, a vendetta, or a payback, whilst others might do it without much thought except to escape a mess of emotions. Either way, the knock-on effects are highly damaging to both the victim and to the teenage persecutor who is now looking at a criminal charge.
The law in Hong Kong.
Hong Kong has a robust legal framework covering different forms of cyberbullying and protection of personal data. For adult defendants the penalties include monetary fines, community service and imprisonment.
The Anti-Doxxing Law: Under Section 64 of the Personal Data (Privacy) Ordinance (PDPO). Disclosing personal data without consent, either with intent or reckless regard for causing specified harm (including psychological harm) is a criminal offence.
The PDPO Intersection: The Office of the Privacy Commissioner for Personal Data (PCPD) specifies that using personal data (like a classmate’s school photo) to build a malicious deepfake violates the PDPO and can trigger simultaneous prosecution under both doxxing and data protection codes.
Deepfake Legislation: Whilst specific deepfake legislation is currently under legislative review, deepfakes are being prosecuted under existing technology-neutral criminal laws such as: non-consensual intimate images, fraud, deception, blackmail, and data privacy, under section 159AAE of the Crimes Ordinance (Cap. 200).
What age does my child become criminally liable?
These are serious offences, and yet they are very easily carried out in the school playground. In Hong Kong, we have a strong juvenile justice system for children above the age of criminal responsibility but not yet an adult. You may be surprised to learn that criminal responsibility starts when a child turns 10 years old, and at 16 they are an adult in the eyes of the law.
As parents we may also be legally responsible. If a victim can prove that the parents of the perpetrator knew their child was engaging in this kind of activity and they failed to properly supervise them, then parents can also become civilly liable for their child’s actions.
For minors below the age of full legal capacity (below 10 years old) the parents or legal guardians are held civilly liable. If a victim’s family sues for defamation, emotional distress, or violation of likeness rights, the court can order the perpetrators’ parents to pay monetary damages.
Tools for parents.
At bowers.law we’ve been handling more and more of these cases, and the scary thing is, the perpetrators are getting younger and younger. So, it’s critical that we ensure our children fully understand and appreciate the devastating and far-reaching consequences of these types of actions, before they do something they can’t undo and will live to regret.
The PCPD has published a dedicated guide entitled: Abuse of AI Deepfakes: Toolkit for Schools and Parents which aims to help parents understand the risks of AI-generated content—such as image-based cyberbullying, identity theft, and scams—and outlines conversations to have with children.
Another great tool is the PCPD’s Children Privacy Thematic Website. This outlines specific talking points for parents to help prevent children from inadvertently oversharing information that leads to doxxing.
Finally, if your child has committed any kind of cyberbullying, doxxing or deepfake offences, get professional legal advice as soon as possible!
Please contact Kevin at kevin.bowers@bowers.law if you have any questions about this Room 228 Newsletter.
…………………………………………………………………………………………………………………………………
This Newsletter is not intended to be and should not be relied on as legal advice. You should seek professional legal advice before taking any action in relation to the subject-matter of this Newsletter.
—————————————————————————————————————————–
See below for links to previous bowers.law articles
Crap! I need a lawyer. (What you need to know when hiring a lawyer. Aug 2026)
https://bowers.law/artificial-vs-intelligent/ (Corporate Scams to watch out for. July 2026)
https://bowers.law/the-only-thing-more-dangerous-than-a-scammer-is-a-scammer-using-ai/ (July 2024)
https://bowers.law/dont-get-doxxed/ (Feb 2024)
https://bowers.law/e-signatures-in-hong-kong/ (Jan 2024)
https://bowers.law/warning-dont-use-emojis-when-negotiating-a-contract/ (Sept 2023)