Cyberstalking Matters

Florida criminalized stalking in 1992, added “cyberstalking” in 2003 when e-mail became a convenient vector for harassment, and has amended the statute repeatedly since — most recently in 2021, to reach online posts that merely pertain to a victim and intrusions into a victim’s online accounts and Internet-connected home devices. The result is one of the broadest anti-stalking regimes in the country: a criminal statute, Fla. Stat. § 784.048, and a civil companion, § 784.0485, that lets a victim obtain a court order — without a lawyer, without a filing fee, and on an emergency basis — restraining the harasser, seizing his firearms and, if he violates it, sending him to jail.

Our attorneys represent both petitioners seeking protection from online harassment and respondents defending against injunctions that are unwarranted or that would suppress legitimate speech. Because cyberstalking disputes increasingly involve doxxing, impersonation accounts, deepfakes, coordinated online campaigns and AI-generated content, and because they frequently intersect with defamation, privacy, trademark and domain-name matters, we approach them as technology cases. This summary explains the statutes, their elements and remedies, the controlling Florida appellate decisions, the related civil and criminal provisions, and — in detail — the gap that generative AI has opened in the statutory scheme and how victims and businesses should respond to it.

What Cyberstalking Is, and Where the Law Comes From

Florida’s stalking statute, enacted as chapter 92-208 and upheld against a vagueness challenge in Bouters v. State, 659 So. 2d 235 (Fla. 1995), makes it a crime to “willfully, maliciously, and repeatedly follow[], harass[], or cyberstalk[] another person.” § 784.048(2). The Legislature added cyberstalking in 2003, expanded the definition in 2012 and 2019, and in 2021 (chapter 2021-220) rewrote it in two ways that matter greatly in current practice: it extended the definition to communications “directed at or pertaining to” a specific person, and it added a second, access-based form of cyberstalking. The statute now provides:

“‘Cyberstalk’ means: (1) To engage in a course of conduct to communicate, or to cause to be communicated, directly or indirectly, words, images, or language by or through the use of electronic mail or electronic communication, directed at or pertaining to a specific person; or (2) To access, or attempt to access, the online accounts or Internet-connected home electronic systems of another person without that person’s permission, causing substantial emotional distress to that person and serving no legitimate purpose.” — § 784.048(1)(d)

Three other definitions do the work. To “harass” is “to engage in a course of conduct directed at a specific person which causes substantial emotional distress to that person and serves no legitimate purpose,” § 784.048(1)(a). A “course of conduct” is “a pattern of conduct composed of a series of acts over a period of time, however short, which evidences a continuity of purpose,” excluding constitutionally protected activity such as picketing and organized protest, § 784.048(1)(b). And a “credible threat” — the element that elevates stalking to a felony — is a verbal or nonverbal threat, “including a threat delivered by electronic communication or a threat implied by a pattern of conduct,” that places the target in reasonable fear for his or her safety or that of family members, without regard to whether the person making the threat intended or was able to carry it out, § 784.048(1)(c).

The Criminal Statute — § 784.048

A sentencing court may also enter a restraining order barring contact with the victim for up to ten years, § 784.048(9), and a law enforcement officer may arrest without a warrant on probable cause that stalking has occurred, § 784.048(6). Prosecution rests with the State Attorney; a victim’s role is to report, preserve evidence and cooperate. For most victims of online harassment, however, the immediately useful remedy is civil.

The Civil Injunction — § 784.0485

Section 784.0485 creates a cause of action for an injunction for protection against stalking, expressly including cyberstalking. It is a stand-alone remedy: no other cause of action need be pending, no attorney is required, no filing fee may be charged, and no minimum residency is imposed. The injunction is designed to stop the conduct; it does not award damages, which must be sought under the tort theories and statutes described below.

Elements a petitioner must prove:

• Standing. The petition must be filed by the victim or, for a minor, by a parent or legal guardian, § 784.0485(1)(a), and must be verified and disclose any pending action between the parties, § 784.0485(1)(b), (3).
• Two or more incidents. Because stalking requires a “course of conduct” and “repeated” acts, Florida’s district courts of appeal uniformly require the petitioner to allege and prove at least two separate incidents, each established by competent, substantial evidence. David v. Schack, 192 So. 3d 625 (Fla. 4th DCA 2016); Touhey v. Seda, 133 So. 3d 1203 (Fla. 2d DCA 2014); Roach v. Brower, 180 So. 3d 1142 (Fla. 2d DCA 2015).
• Directed at or pertaining to the petitioner. Before 2021, posts about a person on the respondent’s own social-media page were held not to be “directed at” the person and could not support an injunction. Leach v. Kersey, 162 So. 3d 1104 (Fla. 2d DCA 2015); Scott v. Blum, 191 So. 3d 502 (Fla. 2d DCA 2016); Horowitz v. Horowitz, 160 So. 3d 530 (Fla. 2d DCA 2015). The 2021 amendment’s “pertaining to” language was enacted to reach exactly that conduct, and courts now treat posts about a petitioner as within the definition, subject to the remaining elements.
• Substantial emotional distress, judged objectively. The distress must be that of a reasonable person in the petitioner’s position, not the petitioner’s subjective reaction. Paulson v. Rankart, 251 So. 3d 986 (Fla. 1st DCA 2018); Klemple v. Gagliano, 197 So. 3d 1283 (Fla. 4th DCA 2016). Annoyance, embarrassment and ordinary conflict are not enough.
• No legitimate purpose. Communications that serve a legitimate purpose — settling a business dispute, commenting on a public controversy, reporting to authorities — are excluded, and the First Amendment limits the statute’s reach to speech that is integral to a course of harassing conduct rather than expression on matters of public concern. Logue v. Book, 297 So. 3d 605 (Fla. 4th DCA 2020) (en banc); David v. Textor, 189 So. 3d 871 (Fla. 4th DCA 2016); Chevaldina v. R.K./FL Management, Inc., 133 So. 3d 1086 (Fla. 3d DCA 2014).

Procedure and relief

The injunction is powerful precisely because it is fast and because its violation is a crime. It is also final in a way that surprises respondents: a stalking injunction has no expiration date unless the court sets one, appears in law-enforcement databases, disqualifies the respondent from possessing firearms, and can affect employment, licensing and family-court proceedings. For that reason, respondents who believe a petition mischaracterizes a business dispute, a family conflict or protected speech should retain counsel before the full hearing rather than after the injunction issues.

Damages: What the Injunction Does Not Provide

Section 784.0485 authorizes no damages. A victim who has suffered financial loss, reputational harm or emotional injury from online harassment must look elsewhere, and the available theories vary considerably in strength.

Related Florida and Federal Provisions

Cyberstalking rarely arrives alone, and the surrounding statutes often supply the charge or the remedy that fits the conduct best. Written or electronic threats to kill or injure, or to conduct a mass shooting, are a second-degree felony under § 836.10, which was expanded in 2021 to cover threats sent by any electronic means, including social media, whether or not directed to the victim. Sexual cyberharassment is a first-degree misdemeanor with a civil remedy under § 784.049. Impersonation through a fraudulently created online profile is criminal identity theft under § 817.568 when it is used to harass or defraud. Unlawful interception of communications (§ 934.03), video voyeurism (§ 810.145), and the offenses against computer users in the Florida Computer Crimes Act (§ 815.06) address device-level intrusions. Since July 1, 2026, HB 1159 makes the creation or possession of AI-generated child sexual abuse material a second-degree felony, and § 106.145 requires disclaimers on political advertisements that use generative AI to depict real persons. Federally, 18 U.S.C. § 2261A criminalizes interstate cyberstalking with intent to harass or intimidate that causes substantial emotional distress; 18 U.S.C. § 875(c) covers interstate threats; and the TAKE IT DOWN Act (2025) criminalizes the publication of nonconsensual intimate imagery, including AI-generated “digital forgeries,” and requires covered platforms to remove reported images within 48 hours.

The Generative AI Gap

Section 784.048’s definitions of “harass” and “cyberstalk” were drafted around a human composing and sending communications. They are silent about conduct in which an AI tool generates the content — images, video, audio or text — that a human then disseminates, or in which an automated agent conducts the harassment with minimal human involvement after it is set in motion. Three features of the statute strain under that technology.

Course of conduct and the single-act deepfake

Stalking requires “repeated” acts and a “course of conduct” composed of “a series of acts over a period of time.” A single, convincing AI-generated video that is posted once and then circulates for months can inflict sustained harm from what is arguably a single act of creation and publication. Whether the creation, the posting, and each subsequent re-sharing, tagging or re-posting by the respondent constitute separate incidents — and whether the deployment of an automated bot that sends hundreds of messages is one act or hundreds — are questions the district courts of appeal have not squarely decided. The better reading of the statute, and the one we advance for petitioners, is that each discrete communication the respondent causes to be made is an act in the series, so that a respondent who generates a deepfake and then posts it, re-posts it, sends it to the victim’s employer and tags the victim’s family has engaged in a course of conduct regardless of the number of underlying files. Respondents will argue the opposite, and the argument has force where the record shows a single publication and third-party circulation the respondent did not cause.

Directed at, pertaining to, and content the respondent did not write

The 2021 “pertaining to” amendment resolves most of the difficulty with content about a victim posted to a general audience: a deepfake depicting the petitioner “pertains to” the petitioner however it was made. The remaining question is causation — whether the respondent “communicate[d], or cause[d] to be communicated” content generated by a model, and whether a respondent who instructed an AI agent to conduct a campaign has caused each resulting message. The statute’s “directly or indirectly” language supports liability for both, but the respondent’s ability to attribute the content to the tool, or to deny knowledge of what the tool produced, complicates the willfulness and malice elements that both the criminal statute and the injunction require.

Credible threats, intent and anonymity

AI tools make identification of the perpetrator harder: content can be generated through anonymized platforms and open-source models, distributed through throwaway accounts, and stripped of the metadata that ordinarily links a file to a device. Proving a “credible threat” or malicious intent is harder when the respondent claims the output was automated or was not specifically “directed” at anyone. And the authentication of AI-generated evidence — proving that an image is fabricated, when and how it was created, and who created it — introduces forensic and expert-witness burdens into injunction hearings that were designed to be conducted in fifteen days without lawyers.

The uneven statutory response

Florida’s legislative response to AI-enabled harassment has been targeted rather than general. Brooke’s Law now gives a victim of a nonconsensual AI-altered sexual depiction a felony charge, a statutory damages floor of $10,000, attorney’s fees and a 48-hour platform-removal right; HB 1159 addresses AI-generated child sexual abuse material; and the federal TAKE IT DOWN Act supplies a parallel criminal and takedown regime. A victim of AI-driven cyberstalking involving sexual deepfakes therefore has a clearer and stronger civil remedy than the general stalking injunction provides. But victims of non-sexual AI-driven harassment — fabricated audio of the victim making statements she never made, synthetic images placing her at events she never attended, cloned voices used to harass her family, or automated campaigns of AI-written messages — must still rely on § 784.048, § 784.0485 and common-law torts that contain no AI-specific provisions and no statutory damages floor. The result is uneven protection: the same technology, used to the same effect, yields a $10,000 minimum recovery in one case and a damages claim that must be proven from scratch in another. The Attorney General’s September 2026 legislative proposal to impose liability on AI companies whose systems facilitate crimes and self-harm, and the pending federal NO FAKES Act, may narrow the gap, but neither is law today.

How We Approach Cyberstalking Matters

For victims:

• Preserve the evidence immediately. Capture every communication, post, profile and account with the URL, date, time and full context visible; export message threads; record the accounts involved and any identifying information; and do not delete or block until the evidence is secured. For suspected AI-generated content, preserve the original file where possible, because metadata and generation artifacts are the basis of forensic authentication.
• Identify the respondent. Where accounts are anonymous, platform records, pre-suit discovery, and subpoenas in a civil action (including a John Doe defamation or CADRA action) can unmask the operator; the injunction statute itself provides no discovery mechanism, so a parallel civil case is often necessary.
• Build the two-incident record. Organize the evidence chronologically, identify at least two discrete incidents that are directed at or pertain to the petitioner, and document the emotional distress in terms a reasonable person would recognize — changes in routine, security measures, medical or counseling consultations.
• Choose the remedies deliberately. The injunction stops the conduct; § 784.049, Brooke’s Law, CADRA and the common-law torts provide damages; platform reporting, DMCA and TAKE IT DOWN Act notices remove content; and a police report opens the criminal track. The right combination depends on the conduct, the respondent’s assets and the victim’s objectives.
• Report to the platforms and to law enforcement. Platform harassment and impersonation policies, the 48-hour removal mandates of Brooke’s Law and the TAKE IT DOWN Act for intimate imagery, and a report to the local law-enforcement agency or the FDLE Cybercrime Office are each independent avenues, and each generates a record.

For respondents:

• Take the petition seriously before the hearing. A final injunction is indefinite, is a public record, bars firearm possession and makes any further contact a crime. The full hearing is the only realistic opportunity to contest it.
• Test each element. Many petitions fail on the two-incident requirement, the objective distress standard, the legitimate-purpose exclusion or the First Amendment. Business disputes, family conflicts and commentary on public controversies are frequently mischaracterized as stalking.
• Do not communicate. Any contact with the petitioner after a temporary injunction issues — including through third parties, social media or AI-generated content — is a violation and an aggravating factor.
• Address the underlying dispute. Where the conduct arose from a commercial, employment or domestic dispute, resolving that dispute is usually the path to dissolution of the injunction.

Key Considerations for Businesses and Technology Companies

Cyberstalking law is not only a matter for individual victims. Businesses encounter it when an employee is targeted by a customer or former partner, when a competitor or disgruntled former employee wages an online campaign against executives, when a company’s platform is used to harass, or when a company’s own marketing or AI tools generate content depicting real people. Employers should have a protocol for supporting employees who are targeted (evidence preservation, security measures, assistance with the injunction), a policy for responding to harassment conducted through company systems, and — for platforms — the removal processes now mandated for intimate imagery. Companies deploying generative AI should recognize that a synthetic depiction of a real person created by their tools may expose them to claims under § 836.13, § 540.08 and FDUTPA, and should clear and label such content accordingly; our FDUTPA and digital-replica commentary address those obligations.

Full Capability

Our Cyberstalking Services Include