25 Things You’re Doing Online That Are Probably Illegal
The internet feels like a consequence-free zone. You download a song here, repost a photo there, toss off an angry comment somewhere else — and nothing happens. No sirens, no flashing lights, no knock at the door. But that doesn’t mean you’re in the clear.
The law hasn’t stood still while the internet evolved. Federal statutes, state regulations, and international treaties govern an enormous range of online behavior, and many everyday digital habits fall squarely on the wrong side of those lines. The tricky part? Most people have no idea they’re breaking the law at all.
This list covers 25 things you’re doing online that are probably illegal — from copyright violations to cybercrime, from privacy breaches to emerging digital threats. This article is meant for educational awareness, not legal advice. If you have specific legal concerns, consult a qualified attorney.
Digital Piracy & Copyright Infringement
Copyright law is one of the most frequently violated areas of internet law, partly because digital copying feels so effortless. Here’s where everyday users cross the line.
1. Torrenting or Downloading Copyrighted Content
If you’ve ever downloaded a movie, album, or software through a torrent client without paying for it, you’ve committed copyright infringement under the U.S. Copyright Act. It doesn’t matter that millions of other people are doing it simultaneously — each download is its own separate violation.
Statutory damages can reach up to $150,000 per infringed work, and criminal penalties can include up to five years in prison and $250,000 in fines. Rights holders and ISPs do pursue these cases, and settlement demands often land in the thousands of dollars.
2. Illegal Streaming of Copyrighted Material
Watching a pirated stream of an NFL game, a new blockbuster, or a premium TV series through an unofficial website or a modified streaming stick isn’t a gray area — it’s infringement. The No Electronic Theft (NET) Act makes this a federal crime even when no money changes hands.
The 2020 Protecting Lawful Streaming Act elevated large-scale commercial streaming piracy to a felony with penalties of up to 10 years in prison.
3. Using Copyrighted Images Without Permission
You’ve probably grabbed an image from Google and dropped it into a blog post, social media graphic, or presentation. Unless that image carries a Creative Commons license or you have explicit permission, you just committed copyright infringement.
“Fair use” has narrow limits and doesn’t protect most commercial or promotional uses. Getty Images and other stock agencies actively scan the web for unlicensed use of their photos and send demand letters regularly — sometimes for hundreds or thousands of dollars per image.
4. Uploading Copyrighted Content to Public Platforms
Posting a full song, a movie clip, a TV episode, or someone else’s original work on YouTube, TikTok, or Instagram without a license violates the platform’s policies and copyright law simultaneously. Platforms use automated content identification systems (like YouTube’s Content ID) to catch this, but automated removal doesn’t protect you from a rights holder’s lawsuit.
5. Password Sharing for Streaming Services — At Scale
Sharing your Netflix password with a college roommate is a terms of service violation. But reselling access to premium streaming accounts, or providing credentials to a large group of people outside your household, can cross into wire fraud territory under 18 U.S.C. § 1343. Netflix and other platforms have begun actively enforcing household policies, and courts have held that TOS violations in some contexts can trigger legal liability.
Cyberbullying, Harassment & Privacy Violations
These offenses are among the most emotionally damaging things people do online — and increasingly, they’re among the most prosecuted.
6. Cyberbullying and Online Harassment
Repeated, targeted, and aggressive online behavior intended to intimidate or harm someone isn’t just morally wrong — in most U.S. states, it’s a crime. All 50 states have some form of anti-cyberbullying or cyber harassment law on the books.
Depending on severity and jurisdiction, charges can range from misdemeanor harassment to felony stalking, carrying fines and potential jail time. The consequences are especially severe when the target is a minor.
7. Doxxing
Doxxing — publicly posting someone’s home address, phone number, workplace, or other identifying information with the intent to harm or harass — is illegal in a growing number of states. Even if the information is technically public, publishing it with harmful intent can be charged under stalking, harassment, or computer fraud laws.
When doxxing incites real-world violence (which it frequently does), the person who published the information can face serious criminal liability as well as civil lawsuits.
8. Revenge Porn (Non-Consensual Intimate Image Sharing)
Sharing intimate or sexual images of someone without their consent — whether from a past relationship or obtained through hacking — is illegal in at least 46 states and Washington D.C. as of recent reporting. Penalties range from misdemeanor charges to felony convictions, with some states imposing mandatory prison sentences.
Federally, certain aspects of this behavior are covered under the Violence Against Women Act. The FBI has also prosecuted cases involving hacked intimate images under computer fraud statutes.
9. Online Stalking
Following someone’s movements through their social media posts, using tracking apps without consent, or sending repeated unwanted contact through digital channels constitutes cyberstalking — a federal crime under 18 U.S.C. § 2261A. Penalties include up to five years in prison for a first offense, and significantly more if threats or violence are involved.
10. Impersonating Someone Online
Creating a fake profile using someone else’s name, photos, and personal details — whether to harass them, defraud others, or damage their reputation — is a crime. Depending on the intent, it can be prosecuted as identity fraud, defamation, or cyberstalking. Several states have enacted specific laws against online impersonation, and federal identity fraud statutes can also apply.
Fraud, Scams & Financial Crimes
Online financial crime costs Americans billions of dollars every year. Some of these activities are obviously predatory; others might surprise you.
11. Phishing
Sending fraudulent emails, texts, or messages designed to trick people into surrendering passwords, financial details, or personal information is wire fraud under 18 U.S.C. § 1343. Convictions can carry up to 20 years in federal prison. Phishing schemes that target financial institutions or involve identity theft add additional charges under separate statutes.
Even amateur attempts — a fake “prize notification” email or a spoofed login page — qualify as federal crimes.
12. Identity Theft
Using someone else’s name, Social Security number, credit card details, or other personal information without their consent is a federal felony under 18 U.S.C. § 1028. Penalties can reach 15 years in prison, plus heavy fines and restitution. State laws add another layer of liability on top of federal charges.
The FTC reported that Americans filed 5.7 million fraud and identity theft reports in 2023 — making this one of the most common and most prosecuted online crimes.
13. Online Gambling in Prohibited Jurisdictions
Online gambling is legal in some U.S. states — New Jersey, Pennsylvania, Michigan, and others have regulated markets. But placing bets through online casinos or sportsbooks in states where it’s prohibited violates both state law and potentially the Unlawful Internet Gambling Enforcement Act of 2006 (UIGEA), which prohibits financial institutions from processing transactions for illegal gambling.
The key word is “illegal” — jurisdiction matters enormously here, so check your state’s laws before placing a bet.
14. Selling Counterfeit Goods Online
Listing fake designer handbags, bootleg sneakers, or knock-off electronics on eBay, Etsy, or your own website violates federal trademark law and the Trademark Counterfeiting Act. Criminal penalties include up to 10 years in prison for a first offense and fines up to $2 million. Civil penalties can be even more severe.
Customs agents seize billions of dollars worth of counterfeit goods annually, and investigators actively monitor online marketplaces.
15. Misrepresenting Products or Services You’re Selling
If you’re a private seller or running an online business and you deliberately describe a product inaccurately — claiming a refurbished item is new, misrepresenting a vehicle’s mileage, or inflating a collectible’s authenticity — you’re committing online fraud. The FTC and state attorneys general actively pursue these cases. Criminal charges under wire fraud statutes carry substantial penalties.
16. Running or Promoting a Pyramid Scheme
Pyramid schemes are illegal under federal law (15 U.S.C. § 41-58), and operating one online doesn’t offer any protection. If you’re promoting a “business opportunity” where participants earn money primarily by recruiting others rather than selling actual products or services, that’s a pyramid scheme — and the FTC will classify it as one regardless of the packaging.
Thousands of online “income opportunity” programs cross this line every year.
17. Participating in or Promoting Crypto Fraud
The cryptocurrency space has become a breeding ground for fraud — rug pulls, fake initial coin offerings (ICOs), pump-and-dump schemes, and fraudulent NFT projects. Participating in, promoting, or orchestrating any of these constitutes securities fraud, wire fraud, or commodities fraud depending on the structure. The SEC and DOJ have ramped up crypto enforcement significantly since 2021, and prosecutions are increasing.
Unauthorized Access & Data Misuse
You don’t need to be a sophisticated hacker to run afoul of computer crime laws. Some of these violations are alarmingly easy to commit accidentally.
18. Accessing Someone Else’s Wi-Fi Without Permission
Connecting to a neighbor’s Wi-Fi network — even one that’s unsecured and broadcasting publicly — without authorization violates the Computer Fraud and Abuse Act (CFAA) under 18 U.S.C. § 1030. This federal law prohibits unauthorized access to any computer or network, and Wi-Fi routers count. Penalties range from fines to years in federal prison depending on the intent and damage caused.
19. Hacking or Unauthorized Access to Any System
Accessing any computer system, account, or network without explicit authorization is a federal felony under the CFAA. This includes guessing a password to access an ex’s email, using exploits to access a corporate database, or logging into a shared account you no longer have permission to use. Penalties can stretch to decades in prison for cases involving national security, financial systems, or significant data theft.
20. Distributing Malware
Deliberately creating and releasing viruses, ransomware, spyware, or other malicious software is a serious federal crime under the CFAA and can result in years of imprisonment. Even if you didn’t create the malware yourself — forwarding an infected file knowingly, or sharing a link to malicious content — can make you an accessory to the crime.
21. Using a VPN to Mask Illegal Activity
VPNs are legal in the United States, and using one for privacy is completely legitimate. However, using a VPN specifically to obscure or facilitate illegal activity — piracy, accessing prohibited gambling sites, buying illegal goods on dark web marketplaces — doesn’t provide legal protection. The illegal underlying act is still illegal. Courts and law enforcement agencies have successfully traced criminal activity through VPN providers, many of which log activity and comply with court orders.
Content & Communication Crimes
What you say online — and what you share — carries real legal weight. These offenses range from the obviously criminal to the surprisingly easy to commit.
22. Child Sexual Abuse Material (CSAM)
This is the most severe category on this list. Creating, possessing, distributing, or even viewing child sexual abuse material is a federal felony with mandatory minimum sentences of 5 to 10 years in prison, with maximum sentences extending to life imprisonment. Federal law under 18 U.S.C. § 2252 covers all forms of CSAM, and there are no exceptions, no mitigating circumstances, and no statute of limitations for federal prosecution in many cases.
Internet service providers are required by law to report CSAM to the National Center for Missing & Exploited Children (NCMEC). Every digital interaction involving such material is traceable.
23. Making Violent Threats Online
Posting a threat to harm, kill, or commit violence against a specific person — even as a “joke” or in the heat of anger — can constitute a federal crime under 18 U.S.C. § 875, which prohibits interstate threats transmitted via digital communication. Courts evaluate threats based on whether a reasonable person would interpret them as credible, not whether you meant them.
People have been arrested and prosecuted for threats made in tweets, Reddit comments, and even online gaming chats.
24. Online Defamation and Libel
Publishing false statements of fact about a real person — in a blog post, a social media comment, a review, or a forum — that damages their reputation can expose you to a civil lawsuit for defamation. While defamation is typically a civil matter rather than criminal, the financial consequences can be devastating. Courts have awarded plaintiffs millions of dollars in defamation cases originating from online posts.
Truth is the primary defense against defamation. Calling your opinion clearly an opinion also matters. But stating false facts as truth — especially about a private individual — creates significant legal exposure.
25. Creating or Sharing Malicious Deepfakes
Using AI to generate realistic-looking video or audio of a real person — placing them in sexually explicit content, fabricating statements they never made, or using their likeness for fraud — has moved into criminal territory. Virginia, California, Texas, Georgia, and several other states have enacted laws specifically targeting non-consensual deepfake pornography, with penalties including jail time. Deepfakes used for financial fraud or political manipulation face additional charges under existing fraud and election interference statutes.
Federal legislation is advancing, and prosecutors are already using existing fraud, harassment, and defamation laws to target deepfake creators in the meantime.
What Actually Happens If You’re Caught?
The consequences of online crimes span a wide spectrum. At the least severe end, you might face civil lawsuits, monetary settlements, or account termination. Moving up the scale, you’re looking at criminal charges, fines, and probation. At the most serious end — hacking, CSAM, fraud at scale, terrorism-related offenses — federal prosecution carries prison sentences measured in decades.
Federal crimes are investigated by the FBI, FTC, Secret Service, and other agencies. State-level crimes are handled by local law enforcement and state attorneys general. International cooperation between agencies means that geographic distance from U.S. servers or using a foreign VPN provider offers no meaningful protection.
Perhaps more practically: a criminal record — even for a minor digital crime — can cost you jobs, professional licenses, financial aid eligibility, and housing opportunities for the rest of your life.
How to Stay on the Right Side of the Law Online
Awareness is the most effective prevention. A few ground rules go a long way:
– Pay for what you consume. Streaming services, music platforms, software subscriptions, and stock photo licenses exist for a reason.
– Read terms of service. TOS violations aren’t always criminal, but they can lead to behavior that is.
– Assume everything is traceable. IP addresses, device fingerprints, metadata, and platform logs all leave trails — even through VPNs.
– Think before you post. Threats, intimate images shared without consent, and false statements about real people all carry legal risk.
– Know your jurisdiction’s gambling laws before placing a bet on any online platform.
– Respect privacy. Don’t access accounts, networks, or data you don’t have explicit permission to use.
– Verify before sharing. Forwarding misinformation that crosses into defamation or incitement can implicate you.
When in doubt about whether an online activity is legal, consult an internet attorney. Many offer free initial consultations, and the cost of 30 minutes of legal advice is trivial compared to the cost of a federal investigation.
—
Frequently Asked Questions
Is it really illegal to use someone else’s Wi-Fi if it’s unsecured?
Yes. Under the Computer Fraud and Abuse Act, accessing any network or computer system without authorization is a federal crime — regardless of whether the network is password-protected. “Unsecured” doesn’t mean “public.”
Can I go to jail for torrenting a movie?
Technically, yes. Criminal copyright infringement carries penalties of up to five years in prison and $250,000 in fines. In practice, most individual casual infringers face civil lawsuits and settlement demands rather than criminal prosecution. But “rare” doesn’t mean “impossible.”
Is sharing my Netflix password illegal?
Sharing your password within your household is a terms of service violation, not a crime. Reselling access or providing credentials to large groups outside your household starts to resemble fraud in some legal interpretations, and platform enforcement is intensifying.
Are VPNs legal in the United States?
Using a VPN is legal. Using it to facilitate illegal activity — piracy, gambling in prohibited states, drug purchases — is not. The VPN doesn’t launder the underlying crime.
What counts as online defamation?
Defamation requires a false statement of fact (not an opinion), published to others, about a real person, that causes reputational harm. Calling someone a “jerk” is protected opinion. Falsely claiming someone committed a crime is defamation.
Are deepfakes always illegal?
No. Deepfakes for satire, entertainment, or clearly labeled fictional content aren’t automatically illegal. Non-consensual sexual deepfakes, deepfakes used for fraud, and deepfakes designed to manipulate elections are where criminal and civil liability kicks in — and legislation in this space is moving fast.
—
The Bottom Line
The internet isn’t lawless — it just feels that way. From copyright infringement to cyberbullying, from unauthorized computer access to AI-generated fraud, the gap between what people routinely do online and what’s actually legal is wider than most people realize.
The 25 things on this list run the gamut from federal felonies to civil liability to emerging areas where law is actively catching up to technology. What they share is a common thread: the assumption that digital actions are private, consequence-free, or too small to matter. That assumption is wrong — and increasingly, it’s being proven wrong in courtrooms.
Curiosity about where the lines are is exactly the right instinct. Stay informed, stay cautious, and when the answer isn’t clear, get proper legal advice before you click.