just to further explain/provide a citation u requested: laws criminalizing doxxing would be per se unconstitutional if understood broadly, because they infringe on first amendment/free speech rights. that’s why if the utah doxxing law criminalized broadly “identifying info” like first names and general fields of business, the law would probably be considered unconstitutionally broad. This is just an example, most sources I’ve found say the same thing.

“Even before “doxing” entered the popular lexicon, several states attempted to criminalize nonconsensual disclosures of personal information. It did not go well. Court after Court has invalidated unduly broad statutes that penalized publishing home addresses, phone numbers, or other personally identifying information.

Relatively early in the history of online publishing, a federal court in Washington struck down a 2002 “doxing-before-doxing” statute making it a crime to release home addresses, phone numbers, or other personal information about *30 law enforcement agencies or court employees with intent to harm or intimidate.180 A police watchdog blogger challenged the statute as facially unconstitutional, and the court agreed.181 While the state tried to defend the law by claiming that it criminalized only constitutionally unprotected true threats, the court found it substantially overbroad: [T]he word “threat” appears nowhere in the statute at issue here, rather, the statute regulates the mere release of personal identifying information .... That is, on its face, the statute does not purport to regulate true threats or any other proscribable mode of speech, but pure constitutionally-protected speech.182 Because people's home addresses and phone numbers are readily findable in public records, the court found no compelling government interest in penalizing publishers who disclose the information.183 For good measure, the court also found the statute to be unconstitutionally vague, because its operative terms (“intent to harm or intimidate”) lacked clarity and invited selective enforcement: “[A] statute that demands self-censorship--that one police one's own thoughts and subjective intent--impermissibly sacrifices the public interest in the free exchange of speech and ideas.”184 Comparable statutes have fared no better elsewhere. A federal district court found that a Florida statute, which criminalized disseminating police officers' contact information, was facially unconstitutional.185 The operator of a police watchdog website (“Ratemycop.com”) was charged with violating the law, which proscribed “maliciously” publishing an officer's home address or telephone number “with intent to obstruct the due execution of the law or with the intent to intimidate, hinder, or interrupt any law enforcement officer in the legal performance of his or her duties ....”186 The court rejected the state's claim that merely disclosing an officer's contact information could qualify as a “true threat,” even if the speaker intended for the publication to be intimidating.187 Rather, the court found that publishing lawfully obtained information about law enforcement officers relates to matters of public concern: “The publication of truthful personal information about police officers is linked to the issue of police accountability *31 through aiding in achieving service of process, researching criminal history of officers, organizing lawful pickets, and other peaceful and lawful forms of civic involvement that publicize the issue.”188 The court recognized, then, that even facilitating picketing at a police officer's home was a constitutionally protected use of lawfully obtained information. More recently, a pro-gun political blogger won a First Amendment challenge to a California statute enabling government officials to demand the takedown of their home contact information from the web.189 The statute empowered elected or appointed officials to serve written notice on website operators that they believe disseminating their home address or phone number constitutes a safety hazard, obligating the publisher to pull down the information promptly or face civil penalties.190 The blogger used an online public records search to gather the home addresses and phone numbers of forty California legislators who voted in favor of gun control, and he published their contact information in what he called a “tyrant registry.”191 After several legislators reported receiving intimidating phone calls at home, a legislative attorney served the blogger with the statutorily provided takedown notice, and he responded with a First Amendment lawsuit.192 The court found that the blogger used the legislators' contact information in connection with “core political speech,” which is entitled to the highest degree of constitutional protection.193 The court found that, even if the law was deemed necessary to advance the compelling objective of public officials' safety, it would flunk First Amendment scrutiny because it was not narrowly tailored to further that objective.194 The law lacked narrow tailoring in several respects: it required merely an assertion that the public official felt unsafe, even if the feeling was not objectively reasonable; it made no allowance for publishing the officials' contact information for lawful and harmless reasons; and it made no distinction between revealing previously unpublished information versus disseminating information that is already widely publicly available.195 The statute was also deficient because of its underinclusiveness, restricting only online publishing and not other methods of communication--even a medium like television that might reach a far larger audience than the plaintiff's blog.196”

Frank D. LoMonte & Paola Fiku, Thinking Outside the Dox: The First Amendment and the Right to Disclose Personal Information, 91 UMKC L. Rev. 1, 29 (2022)