A federal appeals court has struck down West Virginia Daniel's Law, ruling on Tuesday, October 27, 2026, that the state's ban on publishing the home addresses and unpublished phone numbers of judges and law enforcement officers online violates the United States Constitution. The decision is the first time a federal appeals court has invalidated one of the judge-privacy laws that spread across the country after the 2020 killing of the son of a federal judge at her New Jersey home.
The ruling, from the 4th US Circuit Court of Appeals, does not question the danger that prompted the law. The court accepted that protecting judges and officers is a compelling government interest. It held instead that West Virginia went too far: the law restricted speech based on its content, it was not narrowly tailored to its safety goal, and it left online data companies exposed to lawsuits even when they had no way of knowing that the information they published belonged to a protected official.
The 4th Circuit agreed with US District Judge Michael Urbanski, who had dismissed Jackson's lawsuits last year after concluding that the West Virginia law violated the First and Fourteenth Amendments, which protect speech and due process rights. In Tuesday's three-judge opinion, the appeals court upheld that conclusion and explained why the state's approach failed constitutional scrutiny even though its purpose was legitimate.
West Virginia's law prohibited disclosing a covered official's home address or unpublished telephone number without permission, and it allowed lawsuits seeking at least 1,000 dollars per violation, plus punitive damages, attorney fees and injunctive relief. Jackson, a retired law enforcement officer, sued the data companies alleging that they had violated the law by publishing his home address and unpublished phone number through their online people-search services.
The companies argued that the law punished the publication of truthful, lawfully obtained information. The appeals court accepted the core of that argument. Because the law singled out particular content — the addresses and phone numbers of particular people — it was a content-based restriction on speech, and the state therefore had to show that it was narrowly tailored to a compelling interest. The court said West Virginia could not clear that bar.
West Virginia enacted its law in 2021, a year after the attack that gave Daniel's Law its name. On July 19, 2020, a gunman posing as a delivery driver went to the North Brunswick, New Jersey, home of US District Judge Esther Salas. He shot and killed her 20-year-old son, Daniel Anderl, and wounded her husband, defence lawyer Mark Anderl. Judge Salas herself was in the basement at the time and was not injured.
The attacker was Roy Den Hollander, a lawyer who had once had a case before Judge Salas and had published online screeds deriding her ethnicity and career. He was found dead the next day in an apparent suicide about 90 miles north of New York City. Judge Salas later said the attacker had her family's personal information, including her home address, and had used it to target them. "The monster knew where I lived and what church we attended," she said. "My son's death cannot be in vain."
The tragedy set off a wave of legislation. More than a dozen states adopted their own versions of Daniel's Law, and Congress passed the Daniel Anderl Judicial Security and Privacy Act in 2022 to protect federal judges' personal information online. New Jersey, Judge Salas's home state, enacted its own Daniel's Law in 2020. That measure remains subject to litigation, a point Reuters noted in its report on the West Virginia ruling.
New Jersey's law works differently from West Virginia's in one crucial respect. It allows judges, police officers and prosecutors to sue for at least 1,000 dollars in statutory damages per violation if they ask a company to stop disclosing their personal information and the records are not taken down within 10 days. That notice-and-removal step is at the heart of the West Virginia case, and of the wider fight over how far states can go in policing what data brokers publish.
"West Virginia was fully justified in attempting to regulate such speech in light of the compelling government interest in enhancing the safety and security of certain public officials, but its efforts reached more broadly (than) necessary to accomplish the task," Judge Paul Niemeyer wrote for the panel.
The opinion turned on a distinction the court drew between West Virginia's statute and similar laws elsewhere. West Virginia's law did not require officials to notify a company that information was improperly posted and request its removal before suing. As a result, Niemeyer wrote, data brokers could face liability for publishing information about a broad group of people that, unbeknownst to the companies, included protected officials' information.
"As a result, data brokers either face liability or they self-censor and do not publish such information," Niemeyer wrote. In the court's view, that choice — pay up or stop publishing otherwise lawful information altogether — is exactly what the First Amendment forbids when a less restrictive alternative exists. A law that gave companies a chance to remove the information after being told it was protected could serve the same safety goal with far less damage to free speech.
The court also stressed that its ruling was about the design of this particular statute, not about whether judges and officers deserve protection. That framing matters for lawmakers in other states: a privacy law built around notice and removal, with a real opportunity to comply before liability attaches, stands a better chance than a law that allows a lawsuit on first publication.
Neither side immediately responded to requests for comment on the ruling, according to Reuters. Thomson Reuters, the parent company of Reuters, did not immediately respond. Samir Deger-Sen, a lawyer at Latham & Watkins who represented PeopleConnect and argued the appeal on behalf of all the defendants, also did not respond, nor did Jackson's lawyer, Philip Fraietta of Bursor & Fisher.
The contrast with New Jersey's litigation is instructive. In April 2026, US District Judge Harvey Bartle III rejected a First Amendment challenge to New Jersey's Daniel's Law, holding that even under the strict scrutiny applied to political speech, the statute served a compelling government interest and was narrowly tailored to an increasingly serious public safety threat. That court also rejected claims that the law was overinclusive, finding its restrictions limited and carefully calibrated.
Then, in August 2026, New Jersey's highest court ruled that the state's law does not require plaintiffs seeking damages to prove that a defendant acted with any particular intent — only that the defendant did not comply after a take-down notice was sent. That interpretation could help defendants challenging the measure at the 3rd US Circuit Court of Appeals, who argue that the law imposes strict liability even for actions taken with reasonable care or by mistake, violating First Amendment protections.
Data privacy lawyer Paul Bond, who represents companies targeted by enforcement actions under New Jersey's law, has called it "a popular law with the best of intentions born out of the tragedy," adding: "Everyone is in favor of protecting judicial officers and law enforcement officers and their family. But on a straight up legal analysis, the statute just doesn't have a mens rea (an intent requirement)."
The scale of enforcement in New Jersey shows why the stakes are high. Atlas Data Privacy Corp., which brings enforcement actions on behalf of covered officials, has filed more than 100 lawsuits in New Jersey state court, and in one case asserted claims assigned by approximately 21,760 covered persons. In August 2026, a New Jersey court entered a default judgment against the operators of Radaris.com and related people-search sites and ordered the domains transferred to Atlas — a reminder that, for data brokers, these cases can threaten the business itself, not just a fine.
The West Virginia ruling is the first appellate decision to strike down a Daniel's Law-style statute, and that first-mover status gives it weight beyond one state's borders. Other courts considering similar challenges — most immediately the 3rd Circuit in the New Jersey cases — will now have a fully reasoned federal appellate opinion to weigh against the district court decision that upheld New Jersey's law. If the 3rd Circuit reaches the opposite conclusion, the resulting circuit split would make Supreme Court review considerably more likely.
For judges and law enforcement officers, the ruling is a setback but not necessarily a dead end. The 4th Circuit did not say states are powerless to protect officials' personal information. It said this law, as written, was too broad. A revised West Virginia law that requires notice and a reasonable window to remove information before liability attaches could look very different in court — and New Jersey's experience suggests that such a design is precisely what its defenders point to when they argue their law is narrowly tailored.
For the data broker industry, the decision is a significant win, but a limited one. It applies in the 4th Circuit, which covers Maryland, Virginia, West Virginia, North Carolina and South Carolina, and it turns on a feature — the absence of a notice requirement — that other states' laws may not share. Companies that operate people-search sites still face a patchwork of state laws, enforcement actions and damages claims, and the New Jersey litigation alone involves billions of dollars in potential claims, according to Reuters.
For the public, the case captures a genuine tension with no easy resolution. The same online information that lets a stranger find a judge's home address also lets voters, journalists and litigants find out who public officials are and how to reach them. The First Amendment protects the publication of truthful information, even when that information is sensitive. The question the courts are now working through, state by state, is how much of that protection must give way when the information puts a person at risk — and what procedural safeguards make that trade-off constitutionally acceptable.
Several paths are open. Jackson could ask the full 4th Circuit to rehear the case en banc, or seek Supreme Court review, though the Supreme Court takes only a small fraction of petitions. West Virginia's legislature could also respond by amending the law to add the notice-and-removal step the court identified as missing, which would test whether a redesigned statute survives.
The more immediate watchpoint is the 3rd Circuit. That court will decide the constitutionality of New Jersey's Daniel's Law, informed by the state supreme court's August 2026 ruling that no proof of intent is required. A decision upholding New Jersey's law would set up a direct conflict with the 4th Circuit's reasoning; a decision striking it down would extend the West Virginia result to the state where Daniel's Law began.
Meanwhile, enforcement in New Jersey continues, and data brokers operating nationally will have to navigate a legal landscape in which the same kind of law is unconstitutional in one circuit and, for now, upheld in a district court in another. Until a higher court resolves that tension, the safest course for companies is to treat take-down notices seriously and promptly — the very step whose absence doomed West Virginia's law.
It is a 2021 West Virginia statute, named after Daniel Anderl, that barred publishing the home addresses and unpublished phone numbers of judges and law enforcement officers online without permission and allowed lawsuits of at least 1,000 dollars per violation.
The court held that the law was a content-based restriction on speech that was not narrowly tailored to protecting officials, chiefly because it allowed lawsuits without first requiring a notice-and-removal request.
Not directly. The ruling binds courts in the 4th Circuit, not the 3rd Circuit, where New Jersey's law is being challenged. But its reasoning will weigh heavily in that litigation and could contribute to a circuit split.
Retired law enforcement officer Michael Jackson sued Thomson Reuters, Whitepages, Thryv, PeopleConnect and LexisNexis, alleging they published his home address and unpublished phone number in violation of the law.
Possibly. The court's opinion points to a notice-and-removal requirement as a less restrictive alternative, so an amended law built around that step could fare better — though any new version would still face First Amendment scrutiny.
Related coverage on US News Pulse: Supreme Court backs Trump in deportation case as immigration judges lose pause power, California ballots hearing: judge questions DOJ bid to block 20,000 votes, and Judge blocks Trump refugee rule cutting response time to 10 days.
Leave a Comment
| Today's Date:
