Harassment Under California Penal Code: Statutes & Penalties

Most people search for “harassment” and expect one clear law, but California doesn’t have a single harassment Penal Code. Instead, what most people call harassment falls across several criminal statutes—each covering a different type of behavior. These include stalking (PC 646.9), criminal threats (PC 422), annoying or harassing communications (PC 653m), cyber harassment or doxxing (PC 653.2), and restraining order violations (PC 273.6 / PC 166).

That matters because the label “harassment” can mean very different things depending on the facts. The same situation might trigger criminal liability, workplace obligations, or both. If you’re in HR, that distinction shapes how you respond, document, and escalate—especially when conduct could create a hostile working environment.

This guide breaks down each relevant statute in plain English. It also shows how to connect legal definitions to real workplace scenarios so you can act quickly and confidently.

Here’s a look at each statute for quick reference:

If you’re an HR or compliance leader responsible for handling complaints—or preventing them—this guide will help you stay aligned with California law and reinforce your approach with sexual harassment training videos for California.

Stalking: definition under California law

Under Penal Code 646.9(a), stalking occurs when someone willfully and maliciously follows or harasses another person and makes a credible threat that causes reasonable fear for their safety or the safety of their immediate family. Each of those elements matters. If one is missing, the conduct may not meet the legal threshold—even if it still qualifies as harassment in a workplace context.

Before breaking this down, two terms drive how the law works:

• A “course of conduct” means two or more acts directed at a specific person over a period of time, however short, showing a clear pattern.
• A “credible threat” means a threat made with both the intent and apparent ability to carry it out, causing the target to reasonably fear for their safety.

California treats stalking as a “wobbler.” Prosecutors can charge it as a misdemeanor or a felony, depending on the severity of the behavior and the person’s criminal history. That flexibility makes early assessment especially important for HR teams.

To prove stalking under California law, all of the following must be true:

• The person willfully, maliciously, and repeatedly followed someone
• The person engaged in a course of conduct that seriously alarmed, annoyed, or terrorized the target and served no legitimate purpose
• The person made a credible threat that caused reasonable fear

This is a high bar by design. Not every uncomfortable interaction meets it.

Example: when behavior does not qualify

Imagine this: Millie notices a colleague, Mark, behind her on the way to the train, on the train, and again after they get off. She becomes frightened and believes he is following her. But Mark is simply traveling to the same place for his own errand and keeps his distance because he is shy, not because he intends to threaten or harass her.

There’s no malicious intent and no pattern of behavior. This was a one-time coincidence, so it would not be considered stalking.

Example: when behavior crosses the line

Now, picture a different scenario. Val wants a promotion and starts sending threatening messages to her colleague, Joan. It begins with a note at work, then escalates to messages sent to Joan’s home, implying she knows where Joan lives.

That pattern shows intent, repetition, and escalation. The implied threat creates real fear. This kind of behavior clearly qualifies as harassment and may meet the legal definition of stalking under California law.

Where behavior falls short of stalking under California law

Not every uncomfortable or even inappropriate interaction meets the legal threshold for stalking. Before labeling conduct under CPC 646.9 PC, it’s important to look closely at intent, repetition, and whether real fear exists.

Here are common scenarios that do not qualify as stalking:

• A single unwanted contact: One message, one encounter, or one awkward interaction does not establish a course of conduct. The law requires a pattern.
• Annoying behavior without real fear: Conduct can feel frustrating or inappropriate, but still falls short if it doesn’t create reasonable fear for safety. For example, repeated but non-threatening complaints or rude comments may not meet the standard.
• Legitimate business or legal communication: Performance feedback, workplace investigations, legal notices, or attempts to collect a debt can involve repeated contact. If the purpose is legitimate, it does not qualify as stalking.
• Threats that aren’t credible: Exaggerated or unrealistic statements made in anger may sound aggressive, but if there’s no real ability or intent to carry them out, they don’t meet the legal definition of a credible threat.
• Protected or lawful activity: Activities like labor picketing or public protest can involve repeated actions directed at individuals or organizations. When done within legal limits, they are protected and not considered stalking.

Even when conduct doesn’t meet the threshold for stalking, it may still violate other laws—such as annoying communications (PC 653m) or criminal threats (PC 422)—or internal workplace harassment policies under FEHA.

Cyberstalking: definition under California law

Cyberstalking isn’t a separate statute in California. Prosecutors charge it under PC 646.9 when someone uses digital tools to carry out stalking behavior. The law explicitly includes electronic communication, so the same rules apply whether conduct happens in person or online.

An electronic communication device means any device that can transmit electronic communications. This includes telephones, cell phones, computers, video recorders, fax machines, and pagers.

To qualify as cyberstalking, the behavior must still meet the same elements as stalking. That includes a course of conduct, malicious intent, and a credible threat that creates reasonable fear.

Real-world example of cyberstalking

An example of a real-life cyberstalking case involved a woman who created fake social media accounts to monitor, harass, and threaten another woman she found online. She sent repeated emails, texts, calls, letters, and social media messages, threatened to expose private information, and demanded $100,000 to stop. She was later convicted and sentenced to 22 months in prison.

How to preserve evidence of cyberstalking

In digital cases, evidence matters—and it disappears quickly if handled incorrectly. Encourage employees to:

• Screenshot messages with visible timestamps
• Preserve metadata (avoid editing or cropping files)
• Export full message threads from apps
• Document a clear timeline of incidents

For organizations managing remote or hybrid teams, EasyLlama's Cybersecurity & Cybercrime Prevention training course helps employees and managers recognize and properly report digital misconduct, including how to preserve evidence when harassment occurs through texts, DMs, or social channels.

The penalties for cyberstalking mirror standard stalking charges. Depending on the case, that can mean misdemeanor or felony consequences, along with protective orders and additional restrictions.

Penalties for stalking in California

Stalking penalties in California depend on how the case is charged. Because stalking is a wobbler, prosecutors can pursue either a misdemeanor or a felony based on the facts, prior history, and severity of the conduct.

For a first offense, stalking often starts as a misdemeanor. But aggravating factors—like prior convictions or violations involving the same victim—can quickly elevate the charge to a felony:

A prior stalking conviction—especially involving the same victim—significantly increases exposure. Under PC 646.9(c)(1), courts use the 2, 3, or 5-year sentencing range for repeat offenses.

Courts may also impose additional consequences. For example, if the conduct was sexually motivated, the court can require sex offender registration. In many cases, judges also issue protective orders that restrict contact with the victim.

Other consequences beyond criminal penalties

A stalking conviction doesn’t stop at jail time or fines. It often triggers additional consequences that can follow someone long after the case ends, such as:

• Civil lawsuits: Victims can file a civil claim to recover damages. If successful, the court may award compensatory and even punitive damages.
• Protective orders and violations: Courts typically issue a criminal protective order after a stalking conviction. Violating that order is a separate crime under PC 273.6 or PC 166, which can lead to additional charges.
• Immigration and licensing impacts: Non-citizens may face immigration consequences, including visa issues or removal proceedings. Professional licenses can also be suspended or revoked depending on the industry and severity of the offense.
• Firearm restrictions: A conviction can limit or eliminate the right to own or possess firearms.

These consequences add up quickly. For HR teams, they often signal elevated risk, both for workplace safety and for how the organization should respond.

Cyber harassment: definition under California law

Cyber harassment in California falls under PC 653.2. This statute focuses on a specific type of behavior: using the internet or electronic devices to expose someone’s personal information in a way that encourages others to harass or harm them.

Unlike cyberstalking, where the offender directly targets the victim, cyber harassment involves inciting third parties to do the harm.

To meet the legal standard, the conduct must include:

• Electronically distributing personal identifying information (such as a name, address, or phone number) without consent
• Doing so with the intent to cause unwanted physical contact, injury, or harassment by others

Intent is key here. Without it, the conduct may be inappropriate—but it likely won’t meet the criminal threshold.

Example scenario of cyber harassment

An employee leaves a company on bad terms and posts their manager’s phone number and home address online, encouraging others to “tell them how you feel.” Soon after, strangers begin calling and sending threats.

That kind of conduct fits squarely under PC 653.2.

Penalties of cyber harassment

Cyber harassment under PC 653.2 is a misdemeanor. It carries up to 1 year in county jail, a fine of up to $1,000, or both.

For HR teams, this is one of the clearest examples of how online behavior can quickly cross from policy violation into criminal conduct.

Other harassment-related penal codes in California

Harassment-related behavior rarely falls under a single statute. The same set of actions can trigger multiple charges, depending on how the conduct unfolds. Prosecutors often stack offenses to reflect the full scope of harm, which is why it’s important to understand how these laws connect.

Kidnapping

According to California criminal code section 207(a), a person is guilty of kidnapping if:

• The person uses force or other means to instill fear and consequently take, hold, detain, or arrest another person
• The person carries their victim to another country, state, county, or another part of the same county

This crime often overlaps with stalking cases. In more severe situations, stalking behavior escalates into physical control or movement of the victim.

Unlike stalking, kidnapping is always a felony. It carries up to 8 years in state prison, a fine of up to $10,000, or both. It also counts as a strike offense, which means repeat convictions can lead to significantly longer sentences under California’s three-strikes law.

Criminal threats

Under PC 422, a criminal threat occurs when someone makes a serious threat that causes real fear. Sustained fear means more than a brief reaction—it’s ongoing, genuine fear that doesn’t quickly pass.

To meet the legal standard, all of the following must apply:

• Willfully threatened to kill or cause great bodily injury
• Made the threat verbally, in writing, or via electronic communication
• Intended the statement to be understood as a threat
• The threat was clear, specific, and immediate enough to suggest it could be carried out
• The threat caused the victim to experience sustained fear

PC 422 is a wobbler. It carries up to 1 year in jail as a misdemeanor or up to 3 years in prison as a felony.

Annoying phone calls

Under PC 653m, annoying or harassing communications focus on repeated contact, not necessarily threats. The law targets behavior that crosses the line from unwanted to intentionally disruptive.

To qualify, the conduct must include:

• Making repeated telephone calls or electronic contacts
• With the intent to annoy or harass
• Using obscene language or making repeated calls, regardless of what is said

PC 653m is a misdemeanor. It carries up to 6 months in county jail, a fine of up to $1,000, or both.

Restraining order violations

Restraining order violations often accompany stalking or replace it when a court order already exists. Under PC 273.6, violating a domestic violence, civil harassment, or workplace violence restraining order is typically a misdemeanor (up to 1 year), but repeat or violent violations can become felonies. PC 166 also applies, treating willful disobedience of a court order as contempt (up to 6 months).

For HR, this matters. Employers can request workplace violence restraining orders (WVROs) under CCP 527.8, and violations are criminal. If an employee has a restraining order, take reasonable steps to enforce safety—adjust schedules, limit access, or separate workspaces.

Criminal harassment vs. workplace harassment

“Harassment” means different things depending on the law you’re applying. Criminal harassment falls under the California Penal Code and focuses on threats, stalking, and unlawful conduct. Workplace harassment falls under FEHA and focuses on discrimination tied to protected characteristics.

HR teams need to separate these frameworks quickly. The response, documentation, and risk all change depending on which standard applies.

Conduct can fall into one category, both, or neither. For example, a coworker making a credible death threat violates PC 422 and creates a hostile work environment. A supervisor making repeated sexual comments may violate FEHA but not rise to criminal stalking. A stranger sending threatening texts may trigger criminal liability but not employer liability under FEHA—though workplace safety obligations still apply.

EasyLlama's California Sexual Harassment Training includes Nuanced Content Modules covering quid pro quo harassment, third-party harassment, and abusive conduct—helping HR teams and investigators apply the correct legal framework when categorizing reported conduct.

What to do when a report comes in

When a harassment report lands on your desk, speed and structure matter. You need to assess risk, categorize the conduct, and choose the right response path—without overreacting or missing something serious.

Use this framework to guide your next steps.

Step 1. Assess immediate safety

Start with risk. If there’s any sign of immediate danger, act first and investigate second.

• Is there an explicit threat of violence? If yes: Escalate to security/law enforcement immediately.
• Is there a restraining order in place? If yes: Verify compliance; escalate violations to law enforcement.
• Is there a weapon involved or referenced? If yes: Escalate to security/law enforcement immediately.

Step 2. Identify the conduct pattern

Next, match the behavior to the right category. This step determines everything that follows.

• Repeated following, surveillance, or contact causing fear → Potential PC 646.9 (stalking)
• Explicit threat to kill or cause serious harm → Potential PC 422 (criminal threats)
• Repeated unwanted calls, texts, or electronic contact → Potential PC 653m
• Posting personal info online to incite harassment → Potential PC 653.2
• Unwelcome conduct based on protected characteristics → Potential FEHA violation
• Unprofessional but non-threatening conduct → Policy violation or performance issue

Step 3. Determine response track

Once you’ve identified the pattern, choose the appropriate path. Use the table below as a quick reference.

Consistency is where most teams struggle. Standardize manager response with EasyLlama's Cybersecurity Training for Business Leaders course, which trains supervisors on proper intake, escalation, and anti-retaliation practices, reducing ad hoc handling and procedural errors.

If you want a repeatable, audit-ready process across your team, book a demo with EasyLlama and see how it works in practice.