Combating cyberviolence: Key changes to the Criminal Code

On 22 April 2026, the government approved a bill allowing the Minister of Justice to submit to the Chamber of Deputies new legislation aimed at combating cyberviolence and updating the Criminal Code.

The bill follows a dual objective. First, it seeks to modernise criminal law so it can better address forms of violence that are facilitated or amplified by digital technologies. Second, it partially transposes the EU Directive on combating violence against women and domestic violence, insofar as this directive requires the criminalisation of specific forms of cyberviolence.

While Luxembourg criminal law is, in principle, designed to be technology‑neutral, the explanatory memorandum acknowledges that existing offences don’t always adequately cover the realities of digital abuse.

Online violence is often immediate, repetitive, viral and highly intrusive, which can make it difficult both to classify criminally and to offer effective protection to victims. The bill aims to strengthen the criminal law toolkit in a targeted way, without departing from its core principles.

 

New offences targeting sexual violations of dignity and privacy

A first set of measures focuses on protecting dignity and privacy in the digital space, particularly where sexual content is involved.

The bill introduces a new offence addressing the unsolicited sending of sexual images or videos, commonly known as cyberflashing.

This covers the sending, by any means, of visual content showing genitalia or intimate body parts without the recipient’s consent. Proceedings are initiated only if the victim (or their representatives) files a complaint. More serious penalties apply where the conduct targets a minor, a vulnerable person, or involves abuse of authority or multiple offenders.

The bill also criminalises the non‑consensual sharing of intimate images or recordings, including what is often referred to as revenge porn.

It applies even where the person depicted originally agreed to the creation of the content but didn’t consent to its distribution.

The scope of the offence explicitly includes manipulated or fabricated content, such as sexual deepfakes.

Threatening to share such material to force someone to act, agree, or remain silent is also now a criminal offence.

Additional aggravating factors apply, including where the victim is a minor, where there is a family or partner relationship, or where several offenders are involved.

 

Broader and clearer rules on harassment

A second pillar of the reform updates the offence of harassment to better reflect modern forms of psychological violence, particularly online.

The concept of harassment is simplified and broadened to cover collective or “mob” harassment, where a person is targeted by multiple individuals, even if no single perpetrator repeats the conduct.

The law also expressly recognises sexual harassment, defined as remarks or behaviour of a sexual nature (or based on sex) that undermine a person’s dignity and that the offender knew, or should have known, would have that effect.

The reform also introduces the notion of coercive control.

This covers repeated psychological, economic or financial pressure that seriously restricts a victim’s freedom of movement, personal life or daily activities.

Importantly, the law now recognises that a single act may be sufficient to constitute harassment if its effects are persistent or continuously renewed. This is particularly relevant for online content that is accessible over time. Where harassment leads a victim to attempt or commit suicide, significantly increased penalties apply.

 

Criminalising online surveillance and tracking

The bill also tackles online stalking by introducing a new offence targeting the surveillance or monitoring of a person through digital means. This includes repeated or continuous tracking conducted without consent and with the intent to intrude on someone’s private life. Harsher penalties apply in cases involving minors, intimate or family relationships, or abuse of authority.

 

Stronger penalties for doxxing

Finally, the bill reinforces the criminal response to doxxing – disclosing or sharing personal data to expose someone to risk. The maximum prison sentence for this conduct has been increased, ensuring that Luxembourg law aligns with EU requirements.

 

Overall assessment

Overall, the bill represents a focused but significant update of the Criminal Code. By clearly defining and criminalising key forms of cyberviolence, it sends a strong message that violence committed online is treated with the same seriousness as violence committed offline, and that victims of digital abuse are entitled to robust legal protection.