What Is Doxxing, and How Do You Respond?

Doxxing is the malicious act of researching and publishing someone's private, identifying information online, such as a home address, phone number, workplace, financial details, or family members' names, without their consent, usually to intimidate, harass, or expose them to harm. The word comes from "dropping docs," and the intent is almost always to strip away a person's sense of safety and anonymity. If this is happening to you right now, you are not overreacting by taking it seriously, and there are concrete steps you can take. This guide walks through them calmly and in order, so you can act rather than freeze.

What doxxing is, and the forms it takes

At its core, doxxing means compiling private facts about a person and exposing them publicly to cause fear or harm. It takes several recognizable forms. Deanonymizing links a pseudonymous account to a real name. Targeting publishes where someone can be physically found, a home address, employer, school, or daily routine, often alongside a call for others to show up or harass. Delegitimizing dumps sensitive material like medical records, financial details, private messages, or immigration status to humiliate or discredit. It frequently overlaps with other abuse: swatting (making a false emergency report so armed police are sent to a victim's home), stalking, impersonation, and threats. It disproportionately targets women, LGBTQ+ people, journalists, activists, and anyone caught in a public dispute, and because the information gets copied and re-posted, the exposure can outlast the original attacker's involvement. That is why moving early and methodically is the right response, not an overreaction.

Is doxxing illegal? The legal patchwork explained

The honest answer is: it depends, and the picture is a patchwork. There is no single federal law that makes doxxing a crime by name. Instead, doxxing is reached through a mix of existing federal statutes, state laws, and civil claims. Federally, the cyberstalking statute (18 U.S.C. 2261A) makes it a crime to use electronic communications in a course of conduct that puts someone in reasonable fear of death or serious bodily injury, or that causes substantial emotional distress, with penalties that can reach several years in prison and more if serious injury results. When doxxing is part of a broader pattern of intimidation, especially one that crosses state lines, that statute can apply.

At the state level, momentum has grown quickly. As of 2026, roughly 17 states have enacted specific anti-doxxing statutes, and every state can reach the conduct through harassment, stalking, threat, or privacy laws. Practically, doxxing crosses the line into clearly illegal territory when the person publishing the information intends to cause fear, harassment, or harm, or when it is paired with threats, incitement to harass, or the release of legally protected records. Beyond criminal law, victims sometimes have civil options too, such as suits for harassment, intentional infliction of emotional distress, or public disclosure of private facts. Sharing information that is already genuinely public is a grayer area, which is part of why removal and de-indexing, covered below, often matter more day to day than a prosecution that may take months. If threats or defamation are involved, a lawyer can tell you which levers actually apply in your state.

Your first-24-hours checklist

When you first discover you have been doxxed, the flood of emotion is real, and a short, ordered checklist keeps you from spinning. Do these in sequence: (1) If you feel in physical danger, treat safety first, call 911 (or your local emergency number) and consider staying somewhere else tonight. (2) Preserve evidence with screenshots before anything is deleted. (3) Lock down your key accounts and turn on two-factor authentication. (4) Report the content to every platform hosting it. (5) If there are threats, calls to harass, or your home address is exposed, file with law enforcement and the FBI's Internet Crime Complaint Center. (6) Start removal at the source and de-indexing from Google in parallel. (7) Tell someone you trust, and loop in your employer or campus if your work or school is exposed. (8) Do not engage with or negotiate with the attacker. The sections that follow expand each step. You do not have to do all of it in one sitting, but doing the first three quickly protects everything that comes after.

Preserve the evidence before anything disappears

Before you report anything or ask for a takedown, document everything, because content often vanishes once you start reporting it, and you will need proof for platforms, and possibly police and lawyers. Take clear screenshots that capture the harmful content, the username or account that posted it, the full URL, and the visible date and time. Copy the web addresses into a single document. Where the same information has been re-posted, note each location. Do this even though every instinct says to get it deleted immediately: evidence preserved now is what makes reporting, removal, and any legal action possible later. Keep it all in one folder, ideally backed up, that you can hand to a platform, a lawyer, or law enforcement. If a friend can help you capture screenshots so you do not have to keep looking at the material, let them.

Lock down your accounts and stop the bleeding

Doxxing is frequently paired with attempts to break into your accounts, so secure them next. Change the passwords on your email, financial, and social accounts to strong, unique ones, and turn on two-factor authentication everywhere, ideally with an authenticator app rather than text messages, since phone-based codes can be intercepted through SIM-swapping. Review which apps and devices have access to each account and revoke anything you do not recognize. Tighten privacy settings so profiles, friend lists, tagged photos, and past posts are not publicly visible. If your address, date of birth, or financial details were exposed, identity theft becomes a real risk: alert your bank, watch your statements, and consider placing a credit freeze with the three major bureaus, which is the single most effective step to block anyone from opening new accounts in your name. You can report identity theft and get a recovery plan at the FTC's IdentityTheft.gov.

Report to the platforms hosting the content

Every major platform prohibits sharing someone's private information and posting content meant to harass, and each has a dedicated reporting path. Reference the exact policy the content violates, and attach your saved URLs and screenshots. On X, open the post, tap the three dots, choose Report Post, then Privacy, and follow the doxxing options described in X's private information policy. On Facebook and Instagram, use the three-dot menu on the post to Report, then select Harassment or Bullying and indicate the content targets you. On TikTok, report the video or use its Report a Problem form for sensitive-information violations. On Reddit, use the dedicated report form and select the personal-and-confidential-information option, providing the link and the type of information exposed. Prioritize reports that expose a physical address or contain threats, most platforms have expedited review for physical-safety risks, and say so clearly in the report. If a report is denied, calmly re-submit citing the specific policy line; documenting a coordinated pattern rather than one post often gets a stronger response.

Remove the exposed information at the source

Reporting to the platform is one front; the other is getting the content removed at the source and out of search. Source removal means the site or account that published your information takes it down, using its harassment and private-information policies, or, on smaller sites, a direct request to the site owner or host. Pursuing this alongside search de-indexing is how you actually shrink exposure rather than just relocating it. This dual approach, removal at the source plus removal from search results, is the heart of professional content removal work, and it is worth understanding even if you handle the early steps yourself. Where a page cannot be removed outright, the fallback is to suppress it in search results by strengthening accurate, higher-ranking content so the harmful result no longer surfaces on page one.

Use Google's personal-information removal tool

Even after content is reported, a copy can linger somewhere and keep appearing when someone searches your name, so de-indexing from Google matters. Google has a dedicated process to remove personal, contact, and identifying information from Search when it can be used to harm you, and it also removes content used to doxx people. Through the Remove your personal info from Google tool, you can request removal of results exposing your home address, phone number, email, government ID numbers, bank or card numbers, handwritten signatures, medical records, and login credentials. Google specifically accepts doxxing removals where a URL shows your personal information alongside explicit or implicit threats, or calls for others to harm or harass you, so note that in your request. In 2026 the tool became easier to use: the Results About You dashboard scans for your contact details and alerts you when they appear, and you can submit removals in a few clicks from the three-dot menu next to a search result. Google removing a result from Search does not delete the underlying page, so pair this with source removal. Our companion walkthrough on how to remove your personal information from Google covers the step-by-step.

Clear yourself from data broker and people-search sites

Much of what a doxxer publishes is not secret, it is scraped from data broker and people-search sites like Whitepages, Spokeo, BeenVerified, TruePeopleSearch, and FastPeopleSearch, which compile addresses, phone numbers, relatives, and more into free public profiles. The average American appears on hundreds of these sites, and they are frequently the raw material for a dox. Each broker maintains its own database, so opting out of one does not affect the others, and because they continuously re-ingest public records, your information often reappears within three to six months, which makes opt-out ongoing maintenance rather than a one-time fix. Start with the highest-traffic sites that are most likely to rank in Google. Our sibling guide on how to remove yourself from data broker sites walks through the opt-out process site by site and explains how to keep it from creeping back.

When and how to involve law enforcement

Not every dox rises to a crime, but many do, and you should not hesitate to report when there is a threat. If you are in immediate danger, call 911. Otherwise, file a report with your local police, providing your evidence folder and any URLs, and ask for a report number, which is useful later when you ask platforms and search engines to act. In the United States, also file a complaint with the FBI's Internet Crime Complaint Center (IC3), which routes online-crime reports including threats, stalking, and harassment to the appropriate agencies. Document specific threats, any pattern of repeated contact, and anything that suggests the person knows your physical location. Federal cyberstalking cases generally require serious, ongoing harm, so local police plus IC3 is the realistic starting point for most people. If you fear someone may target your home, tell your employer, building security, or campus so they can watch for suspicious visitors or deliveries, and consider whether a protective order is appropriate in your jurisdiction.

Prevention: privacy hygiene that makes you a harder target

Once the immediate crisis is contained, a few habits make you meaningfully harder to dox next time. Audit what is already public by searching your own name, email, phone number, and usernames, then request removals for what you find. Opt out of the major data brokers and re-check every few months. Lock down social accounts, set them private where you can, strip location metadata and geotags from photos, and avoid posting images that reveal your home, workplace, or routine. Separate your identities, use different usernames and a dedicated email for public-facing accounts, and keep a masked or forwarding email and a secondary phone number for sign-ups. Harden your logins with unique passwords in a password manager and app-based two-factor authentication. Be deliberate about what you share, birthdays, pet names, schools, and employers are the exact details attackers stitch together. None of this guarantees immunity, but each layer removes an easy thread for someone to pull. If you want a clear picture of what is currently exposed about you, a reputation audit maps what shows up for your name and sorts it into removable, suppress-only, and fine.

Find support, and do not go through it alone

Being doxxed is frightening and isolating, and the emotional toll is real, so give yourself permission to lean on people. Tell someone you trust what is happening, and consider looping in your employer or campus if your work or school context is exposed. Nonprofit organizations focused on online harassment and cyber civil rights offer hotlines, safety guides, and step-by-step help, and a lawyer can advise where threats or defamation are involved. Some cases overlap with more severe abuse and have their own urgent paths: if private or intimate images were shared without your consent, see our guide to non-consensual image removal; if someone is threatening to release your information or images unless you pay, that is sextortion, a crime, and you should not pay, get help through our sextortion resources. In all of these, do not negotiate with the attacker.

The bottom line

If you are being doxxed, work in order: preserve the evidence, secure your accounts, report to the platforms and, where there are threats, to law enforcement, then pursue removal both at the source and from Google's search results, and clean up the data brokers that feed the problem. Move deliberately rather than deleting in a panic, do not negotiate with whoever is behind it, and do not carry it alone. A path to getting the information taken down and de-indexed exists. Reputation Resolutions has worked on online reputation and privacy since 2013, across more than 40 countries and 5,000+ engagements, and we treat these cases with urgency and discretion. If you want experienced help documenting, reporting, and removing content that exposes you, we offer a free, confidential consultation.