What to do if you have been doxxed

Doxxing is the publication of personal details, such as a home address, a phone number, a workplace or family members' names, with the intent of causing harm. Australia's eSafety Commissioner notes that the person posting often urges others to use the information to harass the target. This guide is the action plan; the doxxing explainer covers what doxxing is and where the data comes from. Before you report anything, decide whether you are safe right now.

• If someone has threatened you, or you think someone may come to your home or workplace, call the emergency number where you live. This is also eSafety's instruction for anyone at risk of immediate harm.
• Tell the people named in the post, such as a partner, family members or your employer, so they are not caught by surprise. CISA lists family members and workplace details among the information doxxers publish.
• Change the password on your main email account and turn on two-factor authentication. CISA's advice after a doxxing incident includes changing login details for all online accounts and watching for signs of identity theft.

It feels wrong to save something hurtful, but every later route, the platform, the police or a lawyer, starts with the evidence. PEN America's Online Harassment Field Manual calls documentation critical if you escalate to platforms, employers, law enforcement or the courts. Posts are also deleted and reposted, so capture them first. If you would rather not look at it, ask someone you trust to do this for you.

1. 1.Copy the full web address (URL) of each post, profile and page where your details appear.
2. 2.Take a screenshot that shows the content, the account name and the date.
3. 3.Write a short log: date and time, the platform, what was posted and any threats that came with it. PEN America suggests a log whenever harassment is repeated or ongoing.
4. 4.Keep everything, including your own messages. PEN America advises saving the whole exchange, not only the parts that favour you, because a partial record can count against you in court.
5. 5.Store the files somewhere private and share them only with the platform, the police or a support service.

Report the post to the platform first. eSafety describes this as usually the fastest way to get content removed. The large platforms have rules against posting other people's private information:

• X prohibits posting someone's home address or physical location, non-public phone numbers, email addresses and identity documents without permission. Anyone can report a clearly abusive post; otherwise X may need to hear from the person the information belongs to. X says it may act on home addresses even when they are available elsewhere.
• Facebook and Instagram (Meta) remove content that shares full private residential addresses and identifiers such as government ID numbers. Meta says the best way to report is the Report link near the content.
• Reddit says posting someone's personal information, or links to it, is not allowed and will get the poster banned.
• Discord does not allow sharing, or threatening to share, personally identifiable information without consent.

If the platform does not act, there are further routes. In Australia, eSafety can direct a platform to remove seriously harmful content under its Adult Cyber Abuse Scheme, which covers content intended to cause serious harm that is menacing, harassing or offensive. In the UK, the Online Safety Act requires platforms to remove illegal content when users flag it. Elsewhere, use the platform's appeal process and keep every reply.

Then ask Google. Its removal policy covers pages that show your personal information alongside explicit or implicit threats, or a significant amount of aggregated personal information without a legitimate purpose. Google reviews only the URLs you submit, and removal from Search does not remove the page from the internet. Results about you can also watch Search for your address, phone number or email and notify you of new results.

Report to the police when there is a threat or the doxxing is part of ongoing harassment. In the US, CISA advises reporting to local law enforcement and considering a complaint to the FBI's Internet Crime Complaint Center (IC3). Bring your log and screenshots and ask for a reference number.

It depends on where you are and what was done. Some countries have a specific doxxing offence. Others treat it under stalking or harassment law, which usually needs more than one incident or a threat. This is general information, not legal advice.

• Australia. Yes. The Privacy and Other Legislation Amendment Act 2024 added section 474.17C to the Criminal Code. It is an offence to use a carriage service, such as the internet, to publish or distribute a person's personal data (name, image, phone number, email, residential or work address and more) in a way that reasonable people would regard as menacing or harassing. The penalty is imprisonment for up to six years.
• United States. There is no single federal doxxing offence. The federal stalking statute, 18 U.S.C. 2261A, covers using an electronic communication service, with intent to harass or intimidate, in a course of conduct that places a person in reasonable fear of death or serious bodily injury, or that causes or would reasonably be expected to cause substantial emotional distress. Some states have their own laws; see the doxxing explainer.
• United Kingdom. Doxxing is not a named offence. Under the Protection from Harassment Act 1997, stalking is an offence, and the Act's examples of stalking include publishing any statement or other material relating to a person. The Crown Prosecution Service explains that a course of conduct means at least two occasions. Section 2A carries up to 51 weeks' imprisonment on summary conviction. See UK privacy law.
• European Union. Directive (EU) 2024/1385 requires member states to make it a criminal offence to make a person's personal data publicly accessible online, without consent, for the purpose of inciting others to cause physical or serious psychological harm. Member states have until 14 June 2027 to bring this into national law, so what applies today depends on the country. See EU privacy law.
• Canada. The Criminal Code has no doxxing section. Section 264, criminal harassment, covers conduct such as repeated communication, watching a person's home or workplace, and threatening conduct, where the person intends to harass or is reckless about it and the conduct could reasonably be expected to make the target believe their safety, or someone else's, is threatened. On indictment the maximum is ten years' imprisonment.

Doxxers rarely find anything secret. CISA lists social media posts, property and court records, wedding announcements, web forums and voter registration lists among common sources. The FTC says people-search reports can include your addresses, phone numbers and the names and locations of family members, and that you can opt out one site at a time for free.

1. 1.Search your own name, phone number and address while logged out of Google, and note where each detail appears. PEN America recommends this as the first step.
2. 2.Opt out of the people-search sites that show you, using the data broker checklist and the guide to removing your address from the internet. The FTC warns that your information can reappear when public records change, so set a reminder to check again.
3. 3.Remove your home address, personal phone number and family details from your own profiles, bios and CVs. CISA's advice includes removing personal identifiers from social media profiles.
4. 4.Ask your employer, university or clubs not to publish your contact details in online directories, as PEN America suggests.

Doxxing often comes in waves: a post is removed and reposted, or picked up on a second platform. Treat each repost as a new report with its own evidence, and add it to your log. A pattern matters legally: the UK, Canadian and US offences above all turn on repeated conduct.

Set up alerts so you learn about a repost early. Google's Results about you can notify you when your contact details appear in Search, and PEN America suggests search alerts for your name, phone number and address. Check people-search sites again after a few months, because the FTC notes that opted-out information can be listed again. If the person doxxing you is a current or former partner, the same steps apply; eSafety describes doxxing after a relationship breakdown as a form of coercive control. See domestic violence survivors.