What to do if someone doxxed you
You found your home address, phone number, workplace, or private details posted somewhere public, next to a name that is unmistakably yours. Maybe it landed in a comment thread, a forum, a group chat, or a whole account set up to expose you. Whatever set it off, the feeling is the same: your private life is suddenly out in the open, and you do not know who has seen it or what they will do with it. That is a frightening place to be, and wanting to make it stop right now is completely understandable.
Being doxxed is not something you brought on yourself, and it does not mean you were careless with your information. Much of what gets posted is scraped from public records and data-broker sites that resell it whether you agreed or not. The useful thing to do now is work through this in an order that protects your safety first, then gets the content down, then puts it on record. Here is where to start.
If you feel unsafe right now
If the post includes a threat, names where you live or work, or is paired with anything that makes you fear for your physical safety, treat that as the priority before anything online. Contact your local emergency number if a threat feels immediate. If you can, tell a trusted person nearby what is happening so you are not managing it alone, and consider staying somewhere else for a night or two if your address was published and you are frightened. The internet cleanup can wait an hour. Your safety cannot.
Lock down your accounts before they follow the trail
Doxxing is often the opening move, not the whole attack. Once someone has your details, they may try to get into your email, social media, or bank, or use what they posted to convince others they are you. Change the password on your email first, since it is the key to resetting everything else, then your most important accounts, and turn on two-factor authentication everywhere it is offered. If any financial account or your Social Security number was exposed, our guide on what to do if someone opened accounts in your name walks through freezing your credit and watching for fraud, which is worth doing even as a precaution.
Save the evidence before it disappears
Before you report anything or ask for it to be taken down, capture it. Screenshots that show the post, the account that made it, the URL, and the date and time give you a record that survives even after the platform removes the content or the poster deletes it. That record is what a platform, a lawyer, or the police will ask for later. Our guide on how to preserve evidence in the first 24 hours covers what to capture and how to do it so it holds up. Do this step even if you are certain you will never need it, because the moment to collect it is now, while it is still up.
Get the information taken down
Report the post to the platform it appeared on. Most sites treat publishing someone’s private information without consent as a policy violation, and their reporting flows usually have a category for exposing personal or contact details. Point to the specific content and the exact detail that is private.
For the search results themselves, Google offers a “Results about you” tool, found under Data & Privacy in your Google account, that lets you request removal of results showing your home address, phone number, or email. Google will also remove results that expose things like government ID numbers, bank or card numbers, and content clearly meant to enable doxxing, even without the tool.
A lot of what gets reposted originally comes from people-search and data-broker sites like Whitepages, Spokeo, BeenVerified, Radaris, and MyLife. Each has an opt-out page where you can ask to be removed, and doing so shrinks the supply of information an abuser can keep pulling from. Be patient here: brokers re-aggregate records constantly, so an entry you remove can reappear weeks later, and this becomes a thing you check on periodically rather than fix once.
Report it, especially if there are threats
File a report with the FTC at ReportFraud.ftc.gov, and if any identifying numbers were exposed, use IdentityTheft.gov to build a recovery plan. If the doxxing came with threats, extortion, or a pattern of harassment, report it to the FBI’s IC3 at ic3.gov and to your local police, and bring the evidence you saved. Many states have specific laws against cyber-harassment and publishing private information with intent to harm, so a police report is worth filing even if it feels like nothing will come of it immediately; it creates the official record that later steps depend on.
If private or intimate images were shared
When doxxing is paired with private photos, or someone is threatening to release them, there are tools built specifically for that. StopNCII.org lets you create a digital fingerprint of an image so participating platforms can block it from being posted, without you ever uploading the picture itself. Our guide on what to do when someone threatens to share your private photos covers this in full, including why paying an extortionist almost never makes the threat go away.
Give it a little time, and don’t go it alone
Doxxing tends to feel loudest in the first day or two and then quiets down, especially once the original post is removed and the accounts amplifying it lose interest. Be wary, in the meantime, of anyone who contacts you promising to scrub your name from the internet for an upfront fee; reputable removal is either something you do yourself through the steps above or something a vetted professional does transparently, never a stranger who appears the moment you are most rattled. If it becomes more than you can manage on your own, that is exactly the kind of thing we are here to help with.
None of this is your fault, and you do not have to sort it all out in one sitting. Protect your safety, secure your accounts, save what is posted, and start the takedowns. Working through it in that order is how the situation goes from overwhelming to handled.
— Gus