What to do if you are doxxed: a response plan

If you are doxxed, do four things in this order: judge whether anyone is in danger, capture evidence of what was posted and where, lock the accounts and numbers that the exposed details could open, and then report the posts to each platform and the pages to search engines. Contact the police at once if there is a threat, and do not reply to the person who posted.

Doxxing means publishing someone's private details, usually a home address, phone number, workplace, family members or account information, in order to cause harm. Google's own help page describes it as people sharing your private information to harm you. The harm comes in two forms. One is physical and immediate: unwanted visitors, deliveries, threats or hoax calls. The other is slow: the details sit in forum threads, scraped listings and search results for months. A good response treats them as two different problems with two different clocks.

This guide is written for the person who has been targeted, or for someone helping them. It explains the order of operations, a decision table for what was exposed, a realistic timeline and the mistakes that make things worse. Policies are described as of the pages read for this article. This is information, not legal advice.

The short version

Start with safety, not takedowns. If there is a threat or someone knows where you live and means harm, call the police first and sort the internet second.
Capture evidence before you report anything. Reported posts vanish, and without a record you cannot prove a pattern to a platform, a lawyer or an officer.
Secure your accounts and your phone number before you chase the posts. Exposed details are often used for password resets and carrier fraud.
Report in layers: the platform where it was posted, then the search engine, then the host or data broker that republishes it. Removal from search does not remove the page.
Do not engage, do not retaliate and do not publish the details again when you ask others to help.

The first hour: decide how much danger you are in

The first question is not "how do I delete this" but "can someone reach me because of it". Your answer sets the order of everything else.

Sort the situation into three levels. At the lowest level, the details are exposed but there is no threat, contact or sign that anyone is acting on them. In the middle, there is unwanted contact: calls, messages, deliveries you did not order, strangers arriving at your workplace, or an account takeover attempt. At the top, there is an explicit or implied threat, or any sign that someone is travelling to you or to a family member.

If you are at the top level, or if anyone is in immediate danger, contact emergency services. The FBI's Internet Crime Complaint Center states the same rule on its home page: if someone is in immediate danger, call 911 or your local police. Outside the United States, use your local emergency number. Do this before you start reporting posts.

Then protect the people around you. Tell the other adults in your household what happened and what to do if a stranger comes to the door. If a child is named, tell the school. If your workplace is exposed, tell your manager or security team the same day. One factual line is enough: what was posted, that you are handling it, and whom to alert if someone asks for you. A friend or partner can take over evidence capture and the forms while you stay offline.

Preserve evidence before anything disappears

Capture first, report second. Once a platform removes a post, its URL may show an error page, the account may be suspended, and the proof of what was published and when is gone. A record also turns scattered abuse into a pattern that a reviewer, an officer or a lawyer can act on.

The US government's anti-bullying site gives the basic rule: keep a log of each incident with when it happened and what occurred, and keep copies of screenshots, emails and text messages. It also advises not responding to or forwarding the abusive messages, and blocking the person. The evidence itself contains your private details, so treat the folder as sensitive.

How to capture evidence without spreading it

Create one private folderUse storage only you and your helper can open, with two-step sign-in on the account that holds it.
Capture the full page, not a cropTake a screenshot that shows the post, the username, the date and time, and the web address in the browser bar. Add a second screenshot of the account profile that posted it.
Save the address of every copyPaste each URL into a plain text log with the date and time you saw it and the platform name.
Record contact separatelyScreenshot call logs, messages, emails, unexpected orders and deliveries, and write down the time of each.
Save the threat language exactlyIf a post or message threatens you or your family, capture it in full, noting any place, time or person it names.
Keep the log currentAdd a line every time something new appears, including when you reported it and what the platform answered. Never edit earlier entries.

Lock down the accounts and numbers that the exposed details could open

Exposed details are not only a risk to your safety. They are raw material for account takeover, so securing accounts is the second job, ahead of most takedown work. Do it in the first day, in this order.

Start with email, because every other account can reset its password through it. Change the password to a long, unique one that you use nowhere else, and turn on two-step verification. Google's help page explains that when you create a passkey on a security key, you bypass the second authentication step, because the passkey verifies that you hold your device. If your provider offers passkeys or a hardware security key, consider them in place of a code sent by text.

Next, contact your mobile carrier. Ask them to add a PIN or passcode to your account and to note that no one may change the SIM or port the number without it. A phone number that someone else can move to a new SIM can unlock many accounts that use text codes.

After that, work through your financial accounts: banks, cards, payment apps and any exchange or wallet service. Turn on alerts for sign-ins and transactions, and set a call-back word if the provider offers one. If your name, date of birth or national ID number was exposed, consider a credit freeze. The US Federal Trade Commission says a credit freeze is free, blocks anyone from opening new credit in your name until you lift it, and is placed by contacting all three bureaus: Equifax, Experian and TransUnion. A fraud alert is a lighter option: an initial alert lasts one year, and the FTC says you place it with one bureau, which must notify the other two.

What was exposed decides what you do first

Different details call for different first moves. Use the table to pick the first action for each type of exposure.

What was exposed	First move	Main route to removal	Watch for
Home address	Tell household and neighbors you trust, alert local police if there is any contact or threat	Platform report, search request, broker opt-out	Unwanted visitors, unordered deliveries, hoax calls
Phone number	Carrier PIN, block and log callers	Platform report, search request, broker opt-out	Mass calls, SIM change attempts, text code requests
Email address	Change password, two-step sign-in, check recovery options	Platform report, search request	Reset emails you did not request, phishing aimed at you
Employer or workplace	Tell your manager or security team the same day	Platform report, request to the host	Complaints to your employer, calls to reception
Family members or children	Tell the school and the adults involved, restrict their accounts	Platform report with their guardian, search request	Contact with children, messages to relatives
ID or financial numbers	Credit freeze, alerts, contact the bank or card issuer	Search request for confidential ID numbers, platform report	New credit applications, unfamiliar transactions
Passwords or logins	Change them everywhere reused, turn on two-step sign-in	Platform report, search request	Sign-in alerts from new places
Private photos or media	Capture evidence, report as private media	Platform report by the person shown or a representative	Reposting on new accounts

Report to platforms: what works and what stalls

Platform reports are the fastest route to removing a specific post, and where most people lose time to avoidable rejections. Platforms draw the line on private information in different places, so read the current rule of the platform you are reporting to before you file. X's policy is described below as an example.

Know the line before you file. X's private information policy prohibits sharing home addresses and physical location details, government IDs, non-public phone numbers and email addresses, passwords, financial account details and health information. It also prohibits threatening to expose private information, and offering or asking for payment to post, or not to post, someone's private information. It excludes information that is publicly available elsewhere if it is shared in a non-abusive way, and it says names, workplaces, schools and rumors or allegations are not covered by the private information rule. The practical result is that a post saying only "this person works at this company" may not qualify, while a post with your home address and a call to turn up at it probably does. X also says that home addresses may still be actioned even when they are public, because of the risk of physical harm.

Know who may file. The X policy says anyone can use its dedicated flow when information is shared in a clearly abusive way, but otherwise X may need to hear from the person the information belongs to, or from an authorized representative such as a lawyer. For private media, it requires a first-person report from the person depicted or a representative such as a parent or legal guardian. If a friend's report is rejected, the fix is often that you or your lawyer have to file it.

Expect three outcomes: removal, a reply that the content does not break the rule, or silence. If the answer is a denial, read the reason and check it against the rule. If the reason is "publicly available", explain that the post aggregates details into one place to target you. If you hear nothing within a few days, file again with the earlier reference number, and escalate through any safety, legal or law enforcement route the platform offers.

The UK's Report Harmful Content service says that if you or the person you are helping is in immediate danger, you should call the police on 999. Meta's, Reddit's and Bing's pages could not be read for this guide, so check each platform's current rules before you file.

Ask search engines to stop showing the pages

Removing the post is one half. The other half is stopping search engines from sending people to it, and from showing copies. Search removal can be faster than source removal, and it helps even when the source will not move.

On Google, the policy covers doxxing explicitly. Google's help page says it may remove a URL that contains your personal information along with explicit or implicit threats against you, or a significant amount of aggregated personal information without a legitimate purpose. It adds that that content about something important or newsworthy, such as the news, may stay up, and that only the URLs you submit are reviewed. It also says plainly that Google can only remove things from Google Search results. The page itself stays where it is, and Google says that hosting-site removal means contacting the site owner.

There are two entry points. The Results about you tool monitors Search for the details you enter, such as a home address, phone number and email address, and also nicknames, a maiden name and government ID numbers. Google says that after setup you get an alert within a few hours saying whether results matched, matches appear under a To review tab, and you can request removal of one result at a time. Approved results may take a while to disappear, and Google says you can check within a few hours of approval. Some removals are query-based, so the URL is hidden only for searches that include your name. Results from government, educational and newspaper sites, and business sites of that kind, generally do not offer a removal option. For anything it does not handle, and for requests made on behalf of someone else, Google points to the detailed removal request form.

Request removal of each URL: the original post, any copy or mirror, and any aggregator page that lists your details. If the request is denied, check whether the page really contains the details you named and whether it shows a threat or a large amount of aggregated information, which are the grounds Google lists. Then file again with a clearer description, or with more detail about the threat.

Go after the source: hosts, forums and data brokers

If the post stays up, go to whoever hosts it. Every website sits on a hosting provider, and many sit behind a content delivery service. A hosting provider usually has an abuse contact and a policy against harassment and private information, and it is often more responsive than a small forum owner who ignores email.

Cloudflare is a common example. Its abuse page explains that for most reports it does not host the content: it forwards the complaint to the website operator and the hosting provider, and for some complaint categories the reporter can ask it not to forward the complaint to the website operator. The page does not say which categories qualify. When you write to a host, give the URL, the rule it breaks, the evidence that it is your information, and any threat language. Keep it short and do not repeat the exposed details in the message.

Then deal with the data broker layer. Many doxxing posts are assembled from people-search and data broker listings that already hold your address and phone number, and those listings are republished long after the original post is gone. Each broker has its own opt-out process, and the work is repetitive: find each listing, submit the request, confirm it, and check again after a few weeks. Without this step the same details keep re-entering the web, so start with the listings that show your current address and phone number.

When and how to contact the police

Contact the police for any threat, any stalking behavior, any attempt to get to you or your family, and any case where the doxxing is part of a campaign of harassment. The US anti-bullying site says that cyberbullying involving threats of violence, stalking and hate crimes, or taking a photo or video of someone where they would expect privacy, is a crime that should be reported to law enforcement, and notes that some states consider other forms criminal too. Laws on doxxing and harassment differ by country and by state, and a report is useful even where there is no offense named "doxxing", because the underlying conduct may be harassment, stalking, threats or fraud.

Prepare before you call. Bring the evidence folder, a one-page timeline in plain facts and a list of who has been told. Ask for a report number and the name of the officer. If the officer says it is a civil matter, ask them to record the report anyway.

For online crime in the United States, the FBI's Internet Crime Complaint Center takes complaints about cyber-enabled crime, and its home page says you can file even if you are unsure whether the issue qualifies. If a child is being exploited online, the National Center for Missing and Exploited Children runs the CyberTipline for those reports.

A realistic timeline and an invented scenario

The first day is about safety and evidence, the first week is about reports and search, and the following months are about brokers and watching. The timeline below is typical of experience, not a promise: platforms reply on their own schedules.

Doxxing response timeline

Hour 0 to 1Judge the danger, call emergency services if anyone is at risk, warn household, school and workplace, and hand evidence capture to a helper if you can.
Hours 1 to 24Capture every page and message, secure email, carrier and financial accounts, and file the first platform reports for the most serious posts.
Days 2 to 3Submit search removal requests for each URL, set up Results about you, and file a police report if there was any threat or contact.
Days 4 to 14Chase unanswered reports, write to hosts for pages that remain, and start data broker opt-outs, beginning with the listings that show your current address.
Weeks 3 to 6Appeal denials with better evidence, check search results for your name and the exposed details, and update the police with anything new.
Months 2 to 3Re-check brokers and search for reposting, keep the log current, and decide with your lawyer whether any formal step is warranted.

To see how the order plays out, take an invented scenario with generic parties. A product manager has her home address, phone number and employer posted in a forum thread after a heated argument. Two days later a stranger rings her doorbell asking for a name she does not recognize, and three delivery notices arrive for items she did not order.

She does not reply in the thread. Her partner takes over capture: screenshots of the thread and the poster's profile, a log of the deliveries, the URLs in a text file. She changes her email password, adds a passkey and calls her carrier to add a PIN. On day two she reports the thread to the moderators and the host under the forum's private information rule. On day three she files search removal requests for the thread and two mirror pages, sets up Results about you, and reports the visit and deliveries to her local police. The moderator removes the thread within days; the mirrors move only after the host is contacted. Over the following weeks she opts out of the broker listings that show her address and checks results for her name.

Mistakes that make a doxxing worse

Much of the damage after the first post comes from what the target does next. These mistakes are avoidable.

Replying to the poster gives the thread a new reason to grow, and it hands the poster a screenshot to use against you. Block, log and move on.

Retaliating is dangerous and unlawful in many places. Publishing details about the person who targeted you, or asking others to find them, repeats the harm and can turn you from victim into defendant. Do not hire anyone to do it, and decline offers from helpful strangers to investigate.

Repeating the details in a public statement spreads them again. Write that your home address was shared without consent and has been reported, without giving it. Do not pay anyone who offers to take a post down or demands money to keep quiet: X's policy treats requesting payment to post or withhold private information as a violation in itself.

Some routes will fail. If the information is public elsewhere and shared without a threat, a platform may decline to act. If the page belongs to a government, school or news site, Results about you generally offers no removal option. If the host ignores reports, a lawyer can advise on formal routes such as a court order. In those cases the goal shifts from deletion to containment: strengthen your accounts, narrow what a visitor could use, and keep watching.

Your next step: one day, three actions

If this is happening now, do these three things today: warn the people near you, capture the evidence in one private folder, and secure your email and carrier account. Everything else can follow in the order above.

If this is happening to you now

If the exposure is spreading fast, tied to a wider campaign against you or aimed at a public role, a crisis desk can take the reporting, search requests and monitoring off your hands while you stay safe. Reputation Partners can start from a private conversation about what was posted and where. See how the crisis desk works.

Questions people ask

Is doxxing illegal?

It depends on the country, the state and what was done with the information. Many places have no offense called doxxing, but the conduct can fall under harassment, stalking, threats, fraud or privacy laws. Police can tell you what applies where you live, and a lawyer can explain civil options. A report is worth making even if the word does not appear in a statute.

Can I find out who doxxed me?

Do not try to unmask the poster yourself, and do not pay anyone who offers to. Amateur investigation can wrongly accuse someone and can break the law. Give police, the platform and your lawyer the evidence instead. Where a court process exists in your country to require a platform to disclose an account holder, a lawyer is the right person to advise.

How long does it take to get doxxed information removed?

Platform reports can take hours or days, and some are never answered. Search removals are often quicker than source removals, and Google says you can check within a few hours of an approval. Data broker listings can take weeks and return. Plan for months of checking, not a single afternoon, and do not treat a first removal as the end.

Should I delete my social media accounts?

Not in the first hours. Deleting accounts can destroy evidence and does not remove what others posted. Lock them down instead: change passwords, turn on two-step sign-in, remove public contact details and tighten privacy settings. Once you have your evidence and the situation is stable, you can decide what to close or make private.