How to Avoid Getting Doxxed Online

In October 2024, two Harvard students put on a pair of Meta's Ray-Ban smart glasses and started looking at strangers. The glasses livestreamed what they saw, software spotted each face, a face search engine matched it to photos online, an AI model worked out the person's name, and a people-search site filled in the rest. Moments later, an app on the students' phones showed the stranger's home address, phone number and the names of their relatives. They called the project I-XRAY and chose not to release the code.

Nothing in that chain was hacked. Every component was an off-the-shelf service, and the students only wrote the glue between them. That's the uncomfortable truth about doxxing now: it rarely takes skill. It takes a few cheap tools, a username you've used for a decade, or a photo with your street in the background.

This guide covers what doxxing is, how many people it hits, where the information comes from, and the steps that actually reduce your digital footprint, from data broker opt-outs to keeping an anonymous account genuinely separate. It ends with what to do if it has already happened to you.

What is doxxing?#

Doxxing (also spelled doxing) is publishing someone's private or identifying information, such as their home address, phone number, workplace or family members, without their consent, usually to intimidate, harass or expose them. The name comes from "dropping docs" on someone.

Most doxxes aren't the product of a hack. They're assembled. A username leads to an old forum profile, the forum profile leads to a real name, and a people-search site turns the name into an address and a list of relatives. Each piece may be public on its own. The harm comes from joining them up and handing the result to people who are angry with you.

That's why the law usually turns on intent. When the Netherlands made doxxing a crime in 2024, it defined the offence as sharing someone's identifying data in order to intimidate them. Looking up an address isn't doxxing. Publishing it so that others can turn up there is.

How common is doxxing? The numbers#

About one in 25 American adults says they have been doxxed, and far more know someone who has. These are the most useful recent figures:

The real numbers are almost certainly higher. SafeHome found that only a very small number of victims went to the police, and plenty of people never learn that a file on them is circulating. The same survey shows what it costs: victims described anxiety and sleepless nights, in some cases ending in hospital, fraud using the leaked details, employers being contacted and jobs lost, and strangers turning up at their homes.

It isn't only public figures, either. SafeHome's victims most often traced their doxxing back to an online argument, in gaming, fandoms or politics, or to a personal dispute with an ex or a coworker. When the Dutch government criminalised doxxing, it said police officers, journalists, politicians and aid workers are hit most often, but that anyone can become a victim.

Where do doxxers get your information?#

Rarely from one place. A dox file is usually stitched together from several sources, each fairly harmless on its own:

What AI changed#

Each step in that table used to take a patient human a few hours. Now each one can be automated:

• Faces to names. I-XRAY chained a public face search engine (PimEyes), an AI model and a free people-search site. Anyone can sign up for all three.
• Photos to places. When OpenAI released its o3 and o4-mini models in April 2025, people found they could zoom into a blurry photo and name the street, bar or building in it. TechCrunch's tests found the models often didn't use the photo's location metadata at all, so stripping metadata is no longer enough on its own.
• Pseudonyms to people. A February 2026 study, with ETH Zurich researchers among its authors, showed AI agents re-identifying anonymous Hacker News and Reddit users from what they had posted, in minutes per person rather than the hours a human investigator would need. Its matching pipeline linked up to 68% of accounts at 90% precision, where the best older method managed close to none. The authors conclude that the "practical obscurity" pseudonymous users relied on no longer holds.

The lesson is that you can't count on any single detail staying hidden. You lower your risk by removing as many pieces as you can and breaking the links between the ones that remain.

How to check your digital footprint#

Search for yourself the way a stranger would. It takes about half an hour and shows you what to fix first.

1) Search your name, email, phone number and usernames#

Put each one in quotes in Google: your full name with your town, your personal email address, your phone number written a couple of different ways, and every username you use. Look past the first page, check the Images tab, and note every people-search listing, old profile and forum post that comes up.

2) Check which breaches you're in#

Enter each email address you use at Have I Been Pwned and sign up for its free alerts. The results show which old accounts still exist, what leaked with them, such as phone numbers, addresses or passwords, and which passwords need changing.

3) Reverse-search your profile photos#

Run your main profile pictures through Google Lens. If the same photo appears on an account you'd rather keep separate, that's a link anyone else can follow too. Face search engines go further, matching faces rather than files, and PimEyes lets anyone run a limited search for free.

4) Write it all down#

Keep a simple list: the site, what it shows, the removal link and the date you asked. That list is your to-do list for the next section, and you'll use it again when you check back in six months.

How to avoid getting doxxed: 8 steps to reduce your digital footprint#

Take your home address out of the places that sell it, cut the links between your accounts, and stop leaking your location in what you post. In rough order of impact:

1) Opt out of people-search sites and data brokers#

This is the biggest single win, because these sites turn a name into an address in seconds.

Do the big ones yourself. In a 2024 Consumer Reports study, manual opt-outs removed 70% of listings within a week. Seven paid removal services managed between 0% and 58.7% in the same week, and only 35% of listings overall after four months. The best of them, Optery and EasyOptOuts, reached 68% and 65% after four months; the worst managed 4% and 6%. If you pay for a service, still check the results yourself.

In California, use DROP. The state's free Delete Request and Opt-out Platform sends a single deletion request to every registered data broker, more than 600 of them. Since 1 August 2026, brokers have had to collect and process new requests at least every 45 days, and Californians had filed more than 345,000 requests by early August. Oregon, Texas and Vermont also keep broker registries, but there you still contact each broker yourself.

In the EU and UK, use your GDPR rights. Article 17 of the GDPR, and the UK's version of it, lets you ask a company holding your data, including data brokers and directory sites, to erase it, and it normally has one month to respond. UK residents should also opt out of the open register, the version of the electoral roll that anyone can buy. Opting out doesn't affect your right to vote.

2) Get your details out of Google#

Removing a page from Google doesn't delete it, but it stops most people from ever finding it. In the US, Google's free Results about you tool watches Search for your phone number, email and home address, and since February 2026 your passport, driving licence and Social Security numbers too, then lets you request removal. Where that tool isn't available, Google's personal information removal form does the same job by hand, and it explicitly covers doxxing: personal details shared to harass or harm you.

3) Split your identities: email aliases and a second number#

Your email address and phone number are the keys that join your accounts together, so stop handing out the real ones.

• Email aliases. Apple's Hide My Email (part of iCloud+), Firefox Relay, SimpleLogin and DuckDuckGo Email Protection give you a separate forwarding address for every site. When a shop gets breached, it leaks an alias, not the address your bank and friends use.
• A second phone number. A cheap second SIM or eSIM for deliveries, sign-ups and marketplace listings keeps your main number off data broker lists.
• A carrier PIN. Your main number is also how attackers hijack accounts through SIM swapping. Ask your mobile carrier for a PIN or port-out lock so nobody can move your number to their own SIM.

4) Lock down social media and contact discovery#

• Go private on accounts that don't need to be public, and hide your friend and follower lists, which are often how doxxers find your family.
• Remove the anchors: employer, school, hometown, birthday and photos of the outside of your home.
• Turn off "find me by phone number or email". Facebook, LinkedIn and Telegram all have a version of this in their privacy settings.
• Delete what you no longer use. Old forum profiles, abandoned blogs and dormant accounts are free research material. If a site won't delete an account, change the username, photo and bio to something meaningless first.
• Make payment apps private. Venmo payments and friend lists can be public; set both to private.

5) Stop leaking your location in photos and apps#

• Turn off location tagging in your camera. On an iPhone: Settings, Privacy & Security, Location Services, Camera, Never. On Android, look for "location tags" or "save location" in the camera app's settings; the name varies by manufacturer. Our iPhone and Android hardening guides cover the rest of your location permissions.
• Strip it when you share. On an iPhone, tap Options at the top of the share sheet and turn off Location.
• Check the frame, not just the file. House numbers, street signs, the view from your window, your number plate and a child's school logo all give away where you are, and AI models read those clues well.
• Post after you've left, not while you're still there.
• Review live location sharing. Check who can see you in Find My, Google Maps location sharing, Life360 and Snap Map, where Ghost Mode hides you. On Strava and similar apps, hide the start and end of your activities (Strava calls this Map Visibility) and limit activities to followers.

6) Use different usernames and profile photos#

A reused username is the easiest link of all: search it and every account appears. A reused profile photo does the same through image and face search. Give accounts you want kept apart different names and different pictures, and for anything sensitive, no photo of your face at all. PimEyes has a free opt-out form, though it asks for a photo and an ID with the details blanked out, and it only hides you from PimEyes' own results.

7) Keep your home address off the record#

• Use a parcel locker, PO box or pickup point for deliveries and marketplace sales.
• If you run a business, use a registered office or virtual office address on company filings where the rules allow it.
• If you own a domain, turn on WHOIS privacy and don't register it to your home address.
• Leave your street address off your CV and LinkedIn. A city is enough.

8) Secure the accounts that hold your private life#

Someone who gets into your email or cloud storage doesn't need a data broker: your messages, photos and documents are all there. Use passkeys or a hardware security key wherever they're offered, an authenticator app where they aren't (strong, though not phishing-resistant), and avoid relying on SMS codes. Our password and passkey guide walks through the setup. And set that carrier PIN from step 3, because SIM swapping is how a lot of email takeovers start.

How to stay anonymous online#

If you post under a pseudonym, assume it can be tied back to you the moment it shares a single detail with your real identity, and after the 2026 study above, that includes how you write. To keep an anonymous account genuinely separate:

• Build it from scratch: a new email alias that isn't connected to your main account, no phone number if the platform allows it, and a separate browser or browser profile.
• Never reuse anything: usernames, avatars, photos, bios, links or recovery details.
• Watch the small clues: your job, your city, your children's ages, local events, the weather and the hours you post. Combining exactly these clues is what the AI agents in that study did.
• Hide your IP address. A VPN stops sites from seeing your real IP address, which can give away your city, and Tor Browser goes further. Our private browser ranking covers both.
• Never log into your real accounts in the same browser session.

Be realistic about the limits. These steps raise the cost of unmasking you a long way, but nobody can promise perfect anonymity against someone determined, well resourced and patient.

What to do if you've been doxxed#

Get safe, save the evidence, report it, then lock things down. Do it in that order: posts get deleted, and you'll need the evidence for every report.

1) If you feel in danger, call the police first#

If there are threats, or someone has turned up at your home, contact the police straight away. Everything else can wait.

2) Save the evidence#

Screenshot every post with the address bar, date and username visible, and save each page as a PDF. Keep the copies on your own device rather than on public archive sites, which would keep the information online. Don't reply to the people sharing it.

3) Report it to the platform and to Google#

Most major platforms ban posting someone's private information. Report every post, then use Google's removal form and tell it the information is being shared to harass you, so the pages drop out of search.

4) Lock down your accounts#

Sign out of all sessions on your email and social accounts, change the passwords, switch to passkeys and set a carrier PIN if you haven't already. If your phone number or email address was posted, consider replacing them and moving important accounts across.

5) Warn the people around you#

Tell your family, close friends and, if your workplace was named, your employer. Doxxers often contact relatives and employers next, or impersonate you to them.

6) Use the law where it helps#

Doxxing is a specific crime in the Netherlands, France and Australia, and harassment, stalking and threat laws apply almost everywhere else. In the EU and UK you can also send erasure requests to sites hosting your data. SafeHome found that very few victims ever go to the police; if the posts came with threats, report them.

Is doxxing illegal?#

As of October 2026, it is in a growing number of countries. Elsewhere it's usually prosecuted through harassment, stalking or threat laws rather than as doxxing itself.

The EU has no bloc-wide doxxing law, so it's down to each member state, but GDPR erasure rights apply in every one of them.

Summary#

1. Doxxing is assembly, not hacking. It joins up scraps that are public one by one: an old username, a people-search listing, a photo with your street in it.
2. It's common and getting easier. About 4% of US adults say they've been doxxed, only 22% would know what to do, and AI now automates face matching, photo geolocation and unmasking pseudonyms.
3. Start with data brokers. Manual opt-outs removed 70% of listings within a week in Consumer Reports' test. Californians can use DROP; people in the EU and UK can send GDPR erasure requests.
4. Take your details out of Google with Results about you or Google's removal form.
5. Break the links between your accounts: email aliases, a second number, and different usernames and profile photos.
6. Stop leaking your location: camera location off, check what's in the frame, and lock down Strava and live location sharing.
7. Secure the accounts that hold your private life with passkeys and a carrier PIN.
8. If it happens: get safe, save the evidence, report it to the platform and Google, lock down your accounts, and use the law where it applies.

---

Worried about what someone could piece together about your business and the people who run it? Get in touch - bluwarden's security consulting can review what your organisation and its leadership expose publicly, and help you close the gaps before someone else maps them.

This article is general privacy guidance, not legal advice. Doxxing laws and removal tools differ between countries and change often, so check what applies where you live with the relevant authority or a qualified adviser.