Safety & harassment
When your personal information is posted online
Doxxing in practical terms: what to do in the first hour, how to get an address or phone number removed from platforms and search results, and how to reduce the exposure that made it possible.
Having your home address, phone number, workplace, or family details posted publicly is frightening in a specific way: the threat stops being confined to a screen. This guide is about what to do, in what order, and what is realistically achievable.
Two things are worth saying at the start. First, most of the information used in these posts was not stolen — it was assembled from places where it was already available. Second, that means removal is often genuinely possible, and it is worth doing even when it feels like the internet never forgets.
The first hour
Work in this order. The sequence matters, because evidence disappears and momentum builds fast.
1. Capture evidence before anything else. Screenshot the posts, including the account handle, the timestamp, and the URL in the address bar. Save the page addresses in a plain text file with the date and time you saw them. If the material is removed later — by the platform or by the poster covering their tracks — this record is the only thing that supports a police report or a legal request.
2. Do not respond. Engagement is the fuel. A reply confirms that the target is watching, and it is frequently screenshotted and used to restart the cycle.
3. Report it as the specific violation it is. Every major platform prohibits publishing private information. Use that category — not "harassment" generally, and not "spam". The category determines which review queue it lands in and which policy the reviewer applies.
4. Lock down the accounts that matter now. Not because you did anything wrong, but because publication is frequently followed by account-takeover attempts. Change the password on your email, confirm your second factor is active, and check for unfamiliar forwarding rules or recovery addresses. The steps are in Securing your email account.
5. Tell someone. A friend, a partner, a colleague. Handling this alone while adrenaline is high leads to worse decisions and, more importantly, means nobody else knows to be careful.
Assessing actual risk, calmly
Not everything posted carries the same weight, and treating all of it as maximum severity burns energy you will need.
Ask three questions:
- Is it accurate? Inaccurate information can still cause harm — misdirected harassment lands on whoever lives at the wrong address — but it changes what you ask for and who you warn.
- Is it actionable? A city of residence is a different category from a street address, a door code, a workplace shift pattern, or a child's school.
- Is it accompanied by encouragement? Information plus an invitation to act is a materially more serious situation, and is the point at which police involvement stops being optional.
If a physical address is published alongside anything resembling a call to action, or if there are explicit threats, contact local police. Bring your documentation. Ask for the report number and keep it.
Getting it taken down
Removal happens on three separate fronts, and they need to be worked in parallel because each takes different amounts of time.
The platform hosting it. Report it, and if you can, have others report it too — not as a brigade, but because independent reports raise the priority of a queue item on most systems. If the first report is rejected, appeal, and in the appeal state plainly which specific piece of private information is published and why it puts you at physical risk. Reviewers work from policy language; give them the language.
Search engines. This is the step people skip, and it is often the highest-leverage one. Major search engines operate removal processes for pages that expose personal contact details, particularly where there is a risk of harm. Removal from search does not delete the page, but it drastically reduces who ever finds it. If the underlying page is deleted but still appears in results, there are separate tools for clearing outdated cached entries.
Data brokers. If your address surfaced through a people-search site, note that many of these companies feed one another, and removal is per-company and often needs repeating after a few months. Work through the largest ones first. It is tedious. It also works, and it removes the source the next person will use.
Reducing exposure afterwards
Once the immediate situation is contained, close the gaps that made the compilation easy. Most of this information came from somewhere predictable:
- Domain registrations — a personal domain registered without privacy protection publishes a name, address, and phone number.
- Business and company registries — often unavoidable and legally required, but many jurisdictions permit a service address instead of a home address.
- Old accounts and forums — profiles created years ago, frequently with a real name attached to a username still in use.
- Photo backgrounds — house numbers, street signs, school uniforms, vehicle plates, and the view from a window.
- Friend and follower lists — used to identify family, and then to reach you through them.
- Public posts about routine — the gym at the same time, the same café, the commute.
You do not need to erase yourself. The goal is to make casual compilation expensive rather than trivial. A structured way to work through this once a year is in Run an annual privacy audit.
The people around you
Two groups deserve a direct warning.
Household members, because a published address is their address too, and because they may receive contact intended for you. Agree in advance what happens if someone unknown arrives or calls: nobody confirms anything, nobody engages, everything is documented.
Whoever handles your workplace's front desk or inbox, if your employer has been named. Organisations handle this much better when told in advance than when a call arrives cold.
Expectations, honestly
Some of this material will not come down. Sites hosted in jurisdictions that ignore requests, screenshots re-posted by people you cannot identify, archives — these exist and pretending otherwise helps nobody.
What is achievable is meaningful anyway: removing it from the platforms most people actually use, removing it from search results where most people actually look, and cutting off the data-broker sources that make the next compilation easy. That combination takes a situation that felt limitless and makes it finite.
The residual anxiety is real and lasts longer than the posts do. Sustained harassment is a documented cause of genuine psychological harm, and treating it as something to simply absorb is bad advice. If it is affecting your sleep, your work, or your willingness to leave the house, that is a reason to talk to someone qualified — not an overreaction.