What Is Doxxing, and How to Protect Yourself

Doxxing is the deliberate act of digging up and publicly posting someone's private personal information without their consent, usually to harass, intimidate, or frighten them. The unsettling part is that most doxxers do not hack anyone. They assemble a target from information that is already out there, and the single richest source is data broker and people-search sites. That is also the good news, because it means the strongest defense is one you can act on: remove the public listings that hand doxxers your name, address, and phone number on a plate.

How does doxxing actually work?

By aggregation. A doxxer cross-references several sources to piece together and confirm your identity, then publishes the result. Those sources typically include data broker and people-search databases, public records, social media profiles, domain registration records, and data from past breaches. Individually, each scrap might seem harmless. Combined, they produce a profile detailed enough to locate you, contact you, or impersonate you: full name, home address, phone number, email, workplace, family members, and sometimes photos or daily patterns. The term comes from hacker slang for dropping documents, or dox, on a rival.

Is doxxing illegal?

It depends on how it is done and where. Publishing information that was already publicly available is not automatically illegal in most places. But doxxing crosses into illegal territory when it is used to threaten, stalk, or harass, when the information was obtained through hacking or other illegal means, or when it targets certain protected groups. The legal landscape has been shifting fast: as of 2026, around 17 US states have standalone anti-doxxing laws, with others covering the same conduct through existing harassment and cyberstalking statutes. There is no single comprehensive federal anti-doxxing law, though several federal statutes can apply, and victims can often pursue civil claims such as invasion of privacy or intentional infliction of emotional distress.

How do I protect myself from being doxxed?

You cannot make yourself completely unfindable, but you can make yourself a much harder target, and most doxxers give up when the easy sources come up empty. Here are the steps that matter most, in order of impact:

1. Remove yourself from data broker and people-search sites. This is the highest-leverage step, because it is where doxxers start. Sites like Spokeo, Whitepages, MyLife, BeenVerified, Radaris, and dozens of others list your address and phone by default. Opting out closes the front door.
2. Lock down your email. Your email is the master key to your accounts. Use a separate address for public-facing activity, and use aliases for sign-ups on sites you do not fully trust, so a single leak does not expose your main inbox.
3. Audit your social media privacy settings. Set profiles to private, strip location tags, and be mindful of photos and posts that reveal where you live, work, or spend time.
4. Use strong, unique passwords and two-factor authentication. This keeps a doxxer from getting into your accounts and pulling private details directly.
5. Monitor for your own information. Set up alerts for your name, phone number, and address, and search yourself across broker sites periodically to catch new listings.

What should I do if I have been doxxed?

Act methodically. First, document everything: take screenshots of every post showing your information, and record the URL, date, and time of each, since this is essential for reports and any legal action. Report the content to the platforms hosting it, most of which prohibit doxxing. If there are threats of physical harm, or others are using your information to threaten you, contact law enforcement right away, and consider asking a court for a restraining order. Then work on removal, getting the listings and posts taken down and tightening the settings that let the information surface. If your safety feels at risk, our guide on people-search sites and survivor safety covers protective steps in more depth.

Why removing your data is the real defense

Everything about doxxing traces back to aggregation, and aggregation depends on your information being easy to find. Take away the easy sources and the whole exercise gets harder, slower, and more likely to be abandoned. That is why security researchers consistently name opting out of data broker sites as the highest-impact prevention step. The catch is that these listings come back as brokers rebuild their profiles, so a one-time cleanup fades. Consumer Reports measured the gap plainly: automated and do-it-yourself opt-outs cleared only about 27 percent of exposed listings, while removals carried out by real people who keep watch and refile reached roughly 70 percent. Against a threat that thrives on public data, staying removed is the protection.

Frequently asked questions

What is the difference between doxxing and identity theft?

Doxxing publicly exposes your private information, usually to harass or intimidate. Identity theft steals your information to impersonate you, typically for financial gain. Doxxing can lead to identity theft, since a published profile gives thieves a head start, but the immediate aim of doxxing is exposure and harm rather than fraud.

Can I be doxxed if I have never posted much online?

Yes. Much of what doxxers use never came from you directly. It comes from public records and data broker sites that compile your details without your involvement. That is why removing those listings matters even for people who are careful about what they share.

Should I report doxxing to the police?

If there are any threats to your safety, or people are using your exposed information to threaten or harass you, yes, contact law enforcement and bring your documentation. Even where criminal charges are uncertain, a report creates a record and can support a restraining order or civil claim.

How long does it take to remove my info after doxxing?

Platform takedowns of specific posts can be quick once reported. Removing your underlying listings from people-search sites takes longer, often days to weeks per site, and requires ongoing attention because listings can return. Starting the removals promptly limits how long the information stays easy to find.