Step 1: Document everything before it disappears
Before you report, block, or ask anyone to take anything down, capture it. Posts get deleted, threads get locked, and accounts go private — often right after they’ve done the damage. DHS’s guidance on doxing recommends preserving evidence by saving emails, voicemails, and text messages, and taking screenshots or photos of the posts themselves.
Screenshot the full post, the profile or username that posted it, the URL, and the timestamp. Save any comments piling on or repeating the information — a pattern matters more than one post. If you’re not sure how to preserve this so it holds up later, documenting it and getting help covers logging technique in more depth. Do this first because every later step in this list — reporting, police contact, takedown requests — goes faster and works better with evidence in hand.
Step 2: Figure out what’s actually exposed, and how dangerous it is
Not all doxxing carries the same risk. A leaked email address is unpleasant; a leaked home address, workplace, or your kids’ school is a different category of danger. Read through what was posted and sort it: contact info, home address, workplace, financial details, photos, family members’ names, license plate. DHS’s doxing resource defines doxing as gathering personally identifiable information and releasing it publicly for malicious purposes — public humiliation, stalking, identity theft, or harassment — and this is the moment to decide which of those you’re facing.
If anything in the posts includes explicit or implied threats, or calls for others to show up or contact you, treat this as a safety emergency, not just a privacy one, and move to Step 3 immediately.
Step 3: If your home address is out and you feel unsafe, act on physical safety first
This is the step that comes before everything else if there’s any threat language, or if a crowd is actively organizing around the post.
- Call 911 if you believe someone may come to your home imminently or you’re in immediate danger.
- Call your local police non-emergency line if the post includes a threat to your physical safety or you feel criminally harassed, and report it there too. DHS’s doxing guidance recommends reporting a physical-safety threat or criminal harassment to local law enforcement as well as the platform. (Step 8 covers filing a report specifically to guard against a hoax swatting call, even without a direct threat.)
- Consider leaving temporarily. A hotel, a friend’s place, or a family member’s home reduces your exposure at the address that’s now public — it doesn’t make you unfindable, so tell only people you trust where you actually are.
- Tell whoever else lives with you or shares the address, including roommates, and if you’re in an apartment or gated building, notify building security or the front desk with a description of the situation so they know not to buzz in or give out information to strangers claiming to know you.
If you suspect the person doxxing you is also someone who has stalked or monitored you before, read safety first before taking any action that might tip them off that you know — that includes changing locks, alerting mutual contacts, or posting publicly about what happened.
Step 4: Report it to the platform it’s posted on
Doxxing violates the policies of the platforms below, including Meta, X, Reddit, TikTok, and Google Search removal policies, though each defines and handles it a little differently. Report the specific post or account, not just the person generally.
- Instagram and Facebook (Meta): Meta doesn’t use the word “doxxing” in its policy, but it removes “content that shares, offers, or solicits personally identifiable information or other private information that could lead to physical or financial harm, including financial, residential, and medical information,” per Meta’s Privacy Violations policy. Use the in-app report button on the specific post. For a photo or video that exposes your image without consent, Instagram also has a dedicated report a violation of your privacy form; for other content, or if you don’t have an account, use Facebook’s general report form.
- X (formerly Twitter): X’s policy prohibits posting someone’s “home address or physical location information,” phone numbers, or other private contact details without consent, and states this applies even to information that’s technically public elsewhere when it’s a home address, “due to the potential for physical harm,” per X’s private information and doxxing policy. Use X’s in-app reporting flow on the specific post.
- Reddit: Reddit’s site-wide rules require users to “respect the privacy of others,” stating that “instigating harassment, for example by revealing someone’s personal or confidential information, is not allowed,” per Reddit’s official rules. Report the post or comment, and also report it to the subreddit’s moderators, since they can remove it faster than a site-wide review.
- TikTok: TikTok’s Privacy and Security guidelines state it does not allow “content that includes personal information that may pose a risk of stalking, violence, phishing, fraud, identity theft, or financial exploitation” — including information the person posted about themselves — per TikTok’s Community Guidelines. Report through the in-app flow on the video or comment.
- Google Search: if the information is showing up in search results even after the original post is down, Google’s removal request process covers home address, phone number, email, and government ID numbers, and separately allows reporting “doxxing content” — defined as your personal information paired with explicit or implied threats, or a large amount of aggregated personal information posted without a legitimate purpose.
Reporting doesn’t guarantee removal on any platform, and review times vary. If the post also contains explicit threats, save the report confirmation or ticket number — you’ll want it if you talk to police.
Step 5: Lock down the accounts and profiles that fed the leak
Once the acute exposure is reported, look at how the information got out in the first place, and close that door.
- Secure your accounts. If there’s any chance a password or security question answer was part of what leaked, or if the person doxxing you has ever had account access, change passwords and review login sessions. Securing your accounts when someone knows you walks through this for exactly this threat model.
- Lock down your social profiles. Old posts, tagged photos, and public follower lists are often where the personal details got pulled from in the first place. Go through each platform’s privacy settings and restrict who can see your posts, photos, and friend or follower list.
- Change what’s discoverable, not just what’s private. A public real name tied to a semi-anonymous account, a bio that names your employer, or a location tag on an old post can all be re-mined even after the original doxxing post is removed.
Step 6: Go after the source data, not just the post
A single deleted post doesn’t fix the underlying problem if your address and phone number are sitting in a people-search database that anyone could have pulled it from. How people-search sites expose your address covers which sites to prioritize and how opt-outs work — this is slower than a platform takedown, so start it now even though results take time.
Step 7: Warn the people and places that might get contacted
A leaked address, phone number, or workplace can lead to people calling your workplace, messaging your school, or showing up at a shared address to “verify” the information or harass you directly.
- Tell your employer’s front desk or HR, especially if your workplace is public information or was included in what leaked. A short heads-up — “someone may call or show up claiming to know me; please don’t share my schedule or location” — is enough.
- Tell your kids’ school office the same way, if applicable, so they know not to release information or allow unauthorized pickup.
- Warn close family or roommates who share your last name, address, or number, since anyone sharing that identifying detail could also be contacted or targeted.
Step 8: If there’s any chance of swatting, tell your local police before it happens
Swatting — a hoax call to 911 designed to send an armed police response to someone’s home — is a documented follow-on risk when someone’s home address becomes public, particularly in gaming and streaming communities. The FBI has described it as a serious crime with potentially dangerous consequences for everyone involved, including the responding officers, per the FBI’s account of swatting. An FBI assistant special agent in charge who worked swatting cases recommended filing a police report about any swatting threats received, specifically so that “if a 9-1-1 incident does occur at your home, the police will be aware that it could be a hoax.”
Call your local police non-emergency line, explain that your address was recently posted publicly and that you’re concerned about a false emergency call being made to your home, and ask that the report be flagged on file at your address. This doesn’t prevent a response team from showing up if a hoax call comes in, but it gives dispatchers and responding officers context before they arrive.
Step 9: Loop in support if this is part of a larger pattern
If the doxxing came from a partner, ex-partner, or someone who has stalked or monitored you before, this isn’t an isolated incident — treat it as part of an ongoing pattern and get outside support.
- The National Domestic Violence Hotline — call 1-800-799-7233, text “START” to 88788, or chat online, for support with relationship abuse.
- VictimConnect Resource Center — call or text 1-855-4VICTIM (855-484-2846), or chat online, for help understanding your rights and finding local resources for any crime, including harassment that doesn’t involve a partner.
- File a report with the FBI’s Internet Crime Complaint Center (IC3) if the doxxing involved hacking, threats, or other cyber-enabled crime — IC3 is the FBI’s central intake for this kind of report, though it notes it can’t respond to every submission individually.
If you’re in immediate danger, call 911 first — everything else on this list can wait a few minutes; your safety can’t. Otherwise, contact your local police department to report the incident and any related threats, per the DOJ Office on Violence Against Women.
None of these steps require you to have everything figured out before you start. Documenting and reporting can happen the same hour it’s discovered; locking down accounts and chasing down source data can happen over the following days. Working through them in order, rather than everything at once, is what makes the first 24 hours manageable.