What Is Doxxing? What Counts, How Doxxers Find You, and What to Do If It Happens

What doxxing means

Doxxing is publishing someone’s private information so that others can find, harass or hurt them. The US Department of Homeland Security defines it as “gathering an individual’s personally identifiable information (PII) and releasing it publicly for malicious purposes, such as public humiliation, stalking, identity theft, or targeting for harassment” (DHS, January 2024).

• Where the word comes from. Merriam-Webster traces “dox” to “docs,” short for documents, and to the older hacker phrases “dropping docs” and “doc-dropping” for the same act. It dates the current meaning to 2009 (Merriam-Webster).
• How to spell it. Dox and doxx are both listed, so doxing and doxxing are both correct.
• Unmasking counts too. The dictionary sense covers publicly identifying someone, so tying an anonymous account to a real name falls under it as well as posting an address.

This guide is general information for adults in the United States. It is not legal advice. The laws and help pages below were checked on October 16, 2026.

What counts as doxxing, and what usually does not

The word gets used loosely online. The state laws below draw the line in a similar place: private details, published without consent, with intent to cause harm.

“It was already public” is a common defense. Washington’s law says it is no defense that the information was public before or can be found through research (RCW 4.24.792(3)).

How doxxers actually find people

Doxxers start from a name or a photo and join up information that already sits in different places. The FBI says swatters “compile sensitive information from a wide range of publicly available sources” to build profiles of their targets (FBI, April 2025).

• Public records. DHS lists property and court records and voter registration lists among the common sources (DHS).
• People-search sites and data brokers. These sites package those records into one profile with an address, phone number and relatives. DHS tells people to ask these sites to remove their data.
• Your own posts. DHS also names social media, wedding announcements, obituaries, newsletters, public conferences and web forums.
• Your face. A face search engine takes one photo and returns other pages that show the same face, often with a name beside it. Our guide to how face search engines get your photos explains where their copies come from.

From a face to a home address

In October 2024 two Harvard students showed how short that chain has become. Their I-XRAY demo paired Meta’s Ray-Ban smart glasses with the face search engine PimEyes and other tools, and returned a person’s name, home address, phone number and family members from their face (404 Media). The students did not release their code.

Setting an account to private does not remove copies that a face search engine already holds, which our post on reverse image vs. reverse face search covers in detail.

What doxxing leads to

• Harassment and stalking. In Pew Research Center’s 2020 survey of 10,093 US adults, 41% had experienced online harassment and 25% had faced more severe forms such as stalking, physical threats or sustained harassment (Pew Research Center). Pew did not measure doxxing on its own.
• Swatting. The FBI describes swatting as hoax emergency calls meant to send armed police to a target’s home, and says that while public figures are frequent targets, anyone can be a victim (FBI).
• Identity theft and humiliation. Both are on DHS’s list of what doxxers are after (DHS).
• Self-censorship. In a September 2025 online survey of about 1,000 US adults by the review site SafeHome.org, 4% said they had been doxxed and 57% said they avoid sharing political views online for fear of being targeted (SafeHome.org).

Is doxxing illegal?

It depends on where you live and what was done with the information. A few states have laws that use the word, and other cases fall under stalking or harassment laws.

Most of these laws require intent to harm and real harm as a result. If you are thinking about a lawsuit, save your evidence first and take it to a lawyer licensed in your state.

If you’ve been doxxed: what to do today

1. Call the police if you feel unsafe. DHS says to report threats to your physical safety to local law enforcement (DHS). The FBI suggests agreeing a plan with the people you live or work with for a police visit to your home (FBI).
2. Save everything before you report it. DHS lists emails, voicemails, texts and screenshots of comments. Add the link and the date to each one, because posts get deleted once people notice them.
3. Report the post under “private information.” On Facebook and Instagram that is the rule it breaks, since Meta bans sharing other people’s personally identifiable information (Meta). Our guide to getting a post taken down walks through each menu.
4. Ask Google to drop the results. Google takes doxxing removal requests for pages that show your details with threats, or large amounts of your details with no legitimate purpose (Google). Its Results about you tool finds results with your address, phone number or email and can alert you to new ones.
5. File a crime report online. DHS points victims of online crime to the FBI’s Internet Crime Complaint Center at ic3.gov.
6. Lock down your accounts. Use a unique password and two-step verification on each one, as both DHS and the FBI advise. Take your address, phone number and birthday off your profiles.
7. Opt out of people-search sites. DHS recommends asking them to remove your data. California residents can send one free deletion request to every registered data broker through DROP, which brokers must check at least once every 45 days since August 1, 2026 (California Privacy Protection Agency).
8. Search your own face. Upload a recent photo of yourself to a face search engine and note which pages connect your face to your name. Then send each engine its opt-out request. Our PimEyes removal guide covers one of them step by step.

Google warns that a removed search result “doesn’t mean that the info is gone from the internet,” so the original page still needs its own report to the site that hosts it.

Making yourself harder to dox

These come from DHS’s doxxing guidance and the FBI’s swatting alert, with the face step added.

• Post photos and videos with care, including ones that disappear after a day. DHS calls this out by name, and the FBI warns that photos and videos can be misused.
• Review who follows you and turn down requests from people you do not know.
• Turn off location services for apps that do not need them, and remove apps and browser extensions you no longer use.
• Repeat your people-search opt-outs every few months, and check whether old listings have come back.
• Opt your face out of face search engines. Our database list shows which engines take opt-out requests. For a longer checklist, read Stop Getting Doxxed: Our Guide.

Common doubts

“My address was already online. Does it still count?”

Often, yes. Washington’s law states that earlier public availability is no defense, and Google’s doxxing policy looks at whether the details are gathered up to harm you.

“Is posting my real name enough to be doxxing?”

Under the dictionary meaning it can be, when it unmasks you to punish you. Under the state laws above, you would also need to show intent to harm and real harm, such as fear for your safety or having to move.

“Will opting out of face search stop doxxing?”

It closes one route, the one that starts from a photo of you. People-search sites, public records and old posts are separate routes, which is why the steps above cover each of them.

“Can FacePrivacy take down the post with my address?”

No. Platform and Google reports have to come from you, using the steps above. We handle the face search engines: you upload two photos, we file opt-out requests with the engines we support and re-file them as necessary, and every request shows up in your dashboard and the app.

“What does that cost?”

US$9.99 a month, or US$7.99 a month billed annually. Cancel from your dashboard whenever you like. Web payments made through Stripe carry a 30-day money-back guarantee. See pricing for details.