Doxxing—the malicious publication of someone's private information online—can destroy careers, relationships, and lives. Once your home address hits a forum or subreddit, the damage is nearly impossible to undo. The best defense is preventing it in the first place.
What Doxxing Actually Is
Doxxing comes from "dropping documents." It's the act of collecting personal information about someone—real name, address, employer, phone number, family members—and publishing it publicly to intimidate, harass, or threaten them. Unlike stalking, which may be one-on-one, doxxing is designed to mobilize a mob.
Common targets include:
- Content creators, streamers, and YouTubers
- Journalists and activists
- Gamers in competitive communities
- People involved in online arguments that go viral
- Anyone with an opinion the wrong person disagrees with
How Doxxers Find You
Doxxers use open-source intelligence (OSINT) tools—the same techniques used by investigators and researchers. The information is almost always legal to collect:
- Data broker sites selling your full address and phone number for a dollar
- Reverse image searches connecting profile pictures to real names
- Leaked databases from old data breaches
- EXIF data in photos you've posted
- Social media oversharing—commute posts, neighborhood photos, coffee shops
- WHOIS records for domains you own
- Professional licenses and voter rolls
Step 1: Separate Your Real Identity From Your Online Presence
Treat your public persona and your legal identity as two different people. A gamer, artist, or activist should never attach their real name to public accounts unless they've consciously accepted the risk.
- Use a pseudonym on every public platform
- Never use your real name in usernames, emails, or Discord tags
- Use separate email addresses for public-facing and private accounts
- Don't cross-link private accounts with public ones
Step 2: Remove Yourself From Data Brokers
People search sites are the #1 source of doxxing information. A single search on TruePeopleSearch or Spokeo can return your full address, phone number, age, and relatives—free, without an account.
Removing yourself from 100+ data brokers manually is tedious and must be repeated regularly as sites re-add you. PrivacyOn automates this process, removing your information continuously and monitoring for re-appearances. For anyone who creates content publicly or holds controversial opinions online, this is the single most important step you can take.
Step 3: Scrub EXIF Metadata From Photos
EXIF Data Leaks Your Location
Every photo taken on a smartphone embeds GPS coordinates, date, time, and device information. When you post it online, that data can reveal your home address. Strip EXIF data before posting, or use platforms that do it automatically. Never post photos taken inside your home on public accounts.
Step 4: Audit Your Social Media
- Switch accounts to private wherever possible
- Remove location-tagged posts
- Avoid posting identifiable landmarks near your home
- Delay real-time posts (share vacation photos after you're home)
- Don't reveal your employer, school, or gym publicly
- Use a different profile picture for public and private accounts to prevent reverse image matching
Step 5: Lock Down Your Domain and Email
- Enable WHOIS privacy on every domain you own (often free)
- Use email aliases (Apple Hide My Email, SimpleLogin, Firefox Relay)
- Never use your real email as a username on public forums
- Use a password manager with unique passwords to prevent breach-based doxxing
Step 6: Address Public Records
- Transfer your home into an LLC or trust
- Use a PO Box on your voter registration where allowed
- Opt out of LexisNexis and Acxiom—the two biggest aggregators
- Suppress your professional license address if your state allows it
Step 7: Prepare for the Worst
Have a Response Plan
If you're a likely doxxing target, pre-write a response plan: which authorities to contact, which platforms to report to, which friends to call, which accounts to lock. Having this ready means you react in minutes, not hours.
Step 8: Monitor Your Digital Footprint
Set Google Alerts for your real name. Monitor HaveIBeenPwned for breaches. Consider dark web monitoring through a service like PrivacyOn, which alerts you the moment your information appears in leaks or paste sites—often before a doxxer has time to weaponize it.
Bonus: Harden Your Phone Number
Get a Google Voice or secondary number for online use. Never give out your real mobile number on public forms, dating apps, or social media profiles. SIM-swapping attacks rely on doxxers obtaining your real number to hijack your accounts.
Prevention Is the Only Real Defense
Once your information is out, you can reduce harm—but you can't fully recover. Start locking things down before you need to. For anyone with a public online presence, data broker removal through a service like PrivacyOn isn't paranoia. It's basic hygiene for the modern internet.