Doxxing Prevention Guide: Steps to Stay Safe

Doxxing is when someone gathers your personal details, such as your home address, phone number or workplace, and publishes them online to frighten, shame or harm you. It often starts after an argument online, a news story, a dispute with a neighbour or a breakup. The information is usually pieced together from things that are already out there: old posts, public records and people-search websites. This guide explains, in plain English, how to shrink what can be found about you, how to lock down your accounts, and exactly what to do and who to call if it happens to you. It is written for members of the public, families and people running very small businesses. For organisations, see the Executive Protection and Digital Footprint Guide.

Key takeaways

Your safety comes first. If you think someone may come to your home or hurt you, call 999 (or your local emergency number) before doing anything else online.
Most doxxing uses information that is already public. Cutting back what you share, and removing yourself from lists such as the open electoral register, makes you much harder to target.
Lock your email first. Your email account is the key to your other accounts, so give it a unique password and turn on 2-step verification.
Keep evidence before you report. Screenshot posts with the date, time and web address showing, then report to the website and, where there are threats, to the police.
You have legal rights. In the UK you can ask organisations to delete your data, and threatening messages can be a crime under the Online Safety Act 2023.

What doxxing is and why it matters

The word comes from "dropping docs", meaning releasing documents about someone. The harm is not usually the information itself, since your address is known to your postman and your neighbours. The harm comes from putting it in front of angry strangers along with an invitation to act on it.

Common effects include:

Floods of messages: abusive calls, texts and emails, sometimes from hundreds of people at once.
Unwanted visits or deliveries: people turning up at your home or work, or ordering things in your name.
Contact with your employer or family: attempts to get you sacked or to embarrass you in front of people you know.
Account takeover attempts: leaked details such as your date of birth or mother's maiden name can help someone guess security questions.
Fraud: personal details can be used to open accounts in your name. See the Identity Theft Recovery Guide.

Childline lists "someone revealing your personal details" as one form of online bullying, so this is something that happens to young people too. If a child is involved, see the Cyberbullying Response Guide.

Shrink your public footprint in an afternoon

You cannot make yourself invisible, but you can remove the easiest routes. Work through this table in order. The first rows usually make the biggest difference.

What to change	Why it matters	How to do it
Open electoral register (UK)	Anyone can buy the open register, which lists names and addresses.	Opt out using the online register-to-vote service or your electoral registration office (the Electoral Office for Northern Ireland if you live there). It does not affect your right to vote.
Anonymous electoral registration (UK)	The full register still holds your name and address even after opting out of the open version.	If your safety is at risk, ask your electoral registration office about registering anonymously. You will usually need supporting evidence.
Search engine results	Search is how most people find your phone number or address.	Use Google's "Results about you" tool to find and request removal of results that show your phone number, home address or email.
People-search and directory websites	These sites collect and republish addresses and phone numbers.	Ask each site to delete your data using your right to erasure (see below). Keep a list of where you asked and when.
Social media profiles	Old posts reveal your school, workplace, street, pets' names and routines.	Make accounts private, hide friend lists, remove your birthday and phone number. See the Social Media Privacy Settings Guide.
Photos	Pictures can show your house number, car registration, school uniform or view from your window.	Delete or crop old photos that show these. Turn off location tagging in your camera and social apps.
Location sharing	Live location in apps can show where you are right now.	Review who can see your location. On iPhone (iOS 16 or later), Apple's Safety Check lets you quickly change what you are sharing and with whom.

Menus and setting names change often. If a setting is not where this guide says, search the app's own help pages for the setting name.

Using the Google "Results about you" tool

Google's tool can check Search regularly for your phone number, home address and email, and alert you when new matches appear. You open the "To review" tab, pick a result and choose "Request to remove". You can also start from a search result by opening "About this result" and choosing "Remove result".

Two limits are important. First, removal only affects Google Search: the page itself stays online, so you still need to ask the website owner to take it down. Second, Google says results from government sites, educational sites and newspapers are generally not removed.

Asking websites to delete your data

Under UK data protection law you have a "right to erasure", sometimes called the right to be forgotten. The ICO (the UK's data protection regulator) explains that you can ask an organisation to delete your personal data, and in some situations it must, for example if it no longer needs the data or you withdraw your consent.

Ask in writing: you can ask verbally, but the ICO recommends writing so you have proof. No special wording is needed.
Say what you want deleted: include the web address and enough detail to identify you, but do not send more personal information than they need.
Timescale: the organisation normally has one calendar month to respond, which can be extended by up to two more months if it tells you why.
If it refuses: complain to the organisation first, then to the ICO if you are still not satisfied.

Lock down your accounts

When someone is targeting you, expect them to try to get into your accounts. Your email matters most. The NCSC (the UK's National Cyber Security Centre) warns that criminals can use your email to access many of your other accounts.

Give your email a strong, unique password. The NCSC suggests three random words. Never reuse it anywhere else.
Turn on 2-step verification (2SV). This means a code or prompt on your phone is needed as well as your password. See the Two-Factor Authentication for Everyone Guide.
Use a password manager. It creates and remembers different passwords for every site. See the Password Managers Explained for Everyone Guide.
Change security questions. If your date of birth, old school or pet's name is public, use made-up answers stored in your password manager.
Check signed-in devices. Most email and social media accounts show where you are logged in. Sign out of anything you do not recognise.
Protect your phone number. Ask your mobile provider whether you can add a PIN or extra checks to your account. A criminal who moves your number to their SIM can receive your login codes. See the SIM Swap Fraud Guide.
Install updates. The NCSC recommends installing software and app updates promptly because they include security fixes.

If you suspect someone has put tracking software on your phone, for example a former partner, see the Spyware and Stalkerware Guide before removing anything, as removal can alert the person and evidence may be useful to police.

Signs you are being targeted

A sudden rise in messages, friend requests or follows from strangers.
Password reset emails or login codes you did not ask for.
Strangers mentioning your address, workplace or family in comments.
Friends or colleagues telling you they have been contacted about you.
A post or forum thread listing your details, often shared with a call to "pay them a visit" or "let them know what you think".
Deliveries, taxis or takeaways ordered to your address that you did not order.

What to do if it happens

Get safe. If there is any threat to your physical safety, call 999. Tell the police your address has been published. In a non-emergency, call 101.
Do not engage. Replying, arguing or posting about it often attracts more attention.
Collect evidence. Take screenshots showing the post, the account name, the date and time, and the web address. Save links. Keep a simple diary of every call, message and visit. Do this before reporting, because posts may be deleted.
Report to the platform. Use the report button on the post and on the account. Most platforms ban posting someone's private information. Block the accounts after you have saved evidence.
Lock down. Make your accounts private for now and work through the account checklist above.
Warn the people around you. Tell family, housemates and your employer so they do not confirm details or pass on messages. Ask your workplace not to give out your details to callers.
Report to the police. Threats and repeated harassment can be crimes. Give them your evidence and diary, and ask for a crime reference number.
Report fraud separately. If your details are used to open accounts or take money, report it to Report Fraud (England, Wales and Northern Ireland, 0300 123 2040). In Scotland, call Police Scotland on 101.
Ask for removal at the source. Use the platform report, the Google tool and right-to-erasure requests together.

When doxxing becomes a crime in the UK

Publishing an address is not, on its own, always a crime. But what usually comes with it often is. The Crown Prosecution Service guidance on communications offences lists these, among others:

What happened	Law that may apply
A message threatening death or serious harm	Online Safety Act 2023, section 181 (threatening communications), for messages sent on or after 31 January 2024
A message the sender knows is false, sent to cause harm	Online Safety Act 2023, section 179 (false communications)
Sharing, or threatening to share, intimate images without consent	Sexual Offences Act 2003, section 66B
Indecent or grossly offensive messages	Malicious Communications Act 1988, section 1, and Communications Act 2003, section 127
A pattern of following, contacting or watching you	Stalking and harassment law. The National Stalking Helpline can explain your options.

This is a summary to help you talk to the police, not legal advice.

Where to get help

Emergency (UK): 999. Non-emergency police: 101.
Report Fraud: for fraud and cyber crime in England, Wales and Northern Ireland, at reportfraud.police.uk or 0300 123 2040.
National Stalking Helpline: 0808 802 0300, free advice for victims of stalking, run by the Suzy Lamplugh Trust.
ICO: if an organisation will not delete your data or handle your request properly.
Ofcom: once you have reported to the website or app, you can tell Ofcom if you think the service is not protecting users. Ofcom says it cannot investigate individual complaints, but uses them to decide whether to act against services.
Under 18: Childline on 0800 1111.
United States: call 911 if in danger and report threats to local police. Online crime can be reported to the FBI's Internet Crime Complaint Center (IC3).
European Union: 112 in an emergency; your national data protection authority handles deletion complaints.

Common failure patterns

Deleting everything straight away. Panic deleting removes the evidence police need. Screenshot first, then report and block.
Arguing with the people involved. Replies give attackers new material and push the posts higher.
Only removing results from Google. The source page is still there and can be found other ways. Ask the website itself too.
Forgetting the open register. Many people tidy their social media but stay on a list anyone can buy.
Leaving email without 2SV. Once your email is taken, every other account can be reset.
Treating it as "just online". If your address is out there with threats, involve the police early. You do not need to wait for something to happen.

Practitioner checklist

Work through this step by step. Tick each one off.

Opt out of the open electoral register, and ask about anonymous registration if you are at risk.
Search your own name, phone number and address, and note what you find.
Set up Google "Results about you" and request removal of results showing your contact details.
Send right-to-erasure requests to people-search and directory sites, and keep a dated list.
Make social media accounts private and remove birthdays, phone numbers and location tags.
Give your email a unique password and turn on 2-step verification.
Move all passwords into a password manager and change public security answers.
Ask your mobile provider about extra protection on your account.
Write down who to call: 999, 101, Report Fraud, National Stalking Helpline.
If it happens: get safe, screenshot, report, lock down, tell people around you, call the police.

Doxxing Prevention Guide: Plain-English Steps to Stay Safe