Been Doxxed? What to Do Right Now, Step by Step

Being doxxed means someone has collected your personal information, such as your home address, phone number, workplace, family or photos, and published it to target you. It's frightening, because it turns online hostility into something that can reach your door.

Act calmly and in order. This guide walks through what to do first, how to get the information taken down, and which laws can protect you in Europe. It's general information, not legal advice.

Step 1: Save the evidence

Before you report anything, record it, because reported content often disappears and you may need proof later for the police, a platform appeal or a lawyer.

• Screenshot every post, page and message, with the website address, the account name and the date visible.
• Copy the URLs of every page where your information appears.
• Keep any threats or messages you received, and note when they arrived.

Step 2: Don't engage

Don't reply to the person who doxxed you or argue in the comments. Responding can escalate things, attract more attention to the post, and reveal more about you. Let the reports and, if needed, the police do the work.

Step 3: Report the posts to the platforms

Most platforms prohibit posting someone's private information, such as a home address, phone number or ID documents, especially to harass them. Report each post using the platform's report button and choose the category for private information or harassment rather than a general complaint.

If the platform operates in the EU and the doxxing is illegal where you live, you can also send a formal notice under the Digital Services Act. The platform must process it, tell you its decision and let you appeal. Our DSA reporting guide explains what to include.

Step 4: Get it out of Google

Even after a post is removed, search results can keep pointing to it, and the information may be copied elsewhere. Google will consider removing results that show:

• Your contact details: home address, phone number or email
• Government ID numbers, bank or card numbers
• Images of your signature or ID documents
• Personal information shared to harm you, such as details posted alongside threats

Google's Results about you tool helps you find results containing your contact details, request their removal and get alerts when new ones appear. Our guide to removing photos and results from Google covers all of Google's removal tools.

Step 5: Ask websites to delete your data

If your information is on a website rather than a social platform, you can ask the site operator to delete it. In the EU, your address, phone number and photos are personal data under the GDPR, and you can request erasure. If the site ignores you, complain to your national data protection authority: the Autoriteit Persoonsgegevens in the Netherlands or the Data Protection Authority (GBA/APD) in Belgium. Our GDPR right to be forgotten guide explains how to write the request.

Step 6: Lock down your accounts and information

• Change passwords and turn on two-factor authentication, starting with your email, since it can be used to reset everything else.
• Make your social profiles private for now, and remove details like your workplace, neighbourhood and family members.
• Tell the people affected. Warn family members whose details were posted, and consider telling your employer if your workplace was named, so they can be ready for calls or visits.
• Watch for new posts. Search your name regularly, and set up alerts so you hear about new mentions quickly.

The law: doxxing is a crime in several EU countries

• Netherlands: since 1 January 2024, Article 285d of the Criminal Code makes it a crime to collect, share or make available someone's personal data with the intent to make them afraid, cause serious nuisance, or seriously hinder their work. Penalties are higher when the target is, for example, a journalist, official or judge.
• Germany: a specific offence for dangerous dissemination of personal data has existed since 2021 (Section 126a of the Criminal Code).
• France: a specific offence was introduced in 2021 (Article 223-1-1 of the Criminal Code).
• Belgium: there's no standalone doxxing offence, but harassment and privacy laws can still apply.

In the Netherlands, Helpwanted helps victims of doxing get content removed, and platforms must give its reports priority because it's an official trusted flagger under the Digital Services Act.

Check which photos of you are out there

Doxxing posts often include photos, taken from your social media or elsewhere, to make you recognisable. Knowing which photos of you are publicly available helps you see what a doxxer could find, and lets you remove photos that show where you live or work. A face search finds public photos of you even when your name isn't on the page.

Sources: Dutch Public Prosecution Service: doxing guideline (Article 285d); overview of EU doxxing laws; Google: remove personal information; ACM trusted flagger decision for Offlimits/Helpwanted. Checked October 2026.

Frequently Asked Questions