To report someone for doxxing, save every piece of evidence first, then file reports with the platform hosting the content, with Google to clear search results, and with law enforcement if there are threats or a pattern of harassment. Working these channels in parallel is what gets content down quickly and creates the paper trail you’ll need if the situation escalates.
Save the Evidence Before You Do Anything Else
Every report will ask for proof, and once you file, the doxxer may delete the post. Screenshot the full browser window so the URL bar, date, and time are visible. On social media, capture both the post itself and the poster’s profile page, including their username and any visible account details.
Copy the direct URL of every page where your information appears. URLs break when content comes down, so archive each one. The Internet Archive’s “Save Page Now” tool at web.archive.org generates a permanent, timestamped copy of any URL you paste in.1Internet Archive. Save Pages in the Wayback Machine Archive.today captures a full-page screenshot alongside the HTML and has no public deletion policy, so the doxxer cannot get the archived copy removed.
Then write out a plain list of what was exposed: home address, phone number, employer, financial details, government ID numbers, whatever applies. That inventory speeds up every report you file and tells you which accounts to lock down next.
Report the Post to the Platform
Most major social media sites and forums prohibit sharing someone’s private information without consent, and their enforcement teams can pull content down faster than any legal process. The reporting option is usually behind a three-dot or flag icon near the post, or in the platform’s help center under “report privacy violation.”
When the form asks you to categorize the problem, pick the option closest to “sharing private information,” “privacy violation,” or “harassment.” In the description field, spell out which specific pieces of your personal data appear in the post, paste in the direct URLs, and attach your timestamped screenshots. A clear, factual explanation gives the reviewer what they need to confirm the violation.
File a separate report on every platform where your information appears. Platforms operate independently, and a takedown on one site does nothing about copies elsewhere.
Ask Google to Drop the Pages from Search Results
Even after the original post comes down, cached versions can linger in search results. Google will remove specific personal information from its index, including your address, phone number, email, government ID numbers, bank or credit card numbers, images of your signature or ID, and medical records.2Google Search Help. Remove My Private Info from Google Search
Google also handles doxxing directly. You can request removal of content that pairs your personal information with explicit or implicit threats, calls for others to harass you, or aggregates a significant amount of your personal data without a legitimate purpose.2Google Search Help. Remove My Private Info from Google Search
You’ll need the exact URLs of every page containing your information. Google reviews the URLs you submit, not your name broadly, so be thorough. Keep in mind that removal from Google’s search index does not delete the content from the source site; the pages just stop showing up in Google results. You still need to pursue takedowns with the hosting platform.
File a Police Report
A police report creates an official record that becomes critical if the harassment escalates, if you later pursue a restraining order, or if you need to show a pattern of conduct in court. Contact your local department through its non-emergency line or go to a precinct in person. Save 911 for situations where you face an immediate, credible threat of physical harm.
Bring the whole evidence package: screenshots with visible timestamps, saved URLs, archived links, and your list of exposed information. Tell the officer you’re reporting online harassment involving the unauthorized publication of your personal identifying information. The more organized your evidence is, the more detailed the report will be, and a detailed report is far more useful to a detective later.
Which Laws Apply
Roughly 19 states have passed laws specifically addressing the unauthorized disclosure of personal information, with most protecting all individuals rather than just public officials. States that lack a specific doxxing statute typically rely on existing stalking, harassment, or intimidation laws.
There is no standalone federal anti-doxxing law for the general public. The federal cyberstalking statute makes it a crime to use electronic communications in a course of conduct that places someone in reasonable fear of serious bodily injury or causes substantial emotional distress.3Office of the Law Revision Counsel. 18 U.S. Code 2261A – Stalking When doxxing is part of a broader pattern of intimidation, especially one that crosses state lines, that statute can support federal prosecution. If your situation fits, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.4Internet Crime Complaint Center. Home Page – Internet Crime Complaint Center (IC3) The FBI also recommends contacting your local field office directly for an ongoing threat.5Federal Bureau of Investigation. Cyber
Tell Your Employer if Work Information Was Exposed
If the doxxing exposed your employer’s name or your work location, tell your supervisor or HR. This is a safety measure. Workplace security can watch for suspicious visitors, screen unusual calls or deliveries, and adjust building access. Getting ahead of it also protects you professionally if the doxxer contacts your employer with false accusations, which is a common harassment tactic.
Protect Your Financial Identity and Accounts
When doxxing exposes your full name, address, date of birth, or government IDs, identity theft becomes a real risk. A credit freeze is the single most effective defensive step. It blocks creditors from accessing your credit report, which stops anyone from opening new accounts in your name. Federal law requires all three major credit bureaus, Equifax, Experian, and TransUnion, to let you place and lift a freeze for free.6USAGov. How to Place or Lift a Security Freeze on Your Credit Report Online and phone requests take effect within one business day, mail requests within three.
If your Social Security number or financial account numbers were part of what was exposed, report it at IdentityTheft.gov. The FTC’s portal walks you through a recovery plan and generates pre-filled letters you can send to creditors and financial institutions.
Change passwords on every account that used any of the exposed information. If you have reused a password across multiple sites, treat all of those accounts as compromised. A password manager generates and stores unique credentials for each site. Turn on multi-factor authentication everywhere it is available. Authenticator apps and hardware security keys are significantly safer than text-message codes, which can be intercepted through SIM-swapping attacks.
Civil Legal Options
Criminal reports depend on police and prosecutors deciding to act. Civil action puts you in the driver’s seat. Two tools are worth knowing about: protection orders and privacy lawsuits.
Protection Orders
Most states let you petition a court for a civil protection order, sometimes called a restraining order, when someone’s conduct makes you reasonably fear for your safety. You generally have to show the person engaged in knowing, repeated behavior that would cause a reasonable person to feel afraid or suffer serious emotional distress. When the situation is urgent, a judge can issue a temporary order before the other person has a chance to respond, provided you demonstrate a real risk of irreparable harm without immediate court intervention. A full hearing follows, where the respondent can contest the order.
A protection order can prohibit the doxxer from contacting you, coming near your home or workplace, and continuing to publish your information. Violating the order is typically a criminal offense, which gives police a much cleaner basis for arrest than the underlying doxxing.
Suing for Invasion of Privacy
The tort of “public disclosure of private facts” exists in most states and fits doxxing situations well. To win, you generally need to show the information was genuinely private and not already publicly known, the disclosure reached enough people that it effectively became public, and the disclosure would be highly offensive to a reasonable person. Unlike defamation, truth is not a defense. The information can be entirely accurate and the claim still holds, because the harm comes from publicizing it.
Successful plaintiffs can recover compensatory damages for quantifiable losses like medical bills or lost income, general damages for emotional distress, and, in cases involving reckless or malicious conduct, punitive damages. Some courts also award attorney’s fees and filing costs. The practical hurdle is identifying the doxxer. If they used an anonymous account, you may need to subpoena the platform for account records, which adds time and expense before the case even begins.
Remove Your Information from Data Broker Sites
Even after the doxxing post is down, your information often remains available through people-search sites and data brokers. These services aggregate public records, social media, and commercial databases into profiles anyone can pull up with a name search. If a doxxer found your home address or phone number, there’s a good chance they pulled it from one of these sites, and the next person can do the same.
Most major data brokers, including Spokeo, WhitePages, and BeenVerified, offer opt-out processes on their websites. You typically locate your profile, submit a removal request, and verify your identity through an email confirmation. Each broker handles requests independently, so you have to repeat the process on every site where your information appears. Removal usually takes a few days to a few weeks, and some brokers re-add information over time, so periodic checks are worth the effort.
What Happens After You File
Platform reports tend to produce the fastest results. When the review team confirms a policy violation, the content comes down and the account may be suspended or permanently banned. Most platforms send a notification about the outcome. Turnaround runs from hours to several days depending on the platform’s backlog and how clear the violation is.
Police investigations move much slower, and an investigation isn’t guaranteed for every report. The department’s response depends on the severity of the doxxing, whether direct threats accompanied it, and available resources. In cases involving credible threats or a clear pattern of harassment, a detective may be assigned and can issue subpoenas for account records and IP addresses. Even if no investigation follows right away, the police report itself matters: it documents the offense. If the harassment continues or escalates, that record strengthens every future report, every protection order petition, and every civil claim.
FBI complaints submitted through IC3 are analyzed and may be referred to federal, state, local, or international law enforcement.4Internet Crime Complaint Center. Home Page – Internet Crime Complaint Center (IC3) The FBI prioritizes cases reported quickly, so file as soon as your evidence is together rather than waiting for local police to act first.