What Is Doxing? How It Works and How to Protect Yourself

Doxing is the act of publishing someone's private or identifying information online, usually without their consent, in order to harass, intimidate, expose, or endanger them. The term covers a wide range of information, from a home address and phone number to a workplace, family members' names, or financial details, and it is almost always compiled from a mix of public and private sources before being dumped somewhere the target's critics or attackers can use it.

The word itself comes from 1990s hacker slang for "dropping docs," compiling a rival's personal documents as a way to strip away their anonymity. Today it shows up everywhere from gaming disputes and political arguments to stalking and domestic-abuse cases, and in the worst instances it escalates into swatting, where a false emergency report sends an armed police response to the target's home. Here is what doxing actually involves, how attackers typically gather the information, where it stands legally, and what to do if it happens to you.

What Is Doxing, Exactly?

According to Wikipedia's entry on the practice, doxing is "the act of providing personally identifiable information about an individual or organization," usually publicly and usually without the subject's consent. New York State's Office of Information Technology Services (ITS) describes it more bluntly in its own consumer guidance: doxing is "the malicious collection and public sharing of someone's personal information without consent," including details like email addresses, home addresses, phone numbers, workplaces, and family information, with the goal of intimidating, harassing, or retaliating against the target, according to its "Don't Get Doxed!" advisory.

Doxing isn't one single act. It can mean compiling details a target already shared publicly, scattered across different platforms, into one place specifically to make them easier to find or weaponize. It can also mean exposing information the target never intended to be public at all, obtained through hacking, social engineering, or a data breach. The common thread, per both the Wikipedia overview and the NY ITS page, is that the information is shared without consent and the likely outcome is harm, whether that's harassment, stalking, identity theft, job loss, or a physical threat.

How Doxing Typically Happens

Doxers rarely need to "hack" anything to build a dossier on someone. Most of the work is aggregation: pulling together scraps of information that are individually unremarkable but dangerous once combined.

Data brokers and people-search sites. Specialized "people finder" sites buy information from other data brokers, scrape public social media profiles, and pull from government records, then compile it into a sellable report. The Federal Trade Commission explains that these sites draw on "property, driving, and voter registration information, as well as criminal records, civil actions, and vital records like marriages and divorces," and that a single detail such as a name or phone number can be enough to generate a report listing someone's age, past addresses, property history, marital status, employment history, and family members' names, according to the FTC's consumer guidance on people-search sites. Because these reports are built for anyone willing to pay, they're a common starting point for doxing campaigns, and they're also why privacy advocates recommend periodically checking what a simple search of your own name turns up and working through the opt-out process the FTC describes, or using a service such as the one outlined in Pandromeda's guide on how to opt out of data brokers and people-search sites.

Social media scraping. Public posts, check-ins, tagged photos, "about" sections, and even old usernames can be stitched together to re-identify someone or locate them. A profile that reveals a hometown, an employer, a school, and a pet's name, each shared separately over years, is often enough for someone determined to build a full profile.

Breached data. Credentials and personal details exposed in a corporate data breach frequently resurface in doxing. If an attacker already has your email and a reused password from an old breach, that password can be the first step toward taking over other accounts that hold more sensitive information, a pattern closely related to the account-takeover techniques covered in Pandromeda's explainer on social engineering.

Reverse lookups and public records. Reverse phone and address lookup tools, property tax records, voter rolls, and court filings are all public by design in most jurisdictions, and all of them can be searched by anyone with a name or a phone number to work backward toward a home address.

Metadata in photos and posts. Some phones and cameras embed GPS coordinates and timestamps in image files (EXIF data) unless location services are disabled, and the background of an otherwise innocent photo, a street sign, a distinctive building, a reflection, can reveal a location even when the metadata has been stripped.

SIM swapping and account takeover. Once an attacker has enough personal information, they may use it to impersonate the target with a mobile carrier and hijack their phone number, a technique Pandromeda has covered in detail in its explainer on SIM swapping, which can then be used to intercept verification codes and break into even more accounts.

Doxing vs. Swatting vs. Harassment: What's the Difference?

These terms get used loosely and interchangeably online, but they describe different acts, and the distinction matters for both reporting and any potential legal response.

Swatting is the clearest example of how doxing can turn into a life-threatening situation. The FBI's Internet Crime Complaint Center (IC3) warns that swatting "can be enabled by sensitive personal information found online," and recommends that people review their own online footprint for exactly that kind of exposure, according to its most recent public service announcement on swatting, published August 4, 2026. That alert, which updates an April 2025 warning, notes that swatting incidents have been directed not just at homes but at schools, government buildings, religious sites, transit centers, and hospitals, and it flags warning signs such as callers who stay unnaturally calm or sound like they're reading from a script.

Is Doxing Illegal?

There is no single federal law in the United States that makes doxing, by itself, a crime. Whether a specific act of doxing can be prosecuted or sued over depends heavily on where the victim and the doxer are located and what was actually done with the information. New York's ITS advisory is direct about this: "Doxing laws are still evolving," but existing harassment, defamation, fraud, and threat statutes "may apply" even when no law specifically names doxing, and victims may have options such as a cease-and-desist letter or a civil complaint, with an attorney who specializes in cyber law or privacy rights able to advise on what applies in a given case.

Some states have passed laws that address specific slices of the problem rather than doxing in general. New Jersey's Daniel's Law is the clearest example: enacted after the 2020 killing of Daniel Anderl, the son of U.S. District Judge Esther Salas, at the family's home, it bars New Jersey government websites from posting the home addresses of "covered persons," a category defined in state statute that includes active, former, and retired judges, prosecutors, and law enforcement officers and their immediate families. It separately lets an "authorized person" send written notice demanding that any other website or individual stop disclosing that covered person's home address or unpublished home phone number and remove it from the internet, under New Jersey's criminal and consumer-fraud codes, according to the state's own Daniel's Law information page, run by the Department of Community Affairs. Laws like it are narrow by design, protecting specific categories of public officials rather than the public at large, which is part of why advocates describe doxing law in the U.S. as a patchwork rather than a single standard.

Swatting, by contrast, is more consistently treated as a serious crime because it typically involves a false report to law enforcement, which is itself illegal in most jurisdictions, in addition to whatever charges might apply to the underlying doxing or harassment.

How Social Platforms Handle Doxing

Because the law is inconsistent, most of the day-to-day enforcement against doxing actually happens through platform policies rather than courts. X's help center addresses the practice directly, telling users that sharing someone's private information without their permission, including a home address or physical location, is a policy violation the company refers to by name as doxxing, and that doing so "can pose serious safety and security risks for those affected," per X's private information policy.

Meta doesn't use the word "doxing" in its own rulebook, but its Community Standards cover much of the same ground under a "Privacy Violations" policy. Meta prohibits sharing someone else's personal contact information and bans posting another person's full private home address, including building names or map pins, even through links to off-platform sources, with narrow exceptions such as information the person has made public themselves or details shared to help find a missing person, animal, or lost property, according to Meta's Community Standards on privacy violations. The same policy states that Meta removes "private information that could lead to physical or financial harm," including information obtained from hacked sources, and separately bars posting partial addresses when they're used to organize a protest at, or otherwise surveil, someone's home.

How to Protect Yourself From Doxing

No set of precautions makes doxing impossible, but several concrete steps meaningfully reduce how much an attacker can find and how fast. New York's ITS advisory and the FBI's swatting PSA both converge on a similar list.

The FBI's IC3 adds a few swatting-specific precautions on top of that baseline: periodically reviewing your own online presence for sensitive details that could enable an attack, and being mindful that photos and videos can be exploited or manipulated by people looking to target you. NY ITS likewise recommends using an alias for public-facing content and, if you believe you're at elevated risk, asking your local police department directly about any preventive measures it offers.

Warning Signs You May Be a Target

Doxing campaigns often don't come out of nowhere. According to NY ITS guidance, warning signs can include a sudden spike in unsolicited mail, deliveries, or sign-ups you didn't request, strangers referencing personal details you never shared with them, or a public dispute on social media, a forum, or in a comment section that escalates in tone just before information starts circulating. None of these guarantee that a dox is coming, but they're worth treating as a prompt to tighten privacy settings and check what a search of your own name currently returns.

What to Do If You've Been Doxed

If your personal information has already been posted, speed and documentation both matter.

• Document everything first. Take screenshots and save URLs, timestamps, usernames, and any recordings, even of content that's embarrassing. NY ITS's guidance is explicit that this evidence matters regardless of how the content makes you feel about preserving it.
• Report it to the platform. Use the site's built-in reporting tools, such as "Report Violation" or "Report Abuse," and cite the specific policy, X's private information rules or Meta's privacy violations standard, where applicable, since naming the exact rule can speed up review.
• Lock down your accounts. Change passwords, enable multi-factor authentication, and check for unfamiliar login activity, since a dox is sometimes paired with an attempt to take over accounts directly.
• Loop in law enforcement if there's a threat. If the posted information comes with threats, or you believe you're at risk of swatting, contact local police. For credible leads, threats, or criminal activity more broadly, the FBI's Internet Crime Complaint Center can be reached at ic3.gov, by calling 1-800-CALL-FBI, through a local field office, or at tips.fbi.gov; always call 911 first for an immediate emergency.
• Get legal guidance if the harassment continues. Because doxing law varies so much by state, an attorney who handles cyber law or privacy matters can tell you whether a cease-and-desist letter, a civil complaint, or an existing harassment or stalking statute applies in your situation.
• Keep checking for re-exposure. Information removed from one site or post can reappear elsewhere, particularly on people-search sites that continually re-scrape public records, so periodic rechecks are part of recovery, not just prevention.

Frequently Asked Questions

What is doxing in simple terms? It's publishing someone's private or identifying information online, often a home address, phone number, or workplace, without their permission, usually to harass, intimidate, or expose them.

Is doxing illegal? There's no single federal law against doxing itself in the U.S. Whether it's illegal depends on your state and what was done with the information; existing harassment, stalking, defamation, fraud, or threat laws may apply even where no statute uses the word "doxing," and a handful of states have passed narrower laws protecting specific groups, such as New Jersey's Daniel's Law for judges and law enforcement officers.

What is the difference between doxing and swatting? Doxing is publishing private information; swatting is a false emergency report, often built from information surfaced through doxing, designed to send an armed police response to a target's location. Swatting is the more immediately dangerous escalation of the two.

How do people find someone's home address online? Commonly through people-search or data-broker sites that compile public records and scraped social media data, reverse address or phone lookups, old posts that reveal location details, or photo metadata that wasn't stripped before posting.

What should I do if I'm doxed? Document the posts with screenshots and URLs, report the content to the platform under its private-information or privacy-violation policy, lock down your accounts with strong passwords and multi-factor authentication, and contact local law enforcement or the FBI's IC3 if you receive threats or fear swatting.

Can I stop my information from showing up on people-search sites? You can reduce it. Most people-search sites offer an opt-out process, though it typically has to be repeated across multiple sites and checked periodically, since new or re-scraped data can reappear even after a successful opt-out.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage