First 60 minutes: triage
The first hour matters most. The goal: slow the spread, capture proof, and stop yourself from making it worse.
1.Do not engage with the doxxer. No comments, no DMs, no subtweets, no friends piling on. Engagement tells the algorithm the post matters (spreading it further) and gives the doxxer the reaction they wanted. Silence is not weakness here — it’s strategy.
2.Screenshot everything. Posts get deleted, accounts get suspended, evidence disappears. Capture the post, the full URL, the username and profile, the timestamp, and any threatening replies. Save it in two places — your phone AND somewhere off it (email it to yourself, private cloud folder).
3.Tell one trusted person right now. Not the whole internet — one person. You shouldn’t be alone with this, and telling someone creates a witness for the timeline.
4.If you feel physically unsafe, call 911. Address exposed and someone has shown up or made a credible threat of violence — that’s what 911 is for. Don’t minimize it.
First 24 hours: containment
1.Lock down your accounts. Social profiles private (temporarily). Change passwords on email and financial accounts — if email is compromised, everything else is at risk, so start there. 2FA everywhere, authenticator app over SMS. Sign out unrecognized devices.
2.Strip identifying details from your own profiles. City, age, school, employer, gym, the coffee shop you tag every morning — take it down. The less a stranger can confirm, the better.
3.Report to the platforms hosting the dox. X has a private-information policy; Reddit a personal-information report form; Telegram takes reports at abuse@telegram.org; TikTok/Instagram/Facebook via in-app “personal information shared without consent.” Be calm and specific: link the post, state it’s private info shared without consent, ask for immediate removal. 4.Search yourself. Real name, stage name, phone number — Google, Bing, DuckDuckGo, plus Reddit, X, and Telegram channels. Write down every URL. You need the full picture before you can clean it up.
5.Alert your bank and payment apps. Ask for a harassment flag and unusual-activity monitoring on cards, Venmo, CashApp, PayPal, and your payout processor. Set transaction alerts.
First week: removal
1.Submit data-broker opt-outs. Spokeo, BeenVerified, WhitePages, Radaris, FastPeopleSearch — 50+ brokers that copy each other. Opt out one at a time free (slow, tedious) or use a service: DeleteMe (ongoing scans), Kanary (free community tier), Optery (free exposure report). The exact one matters less than starting. 2.Use Google’s “Results about you” tool (google.com/results-about-you) to remove search results showing your phone, email, home address, or ID numbers — as of 2026 it also handles non-consensual explicit images. It doesn’t delete the page, but makes it far harder to find. 3.Send DMCA takedowns where your content is being reposted to dox you — that’s copyright infringement on top of everything else. Our free notice writer builds the letter. 4.If your home address is exposed, get private mail. A USPS P.O. Box for most mail, or a CMRA (UPS Store, Anytime Mailbox) for a real street address. Don’t file a USPS change-of-address to hide — USPS sells change-of-address data through licensed vendors and it can leak the new address.
5.Consider a temporary stay elsewhere. If your address is out and you feel unsafe, leave for a few days — time and distance lower the risk while emotions are highest.
TAKE IT DOWN Act and other legal options
If the dox includes intimate images shared without consent, the federal TAKE IT DOWN Act now requires platforms to remove that content within 48 hours of a valid report. It covers NCII specifically — an address or workplace posted with no intimate content is outside its scope.
For doxxing without intimate content, options depend on state law: many states criminalize publishing personal info with intent to harass, threaten, or stalk (enforcement is uneven). Civil options — invasion of privacy, intentional infliction of emotional distress, harassment claims — vary by jurisdiction; slow and expensive, but the threat of a suit sometimes gets a doxxer to back off.
The CCRI Image Abuse Helpline (1-844-878-2274, free, 24/7) can refer you to lawyers who handle these cases; EFF’s Surveillance Self-Defense has privacy and security guides.
Police: when, and when not
This is the section we wish we didn’t have to write. Sex workers have not historically been served well by police, and in some states reporting a doxxing has led to creators themselves being investigated. So we don’t say “always call the police.” We say: think carefully.
•Immediate physical danger? Call 911. Doxxing that turns into stalking or violence is a crime against you, and you deserve protection.
•Explicit threat of violence? Filing a report creates a record that matters if things escalate — and doesn’t require you to push for prosecution.
•Just info exposure, no threat? A report may help documentation (especially for civil action). It may also do nothing.
•Live where sex work is criminalized? Be especially careful. Talk to a sex-worker-led org first — SWOP chapters and BAWS can tell you what reporting has actually looked like for creators in your area.
If you do file: bring screenshots, the URL list, and a calm written timeline. Ask for the report number and a copy.
Telling people in your life
The instinct is to hide it. Don’t. Creators who’ve been through this say the same thing after: telling people preemptively was less stressful than them finding out elsewhere. You control the framing. You don’t have to tell everyone — just the people whose lives might be affected.
Family: “Something’s happening online that I want you to hear from me first. Someone shared private info about me as a way to harass me. I’m safe, I’m handling it, and I wanted you to know in case anyone contacts you.”
Partner: “I need to tell you something and I need you to listen first, then we can talk. Someone doxxed me. Here’s what’s happening, here’s what I’m doing, here’s what I need from you.”
Day-job employer: “I want to give you a heads-up about a personal situation. Someone is harassing me online and may have shared my work info. If anyone calls or emails about me, please don’t engage and please let me know.”
You do not owe anyone the full story. A short, calm version is enough.
Mental health after a dox
This is part of the recovery, not a footnote. Doxxing is a violation — scared, ashamed, angry, numb, or all four at once is reasonable. PTSD-like symptoms (sleep problems, hypervigilance, intrusive thoughts, avoiding your phone) are common in the weeks after. They don’t mean you’re weak; they mean a thing happened to you.
•988 Suicide & Crisis Lifeline — call or text 988, 24/7, free and confidential, for acute crisis
•A regular trauma-experienced therapist — our therapist guide covers how to vet one Keep moving on the practical steps even if you feel terrible. Both can be true at once.
Long-term: rebuilding privacy
1.Use a stage name and protect it like an asset — never linked to your real name in domain registrations, payment accounts, or cross-platform usernames.
2.Separate identities: stage email (ProtonMail or dedicated Gmail), stage phone number (Google Voice or second-line app), separate bank account for creator income.
3.Talk to a CPA about an LLC — it can keep your personal name off payout records in many cases. See our LLC guide. 4.VPN, always — a reputable paid one. Free VPNs often log and sell traffic.
5.Quarterly self-audit: search your real name, stage name, phone, and email every three months. Clean up what leaks.
6.Ongoing data-broker monitoring — brokers re-list; one-time removal is not enough.
Preventing the next one
1.Watermark your content — visible marks deter reposting; invisible ones trace leaks.
2.Don’t reuse usernames across platforms — one shared handle maps your whole presence.
3.Strip photo metadata — phone cameras embed EXIF data including GPS coordinates. Remove it before posting.
4.Watch your backgrounds: posters, window views, license plates, mail, mirrors. People will pixel-peep — stage your set so nothing identifies the location.
5.Never post timestamped content from your real location while you’re still there. Post the gym selfie from home.
6.Vet new fans and clients carefully — many doxxes start as a parasocial relationship that turned hostile. Boundaries aren’t rude; they’re safety.
Where AIU stands
Doxxing is violence. Creators do not deserve it. Period. Platforms should remove this content in hours, not days — the law’s 48-hour window is a ceiling, not a goal. Platforms with public NCII contacts include OnlyFans, Fansly, and LoyalFans. If yours doesn’t have one, ask why.
Resources
Crisis and immediate support
Legal, rights, and removal
•SWOP USA (find a local chapter) and BAWS
FAQ
What is doxxing?
Publishing your private personal information — real name, address, phone, workplace, family details — without consent, almost always to harass, intimidate, or harm. For adult creators it often pairs stage identity with real identity to “out” you.
What do I do if my home address is leaked?
Screenshot and report under the platform’s private-information policy; leave for a few days if unsafe; set up a P.O. Box or CMRA so future mail doesn’t pull to the leaked address. In-person threat or someone shows up: 911.
Should I call the police?
911 for immediate danger or credible violence threats. For exposure without threats, a report documents but may not lead to action — and in states where sex work is criminalized, talk to a sex-worker-led org like SWOP or BAWS first.
How do I get off data broker sites?
Free: each broker’s opt-out page, one at a time (50+ of them). Paid: DeleteMe, Kanary, or Optery automate it and re-check. Either way it’s not one-time — brokers re-list.
Is doxxing illegal?
Depends on the state and what was shared. Many states criminalize publishing personal info with intent to harass; the TAKE IT DOWN Act covers non-consensual intimate imagery with a 48-hour removal duty. Civil claims may also apply — ask an attorney in your state.
Can I sue someone who doxxed me?
Possibly — invasion of privacy, emotional distress, harassment, depending on the state. Slow and expensive, and identifying the doxxer may itself take legal action — but sometimes the threat of a suit is enough. CCRI can refer attorneys.
What if I’m doxxed by an ex-partner?
Sadly common. Intimate-partner doxxing — especially with images — is often covered by both NCII laws and domestic-violence statutes, and a protective order may be available. The National Domestic Violence Hotline is 1-800-799-7233.
This guide is educational — not legal advice or mental-health treatment. Laws change and your situation is unique; only an attorney licensed in your state can advise on a specific case. In acute crisis, call or text 988 now.
