Doxing is the deliberate publishing of someone’s private or identifying information online without their consent, done to expose them to harassment, threats, or real-world harm. The word comes from 1990s hacker slang for “dropping docs” on a rival, and it now covers any campaign that strips away the separation between a person’s online identity and their physical life. Doxing can trigger federal criminal charges under stalking and threat statutes, and at least 19 states have passed laws aimed specifically at the conduct.
What Counts as Doxing
The information involved doesn’t have to be secret in an absolute sense. A home address sits in property records. A phone number might live on a forgotten forum post. What turns ordinary data into a doxing attack is the intent behind compiling and broadcasting it: the person releasing the information wants strangers to use it against the target.
That motive is what separates doxing from legitimate research. Journalists investigate public figures. Employers run background checks. Doxing happens when someone unmasks an anonymous account or aggregates scattered personal details specifically to invite abuse. The perpetrator bridges the gap between a person’s digital presence and their physical existence, and that bridge is where the harm starts.
Information Typically Exposed
A doxing attack is designed to give hostile strangers a roadmap. The details most commonly published are full legal names, home addresses, personal phone numbers, and the email addresses tied to account recovery. In severe cases, perpetrators post Social Security numbers, financial account information, or private photographs pulled from restricted social media.
Workplace information is a frequent target because it extends harassment beyond the home. When an employer’s name and address appear alongside accusations, true or not, the victim faces professional fallout on top of personal danger. Coworkers, clients, and supervisors start receiving hostile messages. Some victims lose their jobs even when the exposed claims turn out to be inaccurate, simply because the disruption becomes unmanageable.
The downstream effects go well beyond embarrassment. Victims commonly report severe anxiety, depression, and symptoms consistent with PTSD. The fear of physical violence is constant once strangers know where you live and work, and many victims spend months cleaning up compromised accounts and financial records.
How Perpetrators Gather the Information
People who dox rarely find everything they need in one place. They piece together a profile from dozens of small data points. The process usually starts with open-source intelligence gathering: scanning social media, public records, voter registrations, and court filings for any identifying detail. A username reused across platforms, a location tagged in a photo, or a pet’s name dropped in a comment can be enough to tie an anonymous handle to a real person.
Data brokers accelerate the work. Companies that compile and sell personal data, including historical addresses, phone numbers, and known associates, will hand over a detailed profile to anyone willing to pay. Privacy advocates recommend opting out of these databases before an incident rather than scrambling afterward.
Social engineering is another common route. The attacker impersonates a service provider, IT helpdesk, or trusted contact to trick the target or someone close to them into revealing sensitive details. A convincing phone call is sometimes all it takes to get a customer service representative to hand over account information. Technical methods matter too: IP logging, where a target clicks a disguised link that records their network address, can narrow down a person’s general location, and on unsecured networks, packet interception lets an attacker capture data moving between a device and a server in real time.
AI-powered facial recognition has added a newer dimension. Reverse image search engines can match a single photograph against billions of indexed images, connecting an anonymous profile picture to other accounts, news articles, or employer directories where the same face appears next to a real name. Visual anonymity is much harder to hold onto than it was even a few years ago.
Why Doxing Is Dangerous: The Swatting Connection
One of the most dangerous consequences of doxing is swatting. Someone uses a leaked address to file a fake emergency call, typically claiming an armed hostage situation or active shooter at that location, and a heavily armed police response arrives at an unsuspecting person’s home. The victim is suddenly in immediate physical danger from officers who believe they are responding to a violent crime in progress.
The FBI has described swatting as a serious crime with potentially lethal consequences and has arrested numerous individuals on federal charges stemming from swatting incidents.1Federal Bureau of Investigation. The Crime of Swatting – Fake 9-1-1 Calls Have Real Consequences Most people who engage in swatting are serial offenders involved in other cybercrimes, and sentences in federal cases have exceeded 11 years in prison. This is the clearest reason doxing is not treated as a harmless prank: publishing someone’s address can directly lead to a life-threatening encounter with law enforcement.
Is Doxing Illegal?
No single federal statute uses the word “doxing,” but several existing laws cover the conduct. The most directly relevant is 18 U.S.C. § 2261A, the federal stalking statute, which makes it a crime to use electronic communication or any internet service to engage in a course of conduct that causes or would reasonably be expected to cause substantial emotional distress, when done with the intent to harass or intimidate.2Office of the Law Revision Counsel. 18 USC 2261A – Stalking Doxing campaigns frequently meet this standard because publishing private details to invite pile-on harassment is exactly the kind of conduct the statute targets. A general violation carries up to five years in prison, and penalties scale upward if the victim suffers serious injury or dies as a result.3Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
A separate federal law, 18 U.S.C. § 119, specifically criminalizes publishing the personal information of certain protected individuals, including federal officers, jurors, and witnesses in federal proceedings, when done with intent to threaten or facilitate violence. The penalty is up to five years in prison.4Office of the Law Revision Counsel. 18 US Code 119 – Protection of Individuals Performing Certain Official Duties When doxing is accompanied by explicit threats, 18 U.S.C. § 875 can apply, with penalties running from two years for threats against property or reputation up to twenty years when the threat is tied to extortion.5Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications
At the state level, at least 19 states have passed laws that specifically address doxing, and the number continues to grow. These statutes generally prohibit publishing someone’s personal identifying information without consent when done with the intent to cause harm or harassment. Penalties range from low-level misdemeanors to felonies carrying years in prison, with severity often increasing if the victim suffers physical harm or if the offender has prior doxing convictions. Nine states, including California, Connecticut, Kentucky, and Washington, allow victims to pursue both criminal charges and civil lawsuits. Civil remedies cover costs like security upgrades, relocation, lost wages, and therapy, which means a single doxing incident can produce prison time and a substantial monetary judgment.
What to Do If You’ve Been Doxed
Speed matters. The longer your information circulates, the harder it is to contain.
Document everything first. Before any content disappears, screenshot every post, message, and comment that contains your information, and capture timestamps, usernames, and URLs. This evidence is what you’ll rely on for a police report or a civil claim later.
Report the content to the platforms where it appears. Every major social media site has a doxing reporting mechanism. For search results, Google offers a “Results about you” tool that lets you request removal of personal contact information, including your home address, phone number, and email, from search listings.6Google. Find and Remove Personal Info in Google Search Results
If your Social Security number, date of birth, or financial details were exposed, place a credit freeze with Equifax, Experian, and TransUnion. A freeze prevents anyone from opening new accounts in your name, costs nothing, and doesn’t affect your credit score. A fraud alert is a lighter alternative that requires lenders to verify your identity before extending credit.7Federal Trade Commission. Credit Freezes and Fraud Alerts
File a report with your local police, especially if the doxing includes threats or has already produced harassment at your home or workplace. A police report creates an official record and is often required for an extended fraud alert or a civil lawsuit. For cybercrimes that cross state lines, you can file a complaint with the FBI’s Internet Crime Complaint Center, which encourages victims to report even when they’re unsure whether their situation qualifies.8Internet Crime Complaint Center. IC3 Home Page
Reducing Your Exposure Before It Happens
The best time to limit your digital footprint is before anyone targets you. Start with social media. Set profiles to private or friends-only. Remove your home address, workplace, and phone number from any profile fields. Audit your post history for location tags, photos of your home’s exterior, or mentions of your daily routine, and disable settings that let strangers tag you.
Then tackle data brokers. People-search sites like Spokeo, WhitePages, and BeenVerified compile and sell detailed personal profiles, and each one has its own opt-out process. Submitting removal requests individually is tedious but worthwhile. Some paid privacy services automate the process across dozens of brokers at once.
Use unique usernames for each platform. A single handle reused across sites is one of the easiest ways for someone to connect your accounts and piece together a full profile. A password manager makes juggling different credentials painless. Turn on two-factor authentication everywhere it’s available, and avoid security questions with answers that can be found on social media, like your mother’s maiden name, the street you grew up on, or your first pet.
Finally, be cautious about what you share in online arguments. Doxing often starts with a personal conflict that escalates. The less identifying information you’ve left scattered across the internet, the less ammunition anyone has if they decide to come after you.