If someone is threatening to dox you, stop responding to them, change your passwords and turn on two-factor authentication, screenshot every threat with usernames and timestamps, and report what’s happening to the platform, your local police, and the FBI’s Internet Crime Complaint Center. Knowing what to do if someone threatens to dox you comes down to two parallel tracks: shrink what they can find about you, and build the paper trail you’ll need if the threat escalates. The person making the threat is counting on panic. A calm, methodical response takes that away from them.
Stop Engaging and Secure Your Accounts
Go silent toward the threatener. Don’t argue, don’t negotiate, don’t try to reason. Every reply gives them what they want: a response, more information about you, or confirmation that the pressure is working.
Then get aggressive about your own security. Change the passwords on your email, social media, cloud storage, and financial accounts, using a long unique password for each. A password manager makes this manageable. Turn on two-factor authentication everywhere it’s offered, and use an authenticator app or passkey rather than SMS codes when you can. SMS codes can be intercepted through a SIM swap if the attacker has enough personal data to fool your phone carrier.
Tighten your social media privacy settings so posts and personal details are visible only to people you actually know. Prune your followers and friends and remove anyone unfamiliar. Check the recovery email and phone number on each account and delete any old or shared recovery methods. If you see an active login session you don’t recognize, log it out and change that password again.
Document Everything Before It Disappears
Threatening content can be deleted or edited at any moment, and once it’s gone, your word stands against theirs. Preserve evidence before you report anything.
Screenshot every threatening message, post, and comment. Make sure each capture shows the username, date, and timestamp. Copy the direct URL to the content and to the threatener’s profile. If threats arrived by email, save the full messages and export the email headers if you can, since the header metadata (server addresses, timestamps) can help investigators trace the source.
Store your evidence somewhere separate from the device where you received the threats. A password-protected cloud folder or an external drive both work. The FBI’s Internet Crime Complaint Center specifically tells victims to keep original evidence in a secure location, because IC3 does not collect attachments through its complaint form and investigators may ask for originals later.1Internet Crime Complaint Center (IC3). Frequently Asked Questions
Scrub What’s Already Findable About You
Before someone else weaponizes your data, see what’s already out there. Search your full name, usernames, phone number, and email across Google, Bing, and the social platforms you’ve used. That self-audit tells you where to focus.
Request Removal From Google Search
Google has a request tool for removing search results that expose specific categories of personal data: home address, phone number, email address, Social Security or tax ID numbers, bank account or credit card numbers, images of your signature or government ID, medical records, and login credentials.2Google Help. Remove My Private Info From Google Search Google’s “Results about you” feature can also alert you when new results containing your contact information appear, so re-posted data gets caught quickly.
One limitation worth understanding: removing a result from Google Search does not delete the content from the website hosting it. For a true takedown, you’ll still need to contact the source site.
Opt Out of People-Search Sites
Sites like Spokeo, WhitePages, and BeenVerified compile profiles from public records that often include your address, phone number, and relatives’ names. Each one has its own opt-out process. Some accept online requests, others require a letter, phone call, or fax, and a few ask for a redacted copy of your government ID. Expect this to be tedious — there are dozens of these brokers and each requires a separate request. Paid services can automate the process across many brokers at once and re-run requests periodically. Whether you do it yourself or hire a service, plan to check back, because brokers regularly repopulate profiles from fresh public records.
Blur Your Home on Google Street View
If your address is exposed, you can request a permanent blur of your residence on Google Maps Street View. Only the homeowner or tenant can submit the request. In Google Maps, open the Street View image of your home, click “Report a Problem,” and complete the form. You’ll need to upload proof of address (a utility bill or bank statement dated within the past six months), with everything redacted except the address and date.3Google Help. Blur Street View Imagery Once approved, the blur is permanent.
Report the Threat
Report to the Platform
Every major social network, forum, and gaming service prohibits harassment and the unauthorized sharing of private information. Find the platform’s reporting tool, submit a detailed report, and point to the specific posts or messages. Enforcement can produce content removal and account suspensions, sometimes within hours. A determined aggressor will create new accounts, but reporting disrupts the current attack and creates a record of the behavior.
File a Local Police Report
If the threat feels credible, references specific details about your location or routines, or mentions physical violence, contact law enforcement. Call your local police department’s non-emergency line and ask about filing a harassment or threat report. Bring your collected evidence and ID to the station. An officer will take your statement and generate an incident report, which you’ll want on file if you later seek a protective order or sue. If police believe you’re in immediate danger, they may be able to act on the spot.
File a Complaint With IC3
For online threats that cross state lines, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The form asks for your contact information, any identifying details you have about the threatener (usernames, email addresses, IPs), and a specific narrative of what happened.1Internet Crime Complaint Center (IC3). Frequently Asked Questions You can paste email headers and other text directly into the complaint, but the system does not accept file attachments. Filing with IC3 does not substitute for a local police report. Do both.
Legal Tools You Can Use
Federal Cyberstalking Law
There is no single federal statute labeled a “doxxing law,” but the federal cyberstalking statute covers much of the same conduct. Under 18 U.S.C. § 2261A, it is a federal crime to use electronic communications in a course of conduct that causes, or would reasonably be expected to cause, substantial emotional distress, or that puts someone in reasonable fear of death or serious bodily injury.4Office of the Law Revision Counsel. 18 USC 2261A – Stalking A doxxing campaign aimed at intimidating a victim or inciting harassment against them can fall squarely within the statute.
Penalties are serious: up to five years in federal prison in the general case, up to ten years if serious bodily injury results, and up to twenty years for permanent disfigurement or life-threatening injury. If the victim dies, the sentence can be life. Violating the statute while a restraining or no-contact order is in place carries a mandatory minimum of one year.5Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
State Doxxing Laws
A growing number of states have passed laws that specifically target doxxing. As of mid-2025, at least 19 states had legislation addressing the intentional publication of personal information, though many focus on protecting public officials.6The Council of State Governments. Doxing – State Protections Against Digital Threats Some provide criminal penalties, others create a civil cause of action that lets victims sue, and some do both. Coverage varies widely, so check your state’s statutes or ask a local attorney what applies to you.
Protective Orders
You can ask a court for a restraining or protective order requiring the aggressor to stop contacting and harassing you. Violating that order is a separate criminal offense, which gives law enforcement an enforceable tool if the behavior continues. Filing fees range from nothing to a few hundred dollars depending on jurisdiction, and some courts offer expedited or same-day processing when the threat is credible.
Not knowing who’s behind the account doesn’t necessarily stop you. Many jurisdictions let you file against a “John Doe” defendant and then use the court process to subpoena platforms or internet service providers for identifying information. The procedures for unmasking anonymous harassers vary a lot by jurisdiction and platform, so this is a point where an attorney’s help pays off.
Civil Lawsuits
You may also be able to sue for monetary damages, seeking compensation for emotional distress, reputational harm, lost income, or out-of-pocket costs the doxxing caused. The practical hurdle is identifying the aggressor by real name and address, since you need that to serve a lawsuit. If your evidence already identifies them, or a court grants a subpoena to unmask them, a civil case becomes viable.
Protect Your Physical Safety
Once your home address is exposed, the threat moves off the screen. Take concrete steps to reduce your real-world exposure.
Most states operate an address confidentiality program, sometimes called “Safe at Home,” that gives victims of stalking, domestic violence, and similar threats a substitute mailing address. More than 40 states and the District of Columbia offer some version. Eligibility rules vary, but stalking victims generally qualify. Once enrolled, you can use the substitute address on public records, voter registration, and other filings so your actual address stays off those documents.
For mail you control now, consider a P.O. box or virtual mailbox and move bank statements, subscriptions, and other correspondence off your home address. If your workplace has security staff or an HR team, give them a brief heads-up so they can screen for suspicious visitors or calls. You don’t owe them the full story — a short note that you’re dealing with an online harassment situation and want extra caution around your schedule or location is enough.
Review the basics at home too: working exterior lighting, solid locks on doors and windows, and a doorbell camera if you don’t already have one. These steps matter most in the first few weeks after a threat, when the aggressor’s motivation is highest and your information is freshest in their hands.