Your home address, phone number, workplace and family members are often only a few searches away from a stranger. When someone collects those details and posts them online to scare or hurt you, that is doxxing.

A username on one forum, a tagged photo on another site and a people-search listing can be enough to find where someone lives. This guide explains what doxxing means, where the term came from, how doxxers find information (including your IP address), where the law stands in the US, and the practical steps that make you a harder target.

What is doxxing?

Doxxing (also spelled doxing) is the act of gathering someone’s private or identifying information and publishing it online without their consent, usually to harass, intimidate or harm them. The US Cybersecurity and Infrastructure Security Agency (CISA) describes doxing as “the practice of taking sensitive information from an individual or organization and releasing it to the public for malicious purposes,” and notes that “anyone can become a victim.”

So what does doxxing mean in practice? The information itself is usually true and often not secret on its own. What makes it doxxing is the combination of three things:

  • Collection. Details are pulled together from many sources into one profile.
  • Exposure. The profile is posted where other people can see it, such as a forum, social media thread or chat group.
  • Intent to harm. The goal is to frighten, shame, punish or put the person at risk, often by inviting others to contact or confront them.

Typical doxxed details include a full name, home address, phone number, personal email, employer and family members. Sometimes the goal is to tie an anonymous account to a real identity.

Where the word doxxing comes from

The word is a spelling of “docs,” short for documents. According to the Wikipedia entry on doxing, it grew out of 1990s hacker culture, where “dropping dox” on a rival meant breaking their anonymity by releasing a file of personal details about them. It was a revenge tactic used inside online communities.

The same article traces online doxing to Usenet forums in the late 1990s and notes that the Gamergate harassment campaign in the mid-2010s brought the term into mainstream awareness.

How doxxing happens

Doxxing rarely needs advanced hacking. Most doxxers stitch together information that is already available, then fill the gaps with a few targeted tricks. Security companies such as Kaspersky list the same common methods.

Social media and reused usernames

Old posts, check-ins, tagged photos, friend lists and “about” sections reveal a surprising amount. If you use the same username across a gaming profile, a forum and a social account, one search can link them all together.

People-search sites and data brokers

Data brokers compile public records, marketing data and other sources into profiles that can include addresses, phone numbers and relatives. Many sell these profiles to anyone who pays. This is one of the fastest routes from a name to a home address, which is why removing your information from the internet is a core part of doxxing defense.

Public records and domain registrations

Property records, court filings and business registrations can show where someone lives or works. If you own a website, a WHOIS lookup can expose your name and contact details unless you turn on your registrar’s privacy option.

Phishing and account breaches

A convincing message can trick you into handing over a password or personal details. Once a doxxer gets into one account, private messages, contacts and saved addresses are exposed. Knowing the common types of phishing attacks helps you spot these attempts.

Your IP address

Every time you visit a website, open a link or join certain online games and voice chats, your device shares its IP address. Kaspersky notes that IP addresses are “linked to users’ physical location,” and doxxers use them as a starting point. An IP address does not reveal your exact street address, but it can point to your approximate area and your internet provider. Combined with other clues, that can narrow down where you are.

It is easier than most people think for someone to get your IP address, for example through a tracking link. You can check what your IP address reveals right now. For a closer look at the risks, read what someone can do with your IP address.

Packet sniffing on unsafe networks

On poorly secured or compromised networks, attackers can capture data as it travels between your device and the internet and look for personal details. Be careful with unknown public Wi-Fi and avoid entering sensitive information on sites that do not use HTTPS.

Is doxxing illegal?

It depends on who is targeted, what is posted, why it is posted, and where you live. Publishing information that is already public is not automatically a crime in the US. It usually becomes illegal when it is done to threaten, harass or endanger someone.

This section is general information, not legal advice. Laws change and vary by state. If you are dealing with doxxing, talk to a licensed attorney in your state and contact law enforcement if you feel unsafe.

Federal law

According to Cornell Law School’s Legal Information Institute, there is currently no comprehensive federal statute that criminalizes doxxing broadly. Two federal laws come closest:

  • 18 U.S.C. § 119. This law makes it a crime to knowingly make “restricted personal information” public about certain protected people, or their immediate family, with the intent to threaten, intimidate or incite a crime of violence against them. Restricted information means a Social Security number, home address, home or mobile phone number, personal email or home fax number. The protected group covers federal officers and employees, federal jurors, witnesses and court officers, informants in federal criminal cases, and state or local officers assisting federal investigations. The maximum penalty is 5 years in prison.
  • 18 U.S.C. § 2261A (stalking). The federal stalking law covers anyone who uses the mail or an interactive computer service or electronic communication system to carry out a “course of conduct” with intent to kill, injure, harass or intimidate someone, where that conduct places the person in reasonable fear of death or serious injury or causes substantial emotional distress. Read the statute. Because it requires a course of conduct, a single post may not be enough on its own.

State laws

States take different approaches to doxxing. A few examples:

  • California has both a criminal and a civil law. Penal Code 653.2 makes it a misdemeanor to electronically distribute someone’s personal identifying information, without consent, with intent to place them in reasonable fear for their safety and to cause harassment or physical contact by a third party. It is punishable by up to one year in county jail, a fine of up to $1,000, or both. Civil Code 1708.89, added in 2024 by AB 1979, lets doxxing victims sue for damages, including statutory damages of $1,500 to $30,000. Its definition of online identifiers explicitly includes IP addresses.
  • Washington passed a civil doxxing law in 2023. RCW 4.24.792 bars publishing someone’s personal identifying information without consent when the publisher intends or knows it will be used to harm them, or acts with reckless disregard for that risk, and the person suffers harm such as physical injury, significant economic injury, mental anguish or a substantial life disruption. The law says it is not a defense that the information was already public.
  • Other states, such as Alabama, have their own doxxing provisions, according to the Legal Information Institute. In states without a specific law, stalking, harassment and threat laws may still apply.

Where free speech fits in

Not everything people call doxxing is illegal. Free speech groups such as FIRE point out that sharing truthful information is often protected by the First Amendment, and that existing laws against true threats, incitement, harassment and public disclosure of private facts already cover much of the harmful conduct linked to doxxing. For a wider look at the rules that govern personal data, see our guide to privacy laws in the US.

How to prevent doxxing

You cannot erase every trace of yourself online, but these steps close the most common doxxing routes.

Search yourself first

Look up your name, usernames, email addresses and phone number the way a stranger would. The North Carolina Department of Information Technology recommends that you “conduct frequent internet searches about yourself and your family.”

Lock down your social media

Set profiles to private where you can, review who can see old posts and tagged photos, and remove birthdays, phone numbers and location details from your posts. NCDIT also advises that you “reconsider using geo-tracking features” on your devices and apps.

Use different usernames and email addresses

Keep separate usernames for gaming, forums and personal accounts, and use a separate email address for sign-ups and newsletters. This breaks the easy links doxxers rely on.

Opt out of data broker sites

Submit opt-out requests to people-search sites, or use a paid removal service if you do not have the time. Our review of Incogni explains how one of these services works. You can also ask Google to remove search results that show your phone number, home address or email through its results removal process. Keep in mind that Google notes this does not delete the information from the website itself.

Secure your accounts

Use long, unique passphrases and turn on multi-factor authentication wherever it is offered. Treat unexpected links and attachments with suspicion, since phishing is a common way into private accounts.

Hide your IP address on your Windows PC

Because your IP address is one of the data points doxxers collect, it is worth keeping it private. A VPN replaces your real IP address with the VPN server’s address, so websites, links and the people behind them see the server, not you. If you use a Windows PC, EonVPN hides your IP address while you browse. You can also learn how to change your IP address on Windows manually.

A VPN will not remove your address from a data broker site or undo a post you already shared, so combine it with the other steps above.

What to do if you have been doxxed

If your information has been posted, act quickly and keep a record of everything.

  1. Make sure you are safe. If you receive threats or feel you are in danger, contact local law enforcement right away.
  2. Document everything. Take screenshots of the posts, messages and profiles involved, and save the URLs and dates. You may need it for the platform, the police or a lawyer.
  3. Report it to the platform. Check the site’s rules on sharing private information and report each post and account involved.
  4. Report online crime. In the US, you can file a complaint with the FBI’s Internet Crime Complaint Center (IC3).
  5. Request removals. Ask site owners to take the information down, submit data broker opt-outs, and use Google’s results removal process for search listings.
  6. Lock down your accounts. Change passwords, turn on multi-factor authentication and review recent login activity.
  7. Protect your credit. Doxxed details can feed into identity theft. The FTC explains that there is no cost to place or lift a credit freeze and that it does not affect your credit score. You need to contact all three bureaus: Equifax, Experian and TransUnion. If your identity is misused, report it at IdentityTheft.gov.
  8. Get legal advice. A lawyer can tell you whether a criminal complaint or a civil claim, such as those available under California and Washington law, makes sense in your case.

Conclusion

Doxxing is the collection and public release of someone’s personal information to harm them. Social media, data brokers, public records, phishing and your IP address give doxxers most of what they need.

The law is catching up but uneven. There is no broad federal doxxing ban, while states such as California and Washington now give victims specific options. Prevention still does most of the work: search yourself, tighten your privacy settings, remove your data from broker sites, secure your accounts and keep your IP address private on your Windows PC with EonVPN.

FAQs

What does doxxing mean in simple terms?

Doxxing means finding someone’s personal details, such as their name, address or phone number, and posting them online without permission, usually to scare, harass or harm them.

Is doxxing illegal in the US?

Sometimes. There is no general federal law against doxxing, but it can be a federal crime when it targets certain protected officials (18 U.S.C. § 119) or amounts to stalking (18 U.S.C. § 2261A). Some states, including California and Washington, have laws aimed at doxxing specifically. This is not legal advice, so check with a lawyer in your state.

Can someone dox you with just your IP address?

An IP address alone usually shows only your approximate area and internet provider, not your home address. The risk comes when doxxers combine it with other details, such as your username, photos or data broker records. Hiding your IP address removes one of those clues.

What is the difference between doxing and doxxing?

There is no difference in meaning. Both spellings are correct and refer to the same act. Some sources, including CISA, use “doxing” with one x, while “doxxing” is also widely used.

How do I know if I have been doxxed?

Warning signs include strangers contacting you who know your address or workplace, a sudden spike in harassment, or finding your details posted on a forum or social media. Searching your own name and usernames regularly helps you catch it early.