Doxxing is the act of publishing someone's private, identifying information online without their consent — usually their home address, phone number, workplace, or family details — in order to harass, intimidate, or endanger them. The information is often technically public already. What makes it doxxing is collecting it into one place and pointing an audience at it.
The word comes from the early 1990s hacking scene, where rivals would "drop dox" — drop documents — to strip away someone's online anonymity and reveal who they really were. Cornell Law School's Legal Information Institute still defines it that way: the release of personal information that may identify an individual, without their consent.
Doxxing, doxing, doxxed, dox — which spelling is correct?
All of them mean the same thing. The spelling never settled because the word came from internet slang rather than formal usage.
- Dox (noun or verb) — the original clipped form of "documents." To dox someone is to publish their personal information.
- Doxx — the same word with a doubled x, now roughly as common as the single-x version.
- Doxxing and doxing — the act itself. Both are widely used; "doxxing" is more common in American usage.
- Doxxed — what happened to the person targeted. "I got doxxed" means someone published your private information.
Style guides disagree, dictionaries list both, and no version is wrong. If you are searching for the doxx meaning or the doxing meaning, you are looking for the same concept.
What information usually gets published
A 2025 SafeHome survey of more than 1,000 U.S. adults found that roughly 4% — about 11.7 million people — say they have been doxxed, and about one in six Americans knows someone who has.
The information published, ranked by how often it appears:
- Full legal name
- Home address
- Phone number
- Email address
- Photos or videos
- Workplace or employer
Beyond that, victims reported having family members' details, Social Security numbers, health records, and financial information exposed. The consequences respondents described were not abstract: anxiety and sleeplessness serious enough to require treatment, financial losses from fraud, damaged professional reputations, job loss, stalking, and threats to physical safety.
Where doxxers actually get the information
This is the part most explanations skip, and it is the part that matters most.
Doxxing is usually not hacking. In the overwhelming majority of cases, nobody breaks into anything. They assemble a profile out of information that is already sitting in public, free, searchable databases — and the largest of those are people-search sites and data brokers.
Type almost any American's name into a site like Whitepages, Spokeo, or TruePeopleSearch and you will typically get, at no cost and with no account: current and previous home addresses, phone numbers, approximate age, relatives and known associates, and sometimes a photo of the house. These companies build those profiles by buying and scraping public records — property deeds, voter files, court filings, marriage licenses — and combining them with purchased marketing data.
Each individual record is harmless. Assembled into one profile, they are a map to your front door. That aggregation is the entire business model of the data broker industry, and it is why removing yourself from these sites is the single most effective anti-doxxing step available to an ordinary person.
Is doxxing illegal?
There is no single federal law that makes doxxing a crime in the general case. Cornell's LII is explicit on this point. What exists instead is a patchwork.
Federal law covers specific victims. 18 U.S.C. § 119 makes it a crime — punishable by up to five years in prison — to publish "restricted personal information" about a "covered person" with intent to threaten or intimidate them, or to incite others to do so. Covered persons include federal officers and employees, servicemembers, federal jurors, witnesses, and informants. If you are not in one of those categories, this statute does not protect you.
Doxxing can qualify as stalking. 18 U.S.C. § 2261A, the federal interstate stalking statute, reaches a course of conduct that would reasonably be expected to cause substantial emotional distress. Doxxing campaigns frequently meet that bar.
A few states have direct laws. As of mid-2025, the National Association of Attorneys General counted three states — Alabama, California, and Illinois — that had made doxxing a standalone crime with its own statutory definition. Everywhere else, prosecutors use existing harassment, stalking, and criminal-intimidation laws.
Congress keeps trying to expand coverage. The Protecting Law Enforcement from Doxxing Act was introduced in the 119th Congress to criminalize publishing federal law enforcement officers' names with intent to obstruct an investigation — another narrow, occupation-specific fix rather than a general one.
The practical takeaway: whether your doxxing is a prosecutable crime depends heavily on who you are, what state you are in, and what the person who did it intended. That is a bad system to depend on, which is why prevention matters more than remedy.
Recent examples
Mass political doxxing. In 2024, more than 5,000 critics of Israel — many of them students — were catalogued on a doxxing site and circulated in "blacklist" campaigns. Targets reported consequences to their employment, immigration status, and personal safety. A separate 2024 incident exposed the members of a private group of Australian Jewish creatives and academics. Doxxing is used across the political spectrum; the mechanic is identical regardless of the cause.
Corporate executive doxxing. In May 2025, a site called luigiwasright.com and a clone, theceodatabase.com, published the names, business emails, mobile numbers, compensation, and LinkedIn profiles of hundreds of Fortune 500 executives. The NAAG notes that executive-targeting incidents doubled in 2025 to their highest recorded level.
Doxxing that escalates to swatting. The most dangerous outcome is swatting — using a doxxed home address to trigger an armed police response with a fake emergency call. In March 2025, Alan Filion, an 18-year-old from Lancaster, California, was sentenced to 48 months in federal prison after making more than 375 swatting and threat calls between August 2022 and January 2024, targeting religious institutions, high schools, universities, government officials, and private individuals. He had advertised swatting as a paid service on social media.
Swatting only works if the caller has a real address to send officers to. That address almost always comes from the same place everything else does.
What to do if you have been doxxed
1. Document everything first. Screenshot the posts, the URLs, timestamps, and usernames before anything gets deleted. If this becomes a police report or a civil claim, contemporaneous evidence is what makes it actionable.
2. Report it to the platform. Every major platform prohibits publishing private information. Use the specific "private information" or "doxxing" report category rather than generic harassment — it routes to different reviewers and usually moves faster.
3. Contact law enforcement if there is any threat. If the doxxing includes a threat, or if you see signs of a swatting setup, file a report. Proactively registering your address with your local police department's non-emergency line can also flag your home in the dispatch system.
4. Lock down your accounts. Assume the person has enough information to attempt account recovery. Change passwords, turn on multi-factor authentication, and consider a credit freeze — which is free at all three bureaus.
5. Start removing the source data. Taking down one post does not help if the underlying profile is still one search away. Work through the people-search sites and brokers directly. Our guide to removing your personal information from the internet walks the full process.
How to protect yourself before it happens
- Opt out of people-search sites. This is the highest-leverage action, because it removes the raw material. Start with the largest aggregators — Whitepages, Spokeo, BeenVerified, and TruePeopleSearch — since the smaller sites largely resell their data.
- Separate your real identity from your accounts. Different usernames, a dedicated email address, and no reuse of profile photos between anonymous and real-name accounts. Reverse image search is a standard first step for anyone trying to unmask you.
- Reduce what your social profiles give away. Geotagged photos, employer listings, and visible friends-and-family lists are all standard doxxing inputs.
- Use a substitute address where you can. A PO box or virtual mailbox on new records limits what future public-records scraping picks up.
- Recheck periodically. People-search sites repopulate from upstream sources, so a removal you filed last year may not still hold.
Frequently asked questions
Is doxxing a crime? Sometimes. There is no general federal anti-doxxing statute. It is a standalone crime in Alabama, California, and Illinois; a federal crime under 18 U.S.C. § 119 when the target is a covered official; and elsewhere is prosecuted under stalking, harassment, or intimidation laws depending on intent and consequences.
What is the difference between doxxing and swatting? Doxxing publishes your information. Swatting uses it — typically your home address — to trigger a false emergency call and an armed police response. Swatting is the more dangerous escalation and is prosecuted more aggressively.
Can doxxed information be removed? Individual posts can be reported and often taken down. The underlying records on people-search sites and data brokers have to be removed separately, site by site, through each company's opt-out process.
How long does removal take? Individual opt-outs typically take anywhere from 24 hours to several weeks depending on the site. The harder problem is that records commonly reappear at the next data refresh, so removal works best as a recurring process rather than a one-time cleanup.
Does going private on social media stop doxxing? It helps, but it does not address the main source. Most of the information used in doxxing comes from public records and data brokers, not from your social accounts.