Doxxing and how to prevent it

What doxxing is

Doxxing is when someone finds and publishes your private information, usually your legal name, address, workplace or family, with the aim of frightening you, getting you fired or harassed, or pressuring you to stop. For adult creators it is one of the most serious risks of the work, and the people who do it are rarely skilled. They are patient, and they use information you or others left in the open.

How people actually get found

The methods are mundane, which is why they work.

• Reverse image search on a profile photo or a tattoo that also appears on a personal account.
• Reused usernames. The same handle on a gaming forum from years ago, linked to an old email, linked to a real name.
• Data broker sites that sell names, addresses and relatives, searchable by phone number or email.
• Location clues in photos: a landmark through a window, a local shop bag, a regional licence plate, weather you mention on stream.
• Friends and family who follow both your accounts, tag you, or talk about you.
• Shipping. A gift sent to your home, or a return address on something you mailed.
• Old accounts you forgot about, which still have your real name attached.
• Public records in some places, such as business registrations that list an owner's home address.

Making yourself a hard target

You cannot make doxxing impossible, but you can make it expensive and slow, which is enough to stop most people.

• Audit yourself. Search your stage name and your handles, and reverse image search your public photos. Do the same for your legal name and see what comes up.
• Request removal from data broker sites. It is tedious and must be repeated, but it works. Paid removal services exist if you would rather not do it by hand.
• Lock down personal accounts. Set them private, remove your face from public profile pictures, and ask close friends and family not to tag or mention your creator work.
• Use a mailbox service or PO box for anything physical, and ask an accountant or lawyer whether forming a company where you live would publish your home address, and how to avoid that.
• Never reuse a username, email or photo between your two lives.
• Keep two-factor authentication on every account, with an authenticator app rather than text messages where possible.

If it happens

Stay calm and document first. Screenshot everything with timestamps and URLs before reporting, because posts get deleted. Report the posts to the platform where they appear; most have a specific category for publishing private information. Report the account on VestaCreate if it is involved, and a person will read the report. Tell someone you trust. If the information includes your address, or there are threats, contact the police and keep a copy of the report number. The guide on stalkers covers when and how to escalate further.