Lesson 8 of 9 · about 17 minutes

Doxxing and Online Harassment

You'll be able to

Find and remove your listings on people-search and data broker sites
Use tools like Google's Results about you and, for Californians, the DROP platform
Lock down social media settings that leak location and family details
Document harassment in a form platforms and police can act on, and find support from CPJ and PEN America

Doxxing is publishing someone's private details, usually an address, phone number or family information, to scare them. For writers it often follows a story that angers a group online. The raw material is rarely hacked. It is bought, for a few dollars, from websites that sell profiles of nearly every adult in the country.

You cannot erase yourself from the internet. You can make the cheap, easy search come up empty, which stops most of the people who would bother.

Where your address comes from

Data brokers pull together property records, voter files where states allow it, court filings, old phone books, marketing lists and social media. People-search sites are the storefronts, showing your address, age, phone numbers and relatives for a name search. Many are owned by the same few companies, and many re-list you months after you opt out.

CPJ's Digital Safety Kit notes that journalists are "increasingly targeted by online abusers who comb the internet looking for personal data," and recommends searching for yourself first. So start there.

Step 1: search yourself like an attacker

Search your full name in quotes, with your town, with your old towns, and with your middle initial.
Search your phone numbers and personal email addresses in quotes.
Search your home address in quotes. See which sites show it.
Do an image search of your profile photos to find accounts that reuse them.
Look at what your family members post: a spouse's public photo of the house, a kid's school sports page.

Keep a spreadsheet: site, what it shows, opt-out link, date requested, date confirmed removed, date to re-check.

Step 2: opt out

Each people-search site has its own opt-out form. Some want an email confirmation, some want you to find your exact listing URL, a few want a phone call. The volunteer-maintained Big Ass Data Broker Opt-Out List (updated August 2026) links the opt-out pages and marks which sites to do first, starting with core people-search sites such as Spokeo, Intelius, BeenVerified and Radaris.

Example: what the opt-out work costs in time

Theo writes about a zoning fight in the invented town of Marrow Creek. His search turns up 30 people-search sites with his address.

At about 12 minutes per site (finding the listing, the form, the confirmation email): 30 x 12 = 360 minutes = 6 hours.
Brokers re-list people. If he re-checks every quarter and, say, a third of sites have re-listed him: 30 / 3 = 10 sites x 12 minutes = 2 hours per quarter.
Yearly: 6 hours up front, then about 2 hours x 4 quarters = 8 hours per year.

Paid removal services file these requests for a yearly fee. They save time and cover a fixed list of brokers. Before paying, compare their list to your spreadsheet, since none covers everything.

Tools that help

Tool	Who can use it	What it does	Limit
Google Results about you	Anyone with a Google account	Finds search results showing your phone, address or email; you request removal; alerts for new ones	Removes from Google Search only; the page still exists on the source site
California DROP	California consumers	One request asks every registered data broker to delete your data	Brokers had to start processing August 1, 2026, checking at least every 45 days; limited exceptions apply
Individual opt-out forms	Anyone	Removes your listing from one site	Many sites; re-listing is common
Credit freeze	Anyone in the U.S.	Blocks new credit accounts in your name; free at each of the three bureaus	Does not hide your address; protects against the identity theft that sometimes follows doxxing

Sources: Google, California Privacy Protection Agency, FTC. Several other states have passed privacy laws that give residents rights to delete data from some companies. Check your own state's attorney general website for what applies to you.

Step 3: lock down social accounts

Separate public and personal. A public account for your work, a private one for family. Different usernames, different photos, no links between them.
Review old posts. Photos of your house, street signs, your car's plate, your kids in school uniforms. Archive or delete them.
Turn off location tagging on posts and photos, and strip location from photos before posting (AVPrep's Images tab, covered in lesson 6).
Hide friend and follower lists where the platform allows, so relatives are not one click away.
Check tagging settings so others cannot tag you in photos without approval.
Turn on the strongest two-factor available. Harassment campaigns often try to take over accounts to post as you.

Talk to family before a big story runs. Ask them to lock their accounts for a while and not to engage with strangers asking about you. The easiest route to a writer's address is often a cousin's public birthday post.

Documenting harassment

If harassment starts, evidence decides what platforms and police will do. PEN America's Online Harassment Field Manual lays out the method:

Screenshot everything, including the URL, the account name and the date and time. Full-page capture tools help with long threads.
Save links, especially to the harasser's profile, before content is deleted.
Save email headers. Do not forward the original, which can lose the sender's IP information. Copy the content instead.
Log calls and texts with date, time and number.
Keep a complete record, including anything heated you said back. Leaving it out can hurt you later.
Track your reports: what you reported, to whom, when, and how long removal took.
Delegate if reading it is wearing you down. A trusted friend can do the logging.

Example: a harassment log entry

Date and time	Platform	Account	What happened	Evidence file	Action taken
2026-10-03 21:14	Social site	@marrowtruth88	Posted photo of my house with street name visible	2026-10-03_house_post.png, URL saved	Reported under platform's private information rule 21:20; removed 2026-10-04 08:05
2026-10-04 07:40	Email	Unknown sender	Message referencing my kid's school	Full header saved as .txt; content copied	Called police non-emergency line, report number logged

Reporting to platforms and police

Most platforms have rules against posting private information and against threats. Report each post under the most specific rule that fits, such as private information or violent threat, which tends to get faster action than a generic harassment report. Keep the confirmation.

Call 911 for any threat that seems imminent or any sign someone is at or near your home. For other threats, file a report with local police and get the report number, even if they do nothing right away. It builds a record. Online threats that cross state lines can be reported to the FBI at tips.fbi.gov. Federal law at 18 U.S.C. 2261A makes it a crime to use the mail, an interactive computer service or an electronic communication service for a course of conduct intended to harass or intimidate that causes reasonable fear of serious harm or substantial emotional distress. States have their own stalking and harassment laws too.

Support

You are not the first writer this has happened to. CPJ publishes resources for protecting against online abuse and an editors' checklist for protecting staff and freelancers. PEN America's field manual has sections on self-care, talking to employers and how friends can help. If you write for an outlet, tell your editor immediately; good outlets have a plan.

Common mix-ups

Claim: "If I opt out once, I'm gone." What the evidence shows: Brokers refresh their data from public records and re-list people. Plan on re-checking every few months.
Claim: "Just ignore them and they'll go away." What the evidence shows: Not engaging is often wise. Not documenting is a mistake. If it escalates, the record is what gets action.
Claim: "Getting Google to remove a result deletes the information." What the evidence shows: Google says the information still exists on the source page. Removal from search makes it harder to find, which still helps.

Checklist

Searched yourself by name, phone, email and address
Opt-out spreadsheet started; high-priority sites done first
Results about you set up with alerts
Credit frozen at all three bureaus
Social accounts split, location off, old posts reviewed
Family briefed before sensitive stories
Harassment log template ready, just in case

Try it

Set a timer for 45 minutes and search yourself the way an angry stranger would. Record every site that shows your address or phone number in a spreadsheet with the columns from step 1. Opt out of the first five high-priority sites on the BADBOOL list and note how long each took. Then set up Google's Results about you and create an empty harassment log with the columns from the example, saved somewhere you can find quickly.

Check yourself

1. Starting August 1, 2026, how often must data brokers check California's DROP platform for deletion requests?

2. What does Google's Results about you tool do when a removal is approved?

3. When documenting a harassing email, why does PEN America say not to forward the original?

4. Which federal statute makes it a crime to use electronic communication services for a course of conduct intended to harass that causes substantial emotional distress?

5. In the worked example, opting out of 30 sites at about 12 minutes each takes how long?

6. Should your own angry replies be left out of your harassment log?

Terms in this lesson

Doxxing: Publishing someone's private information, such as home address, phone or family details, usually to intimidate.
Data broker: A company that collects and sells personal information, often from public records and purchase data.
People-search site: A website that sells or shows profiles with addresses, phone numbers and relatives for a name.
Opt-out: A request telling a company to remove your information or stop selling it.
Harassment log: A dated record of each incident, with links, screenshots and what you did about it.

Full glossary

Sources

California Privacy Protection Agency, Delete Request and Opt-Out Platform (DROP) checked 2026-10
Google Search Help, Results about you checked 2026-10
Big Ass Data Broker Opt-Out List (BADBOOL) checked 2026-10
PEN America, Online Harassment Field Manual checked 2026-10
PEN America, Documenting Online Harassment checked 2026-10
Digital Safety Kit, Committee to Protect Journalists checked 2026-10
18 U.S.C. 2261A, Stalking (Cornell LII) checked 2026-10
FTC, What To Know About Identity Theft (credit freezes and fraud alerts) checked 2026-10