Doxxing on Social Media – Know Your Rights

What Is Doxxing?

Doxxing (also "Doxing") means publishing private or personally identifying information about someone without their consent, typically with the intention of enabling or inciting harassment, threats or real-world harm. The term comes from 'dropping docs' (documents) – originally describing the practice of publicly revealing someone's identity. Today it encompasses a broad range of actions: from publishing a home address to aggregating individually harmless data points into a profile that enables targeting.

Doxxing rarely occurs in isolation. It is frequently used as a tool in coordinated harassment campaigns, sometimes combined with swatting (filing false emergency reports to send police to a victim's address), cyberstalking, harassment and bullying, or hate speech or the publication of non-consensual intimate images. Where these additional harms are present, they may also be reportable under the relevant platform policies.

Common forms of doxxing addressed by platform policies

• Publishing a home address, phone number or email address to enable harassment or threats
• Sharing a person's workplace or school to facilitate targeted contact or physical confrontation
• Revealing someone's legal name when they use a pseudonym for safety reasons
• Publishing personal information about family members to increase pressure on the target
• Aggregating publicly available data points into a harmful profile designed to enable targeting
• Sharing immigration status, health information or other sensitive personal data without consent
• Posting personal information alongside explicit or implicit calls for followers to act on it

Since the Digital Services Act (DSA) came into force, users can challenge unfair moderation decisions through a certified out-of-court dispute settlement body. User Rights is the first such body certified under Article 21 DSA in Europe for social media platforms, certified by the German Federal Network Agency (Bundesnetzagentur). The procedure is free of charge for users. The platform bears the costs. You do not need to complete the platform's internal complaint procedure before turning to User Rights. All we require is proof that you submitted a report or filed an internal appeal through the platform's complaint mechanism. Cases are currently reviewed for platform actions on Instagram, Facebook, TikTok, X, YouTube, LinkedIn, Snapchat and Pinterest. Our assessments are based on platform policies and if applicable, EU and national law. Currently, User Rights is certified for German and Italian Law.

Doxxing and coordinated harassment: an important connection

Doxxing is particularly harmful when it forms part of a coordinated harassment campaign. When an account publishes personal information and simultaneously calls on others to use it, platform enforcement becomes urgent, as the potential for real-world harm escalates rapidly. All platforms covered by User Rights maintain policies against both the sharing of private information and coordinated harassment, and User Rights can review failures to enforce either.

Swatting, meaning filing a false emergency report to send police or emergency services to a victim's address – is one of the most dangerous potential consequences of doxxing. While swatting itself is a matter for law enforcement rather than platform moderation, the doxxing content that enables it remains subject to platform policy. If you are worried you might be an imminent danger, and are the victim of one or multiple coordinated harassment campaigns, please reach out to local law enforcement. If you are in Germany and need dedicated victim support, the organisation Weisser Ring is able to help you further.

Doxxing Policies on Social Media Platforms

All platforms covered by User Rights are subject to the DSA, which requires them to give reasons for moderation decisions and to cooperate with certified dispute settlement bodies. Each platform explicitly prohibits the publication of private personal information without consent in its community standards.

Meta: Instagram and Facebook

While Meta does not use the term 'doxxing' the action is addressed under two separate policy areas: the Privacy Violations and the Harassment and Bullying policy. The policy on Privacy Violations explicitly prohibits the publication of private personal information capable of leading to physical or financial harm. However, the threat to publish personal information is also sanctioned by the Community Standards on Harassment and Bullying. Depending on the context, doxxing may also fall under Meta's policy on Coordinated Harm. This policy prohibits outing, meaning the exposure of a person's identity or location where they belong to a group that outing places at risk, where they have a family or romantic relationship with such a person, or where they have professionally supported such a group, with an exception for politicians.

Important: Meta's Privacy Violations and Image Privacy Rights policy falls outside User Rights' scope of review. If Meta did not remove doxxing content or a moderation decision by Meta was based on the Harassment and Bullying policy, User Rights can review the decision. The dismissal notification from Meta will indicate which policy was applied.

TikTok

TikTok's Community Guidelines address doxxing under its Harassment and Bullying section, which explicitly prohibits sharing personal information to intimidate, shame or target another person. Content that aggregates personal data to enable coordinated targeting is also prohibited. Content shared exclusively via direct messages falls outside User Rights' scope of review.

LinkedIn

LinkedIn's Professional Community Policies prohibit the sharing of personal information to harass or harm others. Members may not reveal others' personal or sensitive information, described in the policy as doxing, and may not incite others to do so. The action of doxxing is removed by LinkedIn as a form of harassment.

In LinkedIn's professional context, doxxing is particularly harmful: publishing a person's personal contact details or sensitive information can damage professional relationships and expose them to targeted harassment in their working life. As professional information is already public, doxxing on LinkedIn usually involves attaching private information, a home address, a personal phone number, family details, to a professional profile, or aggregating publicly visible professional data into a target package.

Pinterest

Pinterest's Community Guidelines prohibit content designed to harass or harm others, including the publication of personal details without consent. Pinterest prohibits content or behaviour revealing personally identifiable or otherwise sensitive information, listing identity documents and more.

Pins or boards that compile personal information about individuals for targeting purposes are a clear violation of Pinterest's harassment and privacy policies.

What is outside User Rights' scope of review

Not every doxxing-related moderation decision falls within User Rights' scope. The following are outside our scope of review:

• Privacy Violations policy at Meta: If Meta's moderation decision was based specifically on its Privacy Violations and Image Privacy Rights policy, that decision falls outside User Rights' scope. Where the same content also engages Meta's Harassment and Bullying policy, that dimension remains reviewable. Check the reason cited in Meta's notification to determine which policy was applied.

Similarly, if you want to make a report of doxxing content which Meta failed to remove, User Rights cannot review it under the Privacy Rights Policy. User Rights will however review any potentially applicable Community Guideline and make an assessment based on the full scope of Community Guidelines.

• Direct messages: User Rights does not review the content of direct messages. If doxxing information was shared exclusively via DMs without any public-facing post or account activity, the platform moderation of those messages is not reviewable. Report the account and any publicly visible content.

A full overview is available on the scope of review page.

Please note: User Rights does not review moderation actions that were taken more than six months ago.

What Can You Do if You Are Affected?

There are two situations in which User Rights can help: a platform has not acted on doxxing content you reported, or your own legitimate content was wrongly removed or restricted as doxxing.

Scenario A: Your personal information was published without consent and the platform has not acted

1. Preserve evidence before reporting: Screenshot the content with the account name, URL, date and time. If the post includes calls for others to act, capture those as well. Once you file a report, content may be removed or become inaccessible – your own record is essential.
2. Report to the platform: Use the in-built reporting function and select the most specific category available – privacy violation, harassment or personal information. Where the content includes explicit calls to harass, report under the harassment or coordinated harm category as well as the privacy category. Keep a record of any reference number or confirmation you receive.
3. Appeal if dismissed: If the platform dismisses your report, use the appeal mechanism via the help centre or the dismissal notification. Note which policy the dismissal cites – this is relevant for determining whether User Rights can review the decision. Keep a record of the response. Please note: You do not have to wait for a response to file a case with User Rights, it is sufficient that a reasonable waiting period of seven days expired.
4. Submit to User Rights: If the platform's inaction was inconsistent with its harassment, bullying or coordinated harm policy, submit a complaint. User Rights will assess whether the platform applied its policy correctly. If User Rights is not able to find a violation of these Community Guidelines, and a violation of the Privacy Violation is potentially present, User Rights is unable to assess it.
5. Consider parallel steps: Depending on the severity and the nature of the threats, you may also wish to contact the police – particularly if the doxxing is accompanied by explicit threats or swatting. These steps are not a prerequisite for User Rights proceedings.

Scenario B: Your legitimate content was wrongly removed or restricted as doxxing

1. Check the reason: Under Art. 17 DSA, platforms must give a specific reason for every moderation action. Identify whether your content was removed under a privacy, harassment or coordinated harm policy and whether that categorisation actually applies. Legitimate cases include journalists publishing information about public figures that is already in the public record, researchers citing publicly available data, or activists documenting harassment campaigns.
2. Appeal internally: Use the platform's appeal mechanism and provide context that demonstrates the legitimate nature of your content – for example, that the information was already public, that you are a journalist acting in the public interest, or that your content documents rather than enables harm.
3. Submit to User Rights: If the internal appeal was unsuccessful or unanswered, submit your case. User Rights will assess whether the removal was consistent with the platform's own policy. If the platform's rejection of your appeal only cites their Privacy Policy, see the scope note above.

Was your content removed for alleged doxxing – or did the platform fail to act on doxxing you reported?

Submit your case to User Rights. Our certified dispute settlement procedure is free of charge for users.