How to avoid being doxxed: protecting your personal information online

Published: Last updated:

Thanks to the Write the Docs community members and KnowledgeOwl folks who gave feedback on the draft of this post.

Introduction

Doxxing (also spelled doxing) is "the act of publicly revealing previously private personal information about an individual or organization" (wikipedia). Usually, it is done by someone other than the person being doxxed, often with malicious intent.

This article lists some tips for avoiding being doxxed. It's important to note that nothing is foolproof, and if an organisation or individual with resources really wants to find you, they probably will. However, you can take steps to make it more difficult, and hopefully too frustrating for the casual hateful individual to bother with. This article describes both easy steps (meaning ones that don't require any change in behaviour or internet usage), and more difficult ones (steps that may impact your online activity).

Note: this article focuses on advice for people who need to protect their identity because they are vulnerable to specific targeting (for example, targets of hate groups or domestic violence), rather than people who need total online anonymity (such as people living under repressive regimes, or hackers). It assumes the main threat is from individuals, hate groups, and internet strangers, not large companies or government organisations. It is meant to be accessible to people with a range of tech knowledge levels.

For these reasons, I've left out some tools that can help you hide online activity, such as VPNs and Tor. Be aware that your IP address (basically, your computer's address on the internet) could be used to track down your location and identify you. It's unlikely a random person can get this. For example, it shouldn't be possible for someone to get your IP address from a tweet or forum post. However, webservers and website owners can access this information, along with anyone who can get their records. If you do investigate this further, please be aware that neither VPNs nor Tor are a total guarantee of privacy.

Really important warning

There are two basic principles of information on the internet:

Those conversations in a private chatroom? What's stopping someone screenshotting them? That comment you made on a forum 15 years ago? May well still be out there. The adolescent blog you deleted? Could still be stored in the wayback machine.

This means the best practice of life online is to reveal as little as possible, and never say anything that you wouldn't want shown to a potential employer or your mother or the police, or whichever authority is likely to be the biggest threat to you.

However, this is easier for some people than others, and isn't enough to protect everyone. At least two groups face increased risk:

  1. Anyone with an identity that makes them a target of hate is faced with a choice between an offline life, or a degree of risk - even if they never write a controversial tweet or share a silly drunk photo, even if their lives are private.
  2. Some people have the sort of jobs that require putting their info out there: public figures, community organisers, small business owners, the self-employed, and so on.

This article is mainly for group 1. I don't know a solution for group 2. To give a personal example: I'm a low-profile freelancer with a tiny business, and have simply accepted that part of doing business means a lot of my info is out there. If someone gets really frustrated by one of my tutorials, I guess I'm in trouble.

Don't panic

On the one hand, we live in a privacy-invading dystopia and horrifying amounts of personal information are freely available. On the other hand, here's a cat sleeping in a sunbeam:

Photo of a black and white cat napping on the floor in a sunbeam

Figure out your safety level

Some of the steps in the following sections are easy, and should be used by everyone. Others will be time consuming to implement. And a few require ongoing changes to behaviour, and might limit the ways you can act online. Only you can decide how much you need to do. Take some time to really think this over. Weigh your sense of risk and need for privacy against your need to use the internet and your willingness to restrict your behaviour.

How much information is out there?

Start by finding out how much information about you is easily accessible.

Easy steps

These are things you can do without altering your online behaviour or restricting your online presence. While they are 'easy' in that they don't impact your use of the internet, some of them may be time consuming or a bit of a faff (for non-British readers, you need to add faff to your vocabulary - an overcomplicated task, a nuisance).

You don't have to do everything at once. If you don't need to urgently vanish from the internet, you can work through the list gradually.

Anonymise social media and online community identities

Improve security

Delete what you can

Secure your websites

Remove public records

Note: some information cannot be hidden. For example, if you own a home, information about you is likely available through the land registry (in the UK) or similar services in other countries.

Right to be forgotten

Make use of your right to erasure (also known as right to be forgotten), if you have it. This depends on your local laws. Citizens of the UK and EU are given the right to erasure as part of GDPR. This guide by the ICO explains the circumstances where you can ask for your data to be deleted, and how to make a request. Although formally contacting every organisation that has your data and doesn't need it would be a big undertaking, it could be worth doing if you really need privacy. It is a tool you can use to get data fully deleted if a company is failing to fully delete you when you try to delete an account.

More difficult steps

These steps may be more difficult, as they require behavioural changes, or involve other people. Not all of them will be possible for everyone.

Checklist

I've created a checklist for the tips in this article. You can save your own copy of the Google Doc version by following the link to the doc, then selecting File > Make a copy and saving it to your drive. You can also download it in various formats (not all formats will retain the checkbox behaviour).

Wrap up

Remember that even if you do everything on this list and more, a seriously determined person or organisation can still find you. This advice is about reducing the chance of petty trolls tracking you down.

Having given that rather alarming warning, I don't want to trigger horrible anxiety in my readers, so . . . here's another cat picture? That helps, right?

Photo of a black and white cat looking at the camera upside down