Twitter (X) doxxing: how to report it and protect yourself

Identity theft. Updated 2026-09-13. About 5 minutes to read.

Save evidence, report every post under X's private information rules, then protect your posts and turn off discoverability by email and phone.

Doxxing on X, the platform formerly called Twitter, means someone posts your private details so others can find, contact or harass you. X's Private information policy bans sharing home addresses, non-public phone numbers, ID documents and similar details without permission, and it also bans threatening to expose them.

If it is happening now, deal with safety first, then evidence, then reporting and lockdown. The steps below use X's current menu names, which change regularly, so look for the closest match if a label differs.

If your details were just posted: do this first

  1. If there is any threat of violence or someone mentions your home, call 911 in the US, 000 in Australia or 999 in the UK.
  2. Screenshot each post with the username, the post link and the time visible. Copy the links into a dated document.
  3. Report each post (see below). Ask trusted friends to report too, which helps when the post is spreading.
  4. Block or mute the accounts involved and do not quote-post or reply.
  5. Turn on Protect your posts for now. You can turn it off once things calm down.
  6. Warn family, your workplace and your building manager not to confirm details to unknown callers or visitors.

What X treats as private information

X's policy, last updated in March 2024, lists information you cannot share about someone else without their permission. X says it treats physical location and phone numbers as higher risk than other details, and it may act on a posted home address even if that address is public elsewhere.

  • Home address or physical location, including GPS coordinates.
  • Government IDs, Social Security numbers and other national identity numbers.
  • Non-public phone numbers and email addresses, and passwords.
  • Bank account and card details, and health information such as medical records.
  • The identity of an anonymous account, such as its owner's name or photo.
  • Offering or asking for a bounty to post or not post someone's information.

X does not treat names, birthdates, ages, places of education or employment, or descriptions of appearance as private. A post naming your employer may stay up unless it is part of wider harassment.

Report doxxing to X

X's penalties include requiring the post to be deleted and putting the account in read-only mode for a period. Accounts whose main purpose is posting other people's private information can be suspended.

  1. On the post, tap the three-dot menu and choose Report post.
  2. Choose the privacy option, then the one for sharing private information. Follow the prompts to say whose information it is.
  3. If you are the person in the post, say so. X says anyone can report information shared in a clearly abusive way, but otherwise it may need to hear from you or an authorised representative such as a lawyer.
  4. For accounts that exist only to post your details, report the account from its profile page as well.
  5. If a report option is missing, use X's help centre forms at help.x.com/forms.

Lock down your X account in ten minutes

  1. Protect your posts: tap your profile photo, then Settings and privacy, Privacy and safety, Audience and tagging, and turn on Protect your posts. Only approved followers will see new and old posts.
  2. Hide from lookups: in Privacy and safety, open Discoverability and contacts and turn off Let others find you by your email and Let others find you by your phone.
  3. Turn off location: in Privacy and safety, find the Location section and turn off Precise location. Also set the X app's location permission to Never in your phone settings.
  4. Limit contact: in Privacy and safety, open Direct Messages and stop message requests from people you do not follow. In Audience and tagging, stop others tagging you in photos.
  5. Secure the login: in Settings and privacy, open Security and account access, then Security, and add an authenticator app or security key. X limited text message two-factor authentication to paid subscribers in 2023.
  6. Review Apps and sessions and log out of anything you do not recognise.

How people get identified from X posts

  • Old posts with location tags, or photos showing your street, office or car.
  • Replies from relatives or coworkers who use their real names.
  • A bio link to a personal website, podcast or LinkedIn profile.
  • The same handle used on other sites that show your face.
  • Contact lookups: anyone with your phone number or email could find your account if discoverability was left on.

When to go to police and other help

Report to police when there are threats, repeated unwanted contact, or people using your details to find you offline. Bring your screenshots, links and report log.

  • Australia: publishing personal data in a menacing or harassing way has been a federal offence since December 2024. Call 131 444, and report to the eSafety Commissioner if X does not remove serious abuse.
  • United Kingdom: call 101, or 999 in an emergency. Harassment and stalking laws can apply. In Scotland, contact Police Scotland on 101.
  • United States: report threats to local police and online threats to the FBI at ic3.gov. Several states also have their own doxxing or harassment laws.

Frequently asked questions

Is Twitter doxxing reported differently now that it is X?

The rules carried over. X's Private information policy covers the same kinds of details Twitter's did, and reports are made from the three-dot menu on the post.

X says the information is public elsewhere. Now what?

X may leave up information that was already public, such as a business address. It says it may still remove home addresses because of the risk of physical harm. Remove the original source too, such as a people-search listing.

Does protecting my posts hide my old posts?

Yes. Protected posts, including old ones, are visible only to your approved followers. Posts that others already screenshotted or quoted are outside your control.

Should I delete my X account?

Deactivating does not remove other people's posts about you. Report first and keep the account until your reports are resolved, because you may need it to follow up.

Should I tell my employer?

If your workplace or work contact details were posted, yes. Ask reception and security not to confirm your schedule or location to callers, and ask IT to watch for phishing aimed at your work email.

Tools that help

Related guides

Sources