My address or number was posted online — what now?
Doxxing is punishable across Europe and platforms remove it under priority rules. Takedown first, then de-index, then dry up the source registers — and treat any threat as a police matter, immediately.
- Assess the threat level honestlyAddress plus threats or a call to action = police today, not tomorrow — most countries prosecute doxxing via harassment, threat or data-protection offences. Pure data dump without threats: proceed with takedowns but still document everything first.
- Freeze the evidenceScreenshots with URLs, usernames, timestamps; save pages as PDF. Takedowns erase the proof you may need for police or damages later.
- Hit the platform’s priority flowReport as “private information/doxxing” — every major platform bans posting private addresses and numbers and the DSA obliges them to act on notices expeditiously. Repost waves: report the copies, request hash-matching where offered.
- De-index your nameGoogle and Bing remove pages exposing private contact data from name-searches under their own policies — faster than legal routes. File per URL; the right-to-be-forgotten flow in our Google guide doubles for this.
- Dry up the sourcesPeople-search sites, leaked databases, open registers: erasure requests (Art. 17 — no lawful basis survives your objection for a doxxing-fodder listing). Check national rules for blocking your address in population and company registers — founders and freelancers can often shield home addresses.
- Harden while it coolsNew number if needed (keep the old SIM for evidence), tighten who-can-find-me settings, review what your own profiles reveal (photos with house numbers, tagged locations), and consider mail redirection where risk is physical.
The legal spine is solid even where no single law says “doxxing”: publishing private contact data to intimidate breaches the GDPR (no legal basis, plus Art. 17 erasure and Art. 82 damages), platform terms, and criminal harassment/threat provisions — the EU’s violence-against-women directive also pushes member states to criminalise cyber-harassment patterns explicitly. Escalate stubborn hosts via their registrar and hosting provider (abuse@ addresses act on doxxing), and loop in your DPA for sites that ignore erasure — a foreign “anonymous” forum with EU visitors is still within GDPR reach. If the poster is identifiable, damages claims are winnable; if it is an ex, connect the dots for police — pattern context changes how seriously reports are taken.
Verified against the sources above on 18 July 2026. Information, not legal advice.