Hour one: save the evidence
Save everything before anything is deleted. Take full screenshots that show the address bar and the date and time, and save the links and the names of the accounts involved. When the material is deleted, the evidence is gone too, so save it before you ask for removal. Keep the file somewhere other than your work computer.
Hour two: report and notify
- Police. File a report and bring the file with the evidence. In the Netherlands, doxxing is a separate criminal offence.
- The platform. Report the content under the platform rules on personal information. This is usually the fastest way to get it removed.
- The people around you. Tell your household, your editor and the reception at your workspace. Anyone who might get a call or a visitor should know.
Day one: removal requests
Under European privacy law, you have the right to ask search engines to remove results that show your personal data. Send removal requests to the sites that host the material, and name the exact pages. Keep a record of what you sent and when. You often have to send a request more than once, and the record shows your earlier requests.
Week one: make your details harder to find
- Relocate the company visiting address away from home if that is where it is registered: deciding your address.
- Ask the municipality to restrict the sharing of your residential data with third parties.
- Change passwords, switch on two-factor authentication everywhere, and check which old accounts still show your address.
- Check what your own posts, photos and videos show about where you live and when you are away.
How to prevent doxxing
Most published details come from ordinary sources, such as an old registration, a domain record, a company address or a photo with a recognisable view. Check these sources in advance, while you are calm, and remove what you can. Then there is much less material to use against you later. For the registers, see who can see what. If one person is behind it, read if you have a stalker.