Details posted online

In the first hour

Do these with the person whose details were posted, at their pace. They decide what happens next.

1. Make sure they’re safe tonight. If a home address, a phone number, a daily routine or family details are out, make a safety plan with them: where they’ll sleep, how they’ll travel and who checks in on them. If it’s their home address, think about somewhere else to stay for a while.
2. Agree with them who is told and what is shared. Nothing gets reported, posted or passed on about them without them.
3. Let someone else do the documenting. A colleague saves every post before anything is reported, blocked or deleted: a screenshot that shows the link, the date and time and the account name, and a copy of the page. The person targeted doesn’t have to look.
4. Report each post and account to the platform, once it’s saved. Posting someone’s personal details breaks most platforms’ rules.
5. Don’t reply to the attackers or share the posts, even to condemn them. Replies tend to draw more attention and more attacks, and sharing carries the details further.

Getting it taken down

Getting posts taken down takes persistence, but it helps. Even when the original stays up, removing posts and the links that point to them means fewer people see the details (Digital First Aid Kit).

Report it to the platform first. Use each platform’s own reporting tools, for every post and every account. It’s what Access Now’s helpline asks people to do first (Access Now). Answers can take days, so note each report number and keep documenting while you wait (Digital First Aid Kit).

If reporting goes nowhere, ask a helpline to escalate, such as Access Now’s Digital Security Helpline, which is free for civil society. It asks people to come back to it if the situation escalates or the content puts someone at physical risk (Access Now). The big platforms keep channels for trusted civil society partners, and helplines use them when ordinary reports fail (Digital Rights Foundation).

Escalation works, but slowly and unevenly. In 2025 the Digital Rights Foundation’s helpline in Pakistan made 221 escalations. TikTok resolved most of the cases sent to it, answering in 1.6 days on average, and WhatsApp resolved all of its cases in 1.5 days on average, while Facebook took 5.4 days and Instagram 6.1. Some cases took from 28 to 90 days or longer, and YouTube rejected many even after repeated follow-ups. Others were rejected or only partly resolved at first, and took more rounds of argument with the platform (Digital Rights Foundation).

For a website rather than a platform, go to the company behind it. Helplines write to the site’s support, security or abuse address, or to the company that hosts it, which they find in the website address’s public registration record (Access Now). Sites hosted where no law holds them to account, or run by people who don’t object to the abuse, may not respond at all. Getting the links to them removed elsewhere still helps (Digital First Aid Kit).

If the person made the photo or video themselves, they usually own the copyright, and a copyright report can work where a privacy report doesn’t. Platforms tend to respond to copyright claims because of what the law requires of them (Digital First Aid Kit).

For intimate images, StopNCII makes a digital fingerprint of each image on your own device and shares only that with the companies taking part, so they can find and remove copies without the image leaving the device. It’s free, and open to the person in the image if they were 18 or over when it was taken (StopNCII).

For search results, Google’s Results about you lets you ask for results showing a home address, phone number or email address to be removed, and can alert you to new ones, where it’s available (Google). Google also removes doxxing content from its results: pages that pair someone’s details with threats or calls to harm them, or that gather a lot of personal details for no good reason. A representative can ask on the person’s behalf (Google). Either way, only the search result goes. The page stays up until its site removes it (Google).

Expect it to come back. Attackers sometimes open new accounts with new names (Access Now). Keep watching for new posts for several weeks, and report each one (SIIRF).

If you’re coordinating the response, SIIRF’s Harassment & Doxxing playbook helps you judge how serious it is and lists the evidence to keep.

Tell people

The person targeted comes first: agree with them what is shared, and with whom (SIIRF). Then think about:

• family members, housemates and colleagues whose details were posted, or who share the address. They may need to take precautions too.
• whoever leads on incidents and on well-being in your incident response plan, straight away
• your director, and whoever speaks for the organisation if you need to respond in public. Describe the attack without repeating the details (SIIRF).
• a lawyer, and the police only where it’s safe and the person agrees (SIIRF). If the people behind it are linked to the government, going to the authorities may make things worse (Access Now).

Write it down

Whoever documents keeps a log for the person targeted (SIIRF):

• a screenshot of every post and message, with the date, time, account name and link
• a copy of each page saved to your own device, before it disappears
• anything that happens offline: calls, visits, letters
• every report you make, with its number and the platform’s answer
• what you did, when you did it and who did it

Store it securely, with copies on your own devices as well as online, and encrypted (Digital First Aid Kit). Your incident response plan says where records are kept and how to keep them without adding harm, and SIIRF’s Incident Log has a format you can copy.

Look after the person

When Tendai’s land and housing rights group in Bulawayo published its report on evictions, an anonymous account posted her phone number and the street she lives on. A colleague took the screenshots and filed the reports, so Tendai, the group’s communications officer, never had to read the posts. She stayed with her sister for a week, and the director called her every evening.

Being targeted like this is frightening, and it reaches into people’s homes and families.

When someone has been doxed or their pictures or other information have been published without their consent, they are often in a very delicate emotional state, so we should put them at ease, treat them seriously, and ensure they know that we believe them and are on their side.

Access Now Digital Security Helpline, Community Documentation

• Let them choose what they see. Offer to read the posts for them: going back over them can hurt all over again (Digital First Aid Kit).
• Offer time off and support, and a counsellor if they want one (SIIRF).
• Check in over the following weeks, not just once (SIIRF), and ask about the family too.

Well-being and care has more on what helps, and where to find support.

Close the way in

When things are calm, work out where the details came from, and make less about your team easy to find (SIIRF):

• Search for your team the way an attacker would, and remove what you can, starting with home addresses and family details. Doxxing shows how.
• Tighten privacy settings, and keep work and personal accounts apart (Social media accounts).
• Check what photos and files give away, such as where a photo was taken (Deleting data safely).
• If the details could only have come from inside, from an account, a shared folder or a list, check who could see them (Who has access) and whether an account was broken into (Account taken over). The Digital First Aid Kit suggests asking how the attackers got them whenever the details were ones only a few people knew (Digital First Aid Kit).
• Agree in advance what the organisation offers anyone targeted, including time off and counselling, and know how to report abuse on each platform you use (Online harassment and abuse).
• Plan before high-profile moments, such as a publication or a protest.

Teach it to your team

Run this as a private team session of about 30 minutes. Make taking part optional, because being targeted can bring back hard memories, and use a made-up colleague, never a real person’s details.

• Prepare: have the scenario below ready, and find the reporting page on each platform your organisation uses.
• Exercise: read out this scenario: an anonymous account has posted a colleague’s home address and phone number, and the post is being shared widely. Who documents? Who reports? Where could your colleague stay tonight? Let the room answer before you do. Then agree who would document for a colleague who’s targeted, and what the organisation would offer them.
• Three questions: What comes first? Why save the posts before reporting them? Why not reply to the attackers?
• Afterwards: offer one-to-one time to anyone the session worried, and answer questions in the team chat. For a longer session, play level 2 of SIIRF’s Chips Down, which has a staff member’s home address posted online.