On this page
You do not need to post your address for a stranger to find your house. One photo shows your school crest, another your bus stop, a third tags a friend whose profile names your colony. Here is how those pieces join up, and a 15-minute audit to run today.
What is doxxing?
UK Government Security, citing the Crown Prosecution Service, describes doxing as "the malicious publication of personal identifying information, such as home addresses, with the intent to harass, silence, or threaten individuals" (UK Government Security). The word is spelt both doxing and doxxing; they mean the same thing.
The same guidance says doxers "only need minimal clues to begin", such as your name, email and social media profiles, and that threatening messages, cyberstalking and harassment can follow.
A NITI Aayog report on children's online safety notes that many children unknowingly share personal details online, including their location, family information and school (NITI Aayog). The same report cites National Crime Records Bureau figures showing cyber crimes against children in India rose 32%, from 1,381 cases in 2021 to 1,823 in 2022.
How do small details add up to finding someone?
No single post gives you away. The combination does. A 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in an anonymised dataset using 15 demographic attributes (Rocher, Hendrickx and de Montjoye, 2019). It studied datasets, not social media, but the lesson carries over: each ordinary detail shrinks the crowd until one person fits.
Take an invented student, Aanya, 15, with a public account:
Her bio says "Class 10, Pune". The crowd: every Class 10 student in a big city.
A first-day-of-term photo shows her uniform and crest. Now: one school.
A 7:20 am story at a bus shelter with the colony name painted on it. Now: one neighbourhood, and a time she is there most weekdays.
A friend tags her in a Diwali photo outside their building gate. Now: a short walk from one gate.
A post says "Sweet 16 next Friday!" Now: a date she is likely to be out celebrating.
Step 4 came from someone else's account: your privacy depends partly on what the people who tag you post.
How do I check my profile for doxxing risks?
Run this 15-minute audit on the account you use most. The settings steps follow UK Government Security's advice (friends-only posts, app permissions, phone number offline) and NITI Aayog's advice to turn off location services in apps.
Minutes 0 to 3, look like a stranger: search your name and username, then open your profile while logged out.
Minutes 3 to 6, clean your bio: remove school, class and section, colony, phone number and birth date.
Minutes 6 to 9, scan your last 30 posts and highlights for four giveaways: uniform, crest or ID card; bus-stop or street signs; house numbers, gates or number plates; real-time posts of places you visit daily. Archive or crop them.
Minutes 9 to 11, lock settings: make the account private or friends only, and turn off location access for camera and social apps.
Minutes 11 to 13, fix tags: remove unwanted tags and, where the app allows, require approval for new ones.
Minutes 13 to 15, check who is watching: remove followers you do not know in real life; use a unique strong password and 2-step verification.
Repeat it each term, or when you change school or move house.
What should you do if you have been doxxed?
UK Government Security suggests these steps (UK Government Security):
Stay calm and work out exactly what has been exposed.
Screenshot the posts, with URLs, timestamps and comments, before anything is deleted.
Report the posts to the platform, and change your passwords.
If you feel unsafe, go somewhere safe and contact the police. Tell your family.
In India, you can report online crimes on the National Cyber Crime Reporting Portal, which has a special focus on crimes against women and children, or call the 1930 helpline, which Kerala Police says is available 24 hours a day (Kerala Police). If it comes with bullying, see our response plan for AI-made cyberbullying.
If it is weighing on you, talk to someone you trust or call Tele MANAS on 14416, the government's toll-free, 24x7 mental health line (PIB).
What can parents do without taking over?
Ask to do the audit together. One way to say it: "Can we spend 15 minutes looking at your profile the way a stranger would? I'm not reading your messages. I just want us both to know what's public." Then audit your own account; a parent's first-day-of-school photo can show the uniform and the gate too. For where to draw the line, read our guide to how much privacy a teenager should have.
If you then sit down to study and do not know where to start, Fermi's AI tutor works out what you already know and builds a plan for the session.
