Doxxing: What to Do When Your Address Is Posted Online

Your address appears in a comment. Your phone number is circulating in a group chat. Someone has posted a photo of your front door. This is called doxxing: private data is collected and made public, usually to frighten you or to turn others against you. Here you will learn what to do about doxxing, when it is a criminal offence in Germany and how to get the data removed.

Are you in danger? Call 110 first

If your data comes with threats, if someone announces they will come round, or if strangers turn up at your door: call the police on 110, the emergency number in Germany. Online police reports are not meant for emergencies. Everything else in this article can wait until you are safe.

Tell the people you live with. Doxxing often hits family, flatmates or friends as well, whose data was published along with yours.

What is doxxing?

The word comes from “docs”, as in documents. It means gathering and publishing information such as:

• home address, phone number, email address
• school, training place or employer
• photos of your house, car or doorbell name plate
• the real name behind an account that used to be anonymous
• details of your relatives

The information often comes from sources that seem harmless on their own: a photo with a house number in the background, a location tag, an old profile. It becomes dangerous once it is put together, along with the message behind it: “We know where you are.”

Doxxing: what to do first

1. Secure evidence

Before you report or block anything, save the post with its link, the profile name, the profile address, and the date and time. Take screenshots of the whole thread, including replies in which others call for action. Our guide to securing evidence of online hate shows how to do this on Instagram, TikTok, X and other platforms.

2. Secure your accounts

• Change your passwords and turn on two-factor authentication, especially for email and social media.
• Set your profiles to private for the time being.
• Check what is public about you: old posts, photos showing a house number or school logo, location sharing.
• Let calls from unknown numbers go to voicemail for now.

3. Report it

Report the content to the platform. Pick a fitting category such as “private information” or “harassment” if one exists. Under the EU Digital Services Act, platforms must handle reports of illegal content carefully and tell you their decision. The details are in Digital Services Act: What Platforms Must Do About Online Hate.

Is doxxing a criminal offence?

Since September 2021, German criminal law has had a specific provision for it: dangerous dissemination of personal data (§ 126a StGB, the German Criminal Code). It covers anyone who spreads another person’s data publicly, at a meeting or by disseminating content, in a way that is suitable and, given the circumstances, intended to put that person or someone close to them at risk. The risk must be of a serious crime or of an offence against physical integrity, personal liberty, sexual self-determination or property of significant value.

The penalty is up to two years in prison or a fine. If the data was not publicly accessible, such as an address that was never published anywhere, the maximum is three years. § 126a is prosecuted ex officio (Offizialdelikt): the authorities investigate on their own once they know about it, so a police report is enough.

Not every publication of personal data falls under this provision. What matters is the context, for example a call to “drop by”, or a setting full of threats. Depending on the case, other provisions may apply:

• Threat (§ 241 StGB), if you or people close to you are threatened with certain offences.
• Stalking (§ 238 StGB), if someone repeatedly pursues or harasses you, including online.
• The right to your own image (§§ 22, 33 of the Art Copyright Act, KUG), if photos of you are shared without your consent.

Only the police or a law firm can say whether this applies to your case.

How do you get your data taken down?

Erasure under the GDPR

Your address and phone number are personal data. Under Article 17 of the General Data Protection Regulation (GDPR), you can ask the operator of a website or platform to erase them if they are being processed unlawfully. The operator generally has to respond within one month (Article 12(3) GDPR). If it does not, you can complain to a data protection supervisory authority. This is a second route alongside the normal report.

Search engines

Major search engines offer forms that let you request the removal of results showing your address, phone number or email address. The original page does not disappear. It just becomes harder to find.

Civil law

If it is known who published the data, a law firm can demand that the person stop (a cease-and-desist demand, Unterlassung) and, if necessary, go to court. What is possible and what it costs is covered in our overview of injunctions, deletion and compensation.

Can you block your address in the population register?

Yes, under certain conditions. In Germany, many addresses can be found through a simple request to the residents’ registration office (Melderegister). If facts suggest that such a request could put you in danger, you can ask your local registration office for an information block (Auskunftssperre) under § 51 of the Federal Registration Act (BMG). The law expressly names protection from threats, insults and stalking. The block is free of charge, lasts two years and can be extended. Bring your evidence when you apply.

How can you protect yourself from doxxing?

• Watch out for photos showing your house number, doorbell name plate, number plate or school logo.
• Turn off location data in photos and automatic location tags.
• Use different usernames for gaming, forums and new contacts than for your private profile.
• Only give your phone number to people you know.

These are tips, not duties. The person who publishes your data is always the one to blame, not you.

Where can you get help?

You do not have to deal with this alone. HateAid offers free counselling to people affected by digital violence. Young people can get peer counselling at juuuport. The Nummer gegen Kummer helpline for children and young people is on 116 111 (Monday to Saturday, 2 to 8 pm, in German). If you cannot stop thinking about it: the Telefonseelsorge crisis line is available around the clock on 0800 111 0 111 (in German).

You can file a police report at any police station or online through the online police station (Onlinewache) of your federal state. Our guide to reporting to the police online walks you through it step by step.

Frequently asked questions

Is doxxing always a criminal offence?

No. § 126a StGB applies if the publication is suitable and, given the circumstances, intended to put you or people close to you at risk. Threats, stalking or the right to your own image may also play a role.

Do I need to know who is behind it to file a report?

No. You can file a report against persons unknown. Doxxing under § 126a StGB is prosecuted ex officio, so the police then investigate on their own.

How fast does a platform have to delete my data?

There is no fixed deadline for a normal report, but the platform must handle it carefully. For an erasure request under Article 17 GDPR, the operator generally has to respond within one month.

What does an information block in the population register cost?

Nothing. The registration office enters it free of charge. It lasts two years and can be extended.

You can also report it through our form and upload your screenshots and links there. If you say yes, your report goes automatically to a suitable cooperating law firm (Kooperationskanzlei) as soon as one is available. If there is no suitable firm right now, you get an email with other places to turn to straight away. Deadlines keep running: you can always file a request for prosecution (Strafantrag) with the police yourself. The legal assessment comes from the law firm, not from us.