Doxing is not a named criminal offence in England and Wales, but it is illegal in almost every real situation we see. Someone who posts your home address, phone number, workplace or private photographs online to expose you, frighten you or set other people on you is likely to be committing harassment, and sometimes two or three other offences at the same time. You can also sue them, get the material taken down, obtain an injunction, and claim compensation.
This article explains which laws apply to doxing in the UK, what to do in the first day, how we identify the person responsible when they hide behind a fake account, and what a realistic outcome looks like. It is written for the person it is happening to, and for the family member or employer trying to help them.
What doxing is
Doxing (also spelt doxxing) is publishing someone's private or identifying information online without their consent, so that other people can find them, contact them or harm them. The word comes from "dropping documents". In practice the information is usually a home address, a personal phone number, an email address, the name of an employer, a car registration, photographs of a house or children, or details of daily routine such as a gym or school run. Sometimes it is intimate images, medical details or financial information taken from a hacked account or a former partner.
Doxing is rarely the whole of the problem. In our experience it is the trigger for what follows: the abusive messages, the strangers turning up, the fake escort listing, the calls to an employer, the pile-on. That is why the law treats it as part of a course of conduct rather than a single post, and why the remedies go further than one takedown.
Is doxing illegal in the UK?
Yes, in nearly every case, although no statute uses the word. As at September 2026 there is still no standalone doxing offence in England and Wales, and the Crime and Policing Act 2026 did not create one. What exists instead is a set of laws that between them cover almost everything a doxer does. Which ones apply depends on what was published, why, and what happened next.
Harassment and stalking
The Protection from Harassment Act 1997 is the law we rely on most. Section 1 prohibits a course of conduct that amounts to harassment of another person and which the person doing it knows, or ought to know, amounts to harassment. Two incidents are enough for a course of conduct, and one post that is repeated, reshared or followed by messages will usually satisfy that. Section 2 makes harassment a criminal offence, section 2A covers stalking, and section 4 covers the more serious offence of putting someone in fear of violence, which carries up to ten years' imprisonment. Section 3 gives you a civil claim in your own right, with damages for anxiety and financial loss and the power to apply for an injunction.
Publishing someone's address so that others will act on it has been treated by the courts as harassment for some time. In Levi v Bates [2015] EWCA Civ 206 the chairman of a football club printed a businessman's home address and telephone number in the match programme and encouraged supporters to contact him. The Court of Appeal held that the businessman's wife, who lived at the address, could bring her own harassment claim even though she was not the person the articles were aimed at, because the harm to her was foreseeable. She was awarded £6,000.
Communications offences
Where the doxing comes with threats or abuse, the communications offences apply. Section 181 of the Online Safety Act 2023 makes it an offence to send a message that threatens death, serious injury, rape, sexual assault or serious financial loss, with a maximum sentence of five years. Section 179 of the same Act covers sending a message the sender knows to be false in order to cause non-trivial harm, which is the offence that catches fake escort listings and false accusations posted alongside someone's details. Section 1 of the Malicious Communications Act 1988 still covers messages that are indecent or grossly offensive and intended to cause distress, and section 127(1) of the Communications Act 2003 covers menacing messages sent over a public network.
Data protection and computer misuse
Section 170 of the Data Protection Act 2018 makes it an offence to obtain, disclose or retain personal data without the consent of the data controller, which is how doxers who lift information from a work system, a customer database or a hacked account are caught. Separately, you can claim compensation under Article 82 of the UK GDPR from anyone who processes your personal data unlawfully, and publishing your home address to a hostile audience is unlawful processing. If the information was obtained by getting into an account or device without permission, section 1 of the Computer Misuse Act 1990 applies as well.
Misuse of private information
Alongside the criminal law there is the civil claim for misuse of private information, which the courts have developed since Campbell v MGN [2004] UKHL 22 and confirmed in Bloomberg v ZXC [2022] UKSC 5. The test asks whether you had a reasonable expectation of privacy in the information and, if so, whether the other person's right to publish it outweighs yours. A home address, a private phone number, medical or financial details and intimate images will nearly always pass the first part of that test. The remedies are an injunction stopping further publication, an order that the material is deleted, and damages.
The two routes work together. The criminal law is for the police to enforce and gives you a prosecution and a restraining order if it goes well. The civil law is in your hands, moves at your pace, and gets the material down. Most of our clients use both.
Where doxing happens, and the sites that encourage it
Doxing is rarely a lone post on a mainstream platform. In most of the cases we see, the details are gathered and shared on a site or group whose whole purpose is to talk about a person behind their back, and the mainstream platforms are where the crowd then acts on them.
The gossip forums are the commonest source. Tattle Life, the largest of them in the UK and Ireland with about a million visits a month, hosts hundreds of threads on influencers, small business owners and people who are not public figures at all, and those threads have carried home addresses, workplaces and details of children. Its anonymous operator was identified in June 2025 through a disclosure order against the company that supplied the forum's software, and named in the High Court in Belfast as Sebastian Bond, after a Northern Irish couple sued over a thread about them. The £300,000 award made in their favour was set aside in May 2026 on procedural grounds and the couple have been given permission to appeal, so the damages are not the lesson. The lesson is that a forum operator who believes he cannot be found can be found, and that the route to him ran through the businesses that host and serve the site rather than through the site itself. Our sister site sets out what to do about harassment on Tattle Life.
Below the gossip forums sit the sites built for doxing: paste sites where dossiers of names, addresses and family details are uploaded for others to act on, and forums such as Kiwi Farms, which coordinated campaigns against named individuals until its network provider withdrew service in 2022 after a campaign by one of its targets. Then there are the "exposed" and "warning" groups on Facebook and Telegram, the anonymous imageboards, and the review and complaint sites where a dispute with a tradesman or a landlord turns into their home address and car registration. Each of these takes a different approach to takedown: some respond to a properly drafted legal notice within days, some respond only to their hosting company or domain registrar, and some are structured to ignore everything, which is when the disclosure order and the injunction do the work.
Two points of law matter here. First, the person who posts the details and the people who repost or act on them are each liable for their own conduct; there is no safety in being one of a crowd. Second, since the Online Safety Act 2023 illegal content duties came into force in 2025, a UK-facing forum has its own duties to assess and remove content that amounts to harassment or a threat once it is on notice, and a well-drafted notice puts it on notice. The operator's liability is a separate question and usually a slower route than the one against the individual, but it is there.
What to do in the first 24 hours
Preserve the evidence before anything else. Take full-page screenshots that show the URL, the account name and the date, and save the links in a document. Do not ask friends to report the post or reply to it yet, because a post that is deleted before it has been captured is much harder to use, and a doxer who sees a reaction tends to escalate. If the platform has a "download your data" or archive tool, use it.
Then close the doors the doxer is likely to try next. Set every social media account to private for now, change passwords on email and cloud accounts and turn on two-factor authentication, and check whether your address is publicly visible on the electoral register, Companies House or people-search sites, all of which allow you to ask for it to be hidden. If you run a business from home, consider a registered office address elsewhere. None of this is admitting anything; it is removing the material the doxer wants to use.
If there is any threat to your physical safety, or someone has turned up at your home, call the police on 999. Otherwise report the matter on 101 or online and ask for a crime reference number. Our guide on reporting harassment to the police explains what to expect and what to say. Report the posts to the platform as well, using the harassment or privacy option rather than the general "spam" one. Keep the reference numbers; they matter later.
How we stop doxing
We start with the evidence you have gathered and work out two things quickly: who is behind it, and where the material is hosted. The answers decide the route.
How we find out who is behind the doxing
If the doxer is anonymous, we identify them, and in most cases we can. This is something we believe is unique to our firm: Cohen Davis has its own open-source intelligence department, built up over more than a decade, with lawyers trained in OSINT and access to specialist databases, so the investigation is done in-house rather than sent out to an agency. The first stage is open-source intelligence, known as OSINT: a structured investigation of everything the account and the posts have left in public view, carried out by our own investigators and reviewed by a solicitor. Because the people finding the evidence are the people who will use it in court, the work is done to a standard a judge will accept. It uses only lawfully accessible sources, it does not involve contacting the doxer, and it usually takes days rather than weeks.
What we look at depends on the case, but the same threads tend to lead somewhere. A username or a profile picture reused on another platform where the person was less careful. The date the account was created and the moment it went quiet, set against the timeline of your dispute. Turns of phrase, spelling habits and the hours at which the posts appear. Metadata in images, reverse image searches, and the background detail in a photograph. Followers and friends the account shares with someone you already suspect. Archived and cached copies of posts that have since been deleted, which we capture before they disappear. Company, property and electoral records where a name or an address surfaces. Each item on its own may prove little; together they often point to one person, and we set out that reasoning in a report you can put before the police or a court.
Where the open-source work narrows the field but does not close it, we apply to court for a disclosure order against the platform, known as a Norwich Pharmacal order, which requires the platform to hand over the account holder's registration details, such as the email address, phone number and IP addresses used. The OSINT report is what persuades the court that the order is proportionate. Our sister site explains how we identify anonymous internet users using open-source intelligence and how to unmask someone behind anonymous online posts. A disclosure order typically costs in the region of £5,000 plus VAT and takes a few weeks.
What helps us most is what you can gather now: the account names and links, the screenshots with dates, any earlier contact with the person you suspect, and a short list of who might have a motive. You do not need to be right; you need to give us somewhere to start.
In parallel we get the material down. We send takedown notices to the platforms and to the hosting companies and search engines, citing the specific laws above rather than the general community guidelines, because platforms treat a notice from solicitors that names the offence and the claim differently from a user report. Most mainstream platforms remove a home address or a phone number within days once it is put to them properly. Sites that exist to host doxing, or that sit outside the UK, take longer and sometimes need the host or the domain registrar to be approached instead.
Once we know who the doxer is, we write to them. A cease and desist letter, or a formal letter before claim, sets out what they have done, which laws they have broken and what we require: deletion, an undertaking not to repeat it, and usually a contribution to costs. We give a short deadline, typically seven to fourteen days. In our experience a large proportion of doxers stop at this point, because the letter is the first moment they understand they have been identified and that the consequences are personal to them.
If they do not stop, or the risk is too high to wait, we apply for an injunction. The court can grant an interim injunction under section 3 of the Protection from Harassment Act 1997 within days, and in urgent cases within twenty-four hours, ordering the doxer to remove the material and not to publish anything further about you. Where the doxer is still unidentified, the injunction can be made against "persons unknown" and served on the accounts themselves. One of the cases we acted in shows harassment injunctions against anonymous Instagram and social media users working in exactly that way. Breaching an injunction is contempt of court, and the people we deal with generally understand what that means.
Costs depend on how far the matter goes. Takedown notices and a cease and desist letter sit at the lower end; a contested injunction sits at the higher end. After a first consultation we give you a written estimate for each step, so that you decide stage by stage. Our separate guide on harassment injunction cost gives the ranges we have seen in practice.
A first consultation is charged at a fixed, all-inclusive fee of £469. After it we give you a written estimate for each step, so that you decide stage by stage. Book a consultation with an online harassment solicitor.
The letter is the first moment most doxers understand they have been identified and that the consequences are personal to them.
A case we acted in
A fashion influencer we will call Joanna came to us after strangers began messaging her about an escort listing she had never created. The listing carried her photographs, her mobile number, her home town and her measurements. Within weeks, recordings of private conversations, intimate images and her full postal address had been posted to a doxing site, together with the names and workplaces of some of her friends. The person responsible was a former boyfriend, one of her own followers, who had used her Instagram posts to track her movements and had installed a hidden camera in her bathroom during the relationship.
Joanna had done the one thing that mattered most: she had preserved everything. From that evidence we identified him, secured removal of the material about her and her friends from the sites and the search results, and recovered compensation from him, with her legal fees paid. The fuller account is at what to do if you become a victim of doxing.
What outcome you can realistically expect
Removal of the material is the usual first result, and for most clients it arrives within days to a few weeks of instructing us, depending on where the material sits. Identification of an anonymous doxer, where it is needed, generally takes a few weeks by open-source work or a disclosure order. An interim injunction, where the case justifies it, can be in place within days and stays in place until trial or until the other side gives undertakings, which is how most of these cases end.
Damages for harassment in the civil courts are modest by the standards of some other claims. Awards commonly fall between the low thousands and the low tens of thousands of pounds: £6,000 for the wife in Levi v Bates; £30,000 for harassment in Hourani v Thomson [2017] EWHC 432 (QB), where a coordinated campaign included demonstrations outside the claimant's home, on top of £50,000 for the libel that accompanied it. Where the doxing involves intimate images or medical or financial details, the misuse of private information claim adds a further head of damages. If you win, the court will also normally order the other side to pay a substantial part of your legal costs.
On the criminal side, a conviction for harassment under section 2 carries up to six months' imprisonment, section 4 up to ten years, and a threatening communication under the Online Safety Act 2023 up to five years. The court can also impose a restraining order, which for many of our clients matters more than the sentence.
The risks to weigh are these. The doxer may argue that the information was already public, which is not a complete answer, because collecting scattered details into one hostile post is itself the harm, but it can affect the privacy claim. They may argue freedom of expression or public interest, which the courts take seriously where the target is a public figure and the information concerns their public role, and much less seriously where it is a home address. The doxer may be outside the UK, which slows enforcement without stopping it. And there is the cost of a fully contested case, which is why we advise stage by stage and tell you where we think the matter will settle.
Doxing and pile-on harassment
Doxing and pile-on harassment usually travel together. A pile-on, sometimes called dogpiling, is a crowd of people targeting one person at the same time, and the crowd needs somewhere to aim. Publishing the target's details is what turns a bad-tempered thread into strangers ringing an employer or standing outside a house. The Law Commission looked at whether pile-on harassment should become a specific offence and the government has not legislated for one, so the same laws apply: the person who publishes the details and the people who act on them can each be liable for harassment, and the organiser can be liable for what the crowd foreseeably does. We describe one such matter in our pile-on harassment case study, and our general guide on how to stop online harassment covers the wider picture.
Frequently asked questions
Is doxxing illegal in the UK?
There is no offence called doxxing, but publishing someone's private details to expose, frighten or target them is almost always illegal under the Protection from Harassment Act 1997 and, depending on the facts, the Online Safety Act 2023, the Malicious Communications Act 1988, the Data Protection Act 2018 or the Computer Misuse Act 1990. It also gives rise to civil claims for harassment and misuse of private information.
Is it still doxing if the information was already public?
It can be. The courts look at the purpose and effect of the publication, not only at whether each fact could be found somewhere. Gathering a person's address, employer and photographs into one post aimed at a hostile audience is the harm, and Levi v Bates involved an address that was, strictly, discoverable. The "already public" point may reduce a privacy claim, but it rarely defeats a harassment claim.
Can I go to the police about doxing?
Yes. Report it on 101 or online, or on 999 if there is a threat to your safety, and ask for a crime reference number. The police response varies, and in our experience it is stronger where you present the evidence in order and name the offence. Our guide on reporting harassment to the police explains how. A police report and a civil claim can proceed at the same time.
What if I do not know who doxed me?
Most doxers can be identified. We begin with open-source investigation of the account, and where that is not enough we apply for a disclosure order requiring the platform to reveal the account holder. An injunction can be obtained against "persons unknown" while the identification work continues, so you are not left unprotected in the meantime.
Can I sue someone for doxing me?
Yes. Section 3 of the Protection from Harassment Act 1997 gives you a civil claim for damages and an injunction, and misuse of private information and data protection law add further claims where private or personal data is involved. Awards for harassment typically run from the low thousands to the low tens of thousands of pounds, and the court usually orders the other side to contribute to your legal costs.
How much does it cost to stop doxing?
It depends on the route. The first consultation is at a fixed fee, stated above, and after it we give a written estimate for each step so that you decide stage by stage. Takedown notices and a cease and desist letter are the least expensive stage. A disclosure order is typically in the region of £5,000 plus VAT. Injunction proceedings vary widely with the amount of evidence and whether the other side fights; our guide on harassment injunction cost sets out the ranges.
Does the same law apply in Scotland and Northern Ireland?
Broadly, yes. The Protection from Harassment Act 1997 contains separate provisions for Scotland, and Northern Ireland has the Protection from Harassment (Northern Ireland) Order 1997, which works in a similar way. The Online Safety Act 2023 communications offences and the data protection legislation apply across the UK. This article is written from the law of England and Wales, and we can advise on the differences where they matter.
What should I do if my home address has been posted online?
Screenshot the post with its URL and date, report it to the platform under harassment or privacy, tell the police if there is any threat, and lock down the places your address appears publicly, such as the open electoral register and Companies House. Then take advice quickly. Address doxing is the category that most often leads to someone turning up, and it is the one where an early injunction earns its keep.