OFM glossary

Doxxing: when a creator's real identity is thrown to the crowd.

Doxxing meaning: publishing someone's real name, address or contacts to expose them. Is it illegal in the US and UK, and how creators protect anonymity.

By Olivier MaciejewskiUpdated September 16, 20264 min read
doxxingdoxxing meaningdoxingis doxxing illegal
Key points
  • Doxxing (or doxing) is digging up and publishing information that identifies or locates a person: real name, home address, employer, family.
  • Neither the US nor the UK has a general doxxing offence, but it is often caught by stalking, harassment and threats laws, and some US states target it directly.
  • OnlyFans' Acceptable Use Policy expressly bans doxxing and sharing other people's personal data.
  • For a creator working under a stage name, protection is built in advance: separate identities, a service address, and every piece of content checked before it goes out.

Texts and figures checked on September 16, 2026. Sources are listed at the end of the article.

Doxxing, or doxing, means digging up, cross-referencing and publishing online information that identifies or locates a person: their real name, home address, phone number, employer, relatives. For a creator working under a stage name, it is the sudden jump from anonymity to exposure.

Origin and meaning

The word comes from "dox", short for "documents": in hacker culture, publishing an opponent's "docs" meant releasing their personal file. Doxxing rarely involves any hacking. It usually relies on information that is already out there, which the doxxer gathers and connects.

In OFM

Many creators keep the work apart from the rest of their life: a stage name, sometimes a hidden face, family and employer kept out of it. That separation is exactly what doxxers go after, out of revenge, for blackmail, or out of hostility towards the work. The information seldom comes from a technical breach. It is pieced together from a reverse image search, a personal account left public, a recognisable background, a reflection, a number plate, a photo's metadata, or someone who once had access to the accounts: an ex-partner, a former manager, a chatter.

OnlyFans' Acceptable Use Policy expressly prohibits doxxing and sharing other people's personal data. Fake accounts (catfish) are sometimes used to get close to a creator and collect this information, and doxxing often goes hand in hand with sextortion: "pay, or your family gets your content" (see sexting).

What the law says

United States. There is no general federal doxxing offence. Federal stalking law (18 U.S.C. § 2261A) covers a course of conduct using the internet or electronic communications with intent to harass or intimidate that puts someone in reasonable fear of death or serious injury, or causes substantial emotional distress. Some states go further: in California, electronically publishing someone's personal identifying information, without consent, to place them in fear for their safety and to prompt harassment or injury by others is a misdemeanour punishable by up to a year in county jail and a $1,000 fine (Penal Code § 653.2).

United Kingdom. There is no specific doxxing offence either. A campaign of posts can be harassment under the Protection from Harassment Act 1997, and a message conveying a threat of death or serious harm is an offence under section 181 of the Online Safety Act 2023, punishable by up to five years on indictment. Publishing private information can also found a civil claim for misuse of private information. Where intimate images are shared, section 66B of the Sexual Offences Act 2003 applies, and the content can be taken down as with a DMCA takedown.

Protecting your anonymity

  • Keep identities strictly apart: a phone number, email address and social accounts used only for the work.
  • Use a service or registered agent address for your business, so your home address stays off public registers where the rules allow it.
  • Check every piece of content before posting: background, reflections, post, location metadata.
  • Put your agency's and chatters' access to personal data under contract, with a confidentiality clause that survives the end of the relationship; it is one of the agency contract clauses to check.

Mistakes to avoid

  • Replying publicly to the post: it gives it an audience.
  • Deleting your own accounts before taking screenshots: the evidence goes with them.
  • Handling a physical threat alone: at the first sign of danger, call the police.

For leaked content rather than a leaked identity, see our guide on what to do about a leak.

Frequently asked questions

What does doxxing mean?
Doxxing comes from "dox", short for documents: gathering and publishing someone's personal information (real name, address, phone number, workplace, relatives) in order to expose them. It is also spelt doxing.
Is doxxing illegal?
Not always as such. In the US there is no general federal doxxing offence, but federal cyberstalking law and state laws, such as California Penal Code § 653.2, can apply when the aim is to harass or put someone in fear. In the UK, doxxing usually falls under harassment or threatening communications offences, and can also found a civil claim for misuse of private information.
What should I do if my real identity has been posted?
Take dated screenshots with the URLs, report each post to the platform or host, and report to the police, especially if there are threats; call 911 in the US or 999 in the UK if you are in immediate danger. Warn relatives if their details are circulating.
Olivier Maciejewski, founder of OFM Legal
Your contactOlivier MaciejewskiFounder of OFM Legal · Former international business lawyer (HEC Paris, Arendt, Clifford Chance) · Official MYM partnerHis background Updated September 16, 2026

This article is general information and does not replace advice tailored to your situation. OFM Legal is not a law firm: court proceedings are handled by our partner lawyers.

Let's talk about your situation

It doesn't only happen to other people.

A free 15-minute call, by form or Telegram, to work out where you stand. Reply within 24 hours.

Olivier Maciejewski in a working session