10 October 2026 · Telegram Ban Service · 12 min read

How to report doxxing on Twitter, and where X's doxxing policy stops

How to report doxxing on Twitter: tap the three dots on the post, choose Report post and pick the private information option, or file X's private information form when the details need explaining. X's doxxing policy covers home addresses, IDs, private phone numbers and emails, bank details, medical data and unmasking anonymous users, when shared without consent.

Doxxing on Twitter tends to arrive as a screenshot. Your street name in a reply, your mother's phone number under a quote post, a photo of your front door with the house number circled. The first instinct is to report everything at once, and the second is to search for whether X will actually do anything. Both make sense. The catch is that X's rules draw the line in places people don't expect, and the report you file has to land on the right side of that line. We went through the policy page and the private information form on 10 October 2026, and counted what X has filed with the EU about privacy since April, so the steps below match what you'll see on screen this week.

What does the Twitter doxxing policy treat as private information?

The Twitter doxxing policy, which X files under "Private information" and last revised in March 2024, bans posting someone's private details without their express permission, threatening to post them, and offering or asking for a reward either way. It names six kinds of information. Home address or other private location, government ID numbers, non-public phone numbers and email addresses, bank or card details, medical and biometric records, and the real identity of an anonymous user. That last one surprises people: unmasking an anon account is doxxing under X's rules even if no address appears.

X says it weighs four things before acting. What kind of information it is, who posted it, whether it was already public somewhere else, and why it was shared. Physical location and phone numbers rank as the highest risk. A phone number you published on your own website may not count as private, but a home address can be actioned even when it's already public, because of the risk of someone turning up. You can read the full wording on X's private information policy page.

How do you report doxxing on X from the app?

Report the post itself, not just the account, because X needs to see the exact content. Here's how to report doxxing on X Twitter from the phone app or the website:

1. Open the post that shows the information. If it's in an image, open the image too, so you know which post holds it.
2. Tap the three dots in the post's corner and choose Report post.
3. When X asks who the report is for, pick yourself if it's your information, or the option for someone else.
4. Choose the privacy option that mentions private information or media, then the type that matches: address, contact details, ID, financial or medical information, or an image.
5. Add other posts from the same account when X offers. A pattern matters more than one post.
6. Block or mute afterwards, not before. Blocking first can hide the posts you still need to report.

Who learns about it? X doesn't show the poster the name of the person who reported them, and our guide to what happens after you report someone on Twitter covers the notices each side receives.

When is the private information form better than the Report button?

Use the form when a report needs words. Maybe the address is in a reply chain spread across five accounts, or the post is from a protected account you can't see anymore, or someone is threatening to post your details and hasn't yet. The private content form in X's safety section asks whose information it is (Me, Someone I am authorized to represent, Someone else), then makes you pick one of seven kinds of content: contact, location, financial, ID, medical, a sexual or intimate image, or a photo or video you just don't want on X.

Then it wants your email, a typed signature, the username, links to the posts and a free-text box. When we worked through the form on 10 October, we chose Someone else and stopped short of submitting. The final checkbox still asked us to confirm the report concerned private information "of myself or someone I am authorized to represent". So the form is really built for the person named or their representative. A bystander is usually better off using the in-app report, which takes third-party reports when the posting is plainly abusive. X also flags at the top of the form that it handles reports under its own rules, and points EU users to a separate legal form if they'd rather report the content as illegal.

Who can file a Twitter doxxing report for someone else?

Anyone can, as long as the information was posted in a clearly abusive way. When it isn't obvious, X says it may need to hear from the owner of the information or someone acting for them, such as a lawyer. Images are stricter. For photos or videos of a private person, X needs a first-person report, from the person shown or a parent, guardian, lawyer or other legal representative, because only they can say whether they agreed to it.

This is where a lot of well-meant reports stall. A friend reports a post that shows your face at a party, and nothing happens, because X has no way to know you didn't agree to it. You file the same report and it comes down. If several people want to help, the useful job for them is collecting links and screenshots for you. A pile of identical reports from strangers isn't what moves X, and paid mass reporting can count against the person who ordered it. We explain that risk on our page about the Telegram bots that sell mass reports against X accounts.

What do X's rules on doxxing leave out?

More than most people hope. X's rules on doxxing list what doesn't count as private: your name, your birthday or age, where you go to school or work, a business address that's already public, what you look like, gossip, rumours and accusations, and screenshots of messages from other apps unless they show something like a phone number. Information that's public elsewhere and shared without abusive intent is also out, and so is media of public figures, news coverage and eyewitness footage.

If what you're facing is a sustained campaign rather than one leak, you'll get further combining routes. Our page on getting an account suspended on Twitter for repeat violations shows how X adds strikes up.

How often does X act on doxxing on Twitter in the EU?

Rarely, at least on paper. Under the EU's Digital Services Act, X files a statement every time it restricts an account or a post, and the public DSA Transparency Database lets anyone filter them by category. We counted X's entries from 1 April to 9 October 2026 on 10 October. Out of 2,553,153 statements, 472 sit in the data protection and privacy category, about one in 5,400. Only 27 of those 472 were account suspensions, and every one of the 472 was marked as made without automation, which fits X's line that it needs context before acting on these reports. Twitter doxxing rules are applied by people reading the post, not by a filter.

For comparison, cyber violence, the category closest to harassment, had 23,297 entries in the same window, with 97 suspensions. Two cautions. These are EU filings only, and X sorts each decision into one category, so an address dump reported as harassment may be counted there instead of under privacy. The direction is still clear. A privacy report usually ends with a post removed and the account kept, so plan for the poster to stay on X.

What happens to an account that doxxed you on Twitter?

Usually it loses the post and some time. X's listed penalty is to require the post's removal, often with a spell in read-only mode before the account can post again. Repeat violations can lead to suspension. Accounts whose only purpose is posting other people's private information or media, including upskirt and creepshot accounts, are suspended outright. The account holder can appeal if they think X got it wrong.

That read-only lock is why the post sometimes stays up for a few hours after X agrees with you. X asks the owner to delete it, and the account is frozen until they do. If you need the account itself gone rather than the post, the routes are narrower, and how to take down a Twitter account through X's own channels lays them out. Be wary of anyone who sells guaranteed removals. A Twitter ban service can prepare and file reports, but X still makes the decision, and nobody can promise its outcome.

What should you do in the first hour after being doxxed on Twitter?

Order matters, because posts get deleted and accounts get blocked. If you've just been doxxed on Twitter, work through this in sequence:

1. Save evidence first. Screenshot each post with the username, date and URL visible, and copy the links into a note. Posters often delete once a report lands.
2. Report each post through the app, then use the form for anything that needs explaining.
3. If there's a threat of violence, or someone says they're coming to your address, call local police and keep the report number. X has a separate violent-threats report as well.
4. Lock down the accounts the leak points to. Change passwords, turn on two-factor authentication, and check the phone number linked to your Telegram and other apps. If someone has already got into your Telegram, follow our steps to recover a hacked Telegram account, or the general Telegram account recovery guide if you're simply locked out.
5. Find the source. Doxxers often pull addresses from people-search sites, old posts or a reused username. Removing the source stops the same details reappearing next week.

Some people decide the safest move is to cut an account loose entirely. If a Telegram account tied to your number is the weak point, deleting a Telegram account properly explains what's erased and what stays with other people.

What do Reddit threads about Twitter doxxing get right and wrong?

Search "twitter doxxing reddit" or "doxxing on twitter reddit" and you'll find the same handful of threads repeated: someone's report was rejected, the post is still up, and replies suggest reporting it again with friends. The useful part of those threads is the practical advice. Screenshot before you report, check people-search sites, and don't reply to the doxxer, since a reply can push the post to more people. The weak part is the explanation for why reports fail. It's usually not that X ignores doxxing. It's that the post showed something X doesn't treat as private, like an employer, or a photo needed a first-person report.

The other common thread, "twitter report doxxing reddit" style, asks whether Reddit is a safer place to report a Twitter doxxer. It isn't. Reddit can only remove what's posted on Reddit. If your details have spread there too, report them to Reddit separately, and keep each platform's report to that platform's own content.

What if the same person keeps going on Instagram?

People who dox on X often copy the same material to Instagram. The rules there differ, so the starting point depends on what they posted.

The general guide on reporting someone on Instagram covers the menu itself, and Instagram, like X, keeps the reporter's name from the person reported, with exceptions explained in whether someone finds out you reported them on Instagram. Picked the wrong reason? Withdrawing an Instagram report shows what can be undone. When the account itself is the problem, getting an Instagram account taken down and whether you can delete someone else's Instagram account set out the limits. Paid help works the same way it does on X: an Instagram ban service or an Instagram account removal service can file on your behalf, but Meta decides.

FAQ

Report a channel