AI Glossary / Data governance and quality / Intermediate
Doxing
Definition
Doxing, also spelled doxxing, is the deliberate online exposure of someone's identity or personal information without their consent, typically to enable harm, intimidation, or harassment. The information can be accurate and may come from material that was already accessible somewhere. The harmful act can involve collecting and amplifying it in a new context. This is a safety and privacy explanation; legal definitions and available remedies vary by jurisdiction.
What it means
Privacy harm is not limited to stealing a secret database. Combining fragments of personal information and presenting them to a hostile audience can change the risk to a person. The intent, context, sensitivity, and likely consequences matter. Doxing is also distinct from merely disagreeing with someone's public statements. A useful discussion focuses on the exposure of personal information and its potential to enable targeting, rather than treating all public criticism as doxing.
How it works
At a high level, personal details are exposed or amplified in a way that makes a person easier to identify, contact, locate, or intimidate. Defensive work aims to reduce unnecessary exposure, limit amplification, and provide a clear response path. Organizations should handle reports with restricted access and avoid reproducing the exposed information in broad internal messages. People facing a credible immediate threat should use appropriate local emergency support. Platform reporting and specialist support routes depend on the service, location, and circumstances.
Three practical examples
- Staff safety: an employee's private contact details are posted alongside encouragement for strangers to harass them.
- Community moderation: a pseudonymous participant's identity is exposed to intimidate them after a disagreement.
- AI products: a system is misused to compile personal details about a private person into a targeting profile, creating a privacy risk even if individual fragments came from separate sources.
Think of it this way
Think of taking scattered pieces of a person's private life and placing them together on a noticeboard facing a hostile crowd. The change in audience and context can create harm beyond any one fragment. The analogy is limited because online information can be copied rapidly, persist across services, and reach people far beyond the original poster's audience.
Worked example
In an original fictional moderation exercise, a report contains three elements: criticism of a speaker's published argument, a link to their official public biography, and a screenshot displaying their private contact information with a call for harassment. The moderator separates the policy questions rather than treating the entire post as one undifferentiated item. The personal information and targeting language require urgent review under the platform's rules, while criticism of the public argument is a different matter. The internal report records the relevant location and context with access restricted to the response team. This exercise teaches classification and careful handling, not a legal ruling or a method for locating personal information.
Illustrative case study
Fictional example: Acorn Events receives a warning that a volunteer's personal details are circulating online. Instead of forwarding the screenshot to its entire mailing list, the coordinator uses the organization's designated incident route and limits distribution to people supporting the response. The volunteer helps identify practical support needs, and public updates omit the exposed details. This invented case illustrates that well-intentioned amplification can worsen the original exposure and that the affected person's safety should guide communications.
Common misconceptions and mistakes
Do not assume information is harmless to republish merely because it appeared publicly elsewhere. Do not equate accuracy with permission or ethical acceptability. Avoid asking the affected person to prove the incident by broadcasting the material again. Also, do not promise that removing one post erases every copy, or claim that all jurisdictions use the same legal definition. Automated detection can help surface reports but may miss contextual threats or incorrectly flag legitimate public-interest discussion; consequential decisions need appropriate review.
Business use
Businesses operating websites, communities, or AI tools need clear rules against targeted personal-information exposure and usable reporting processes. Staff-facing organizations also need a coordinated response involving relevant safety, security, privacy, and communications owners. For AI systems, assess whether features make it easy to aggregate or reveal private-person information for harmful targeting. Evaluate report handling with fictional cases, keep sensitive evidence access limited, and measure whether people can obtain help without being required to amplify the exposure.
People also ask
Must doxed information be false?
No. Accurate personal information can still be exposed in a harmful, non-consensual context.
Must the information come from hacking?
No. Publicly accessible fragments can also be combined or amplified to target someone.
Does deleting a post guarantee the risk has ended?
No. Copies and continuing harassment may require further support and follow-up.
Check your understanding
A colleague wants to warn everyone by reposting an unredacted screenshot of exposed personal details. What is the better approach?
Answer: Use the designated reporting route and share only what authorized responders need. A warning should not unnecessarily widen the audience for the information that caused the harm.
Related terms
- Privacy
- Incident response
- cyberstalking
- online harassment
- identity theft
- personal information
- data minimization
Learn next
review a platform's personal-information and harassment policies, then practice writing a privacy-preserving incident report using wholly fictional details. Separate the exposed content, targeting context, immediate safety concerns, and requested support. Avoid including unnecessary identifiers in training examples, demonstrations, or broadly accessible logs.
More in Data governance and quality
- Digital continuity - Digital continuity is the ability to keep digital information usable for the purposes and period for which it is needed.
- Dirty data - Dirty data is an informal name for data with quality problems that make it unreliable or unsuitable for an intended use.
- Discretionary access control - Discretionary access control, or DAC, is an approach in which an object's owner or another authorized controller has some discretion to decide who can...
- Electronic seal - An electronic seal is electronic data associated with other electronic information to support verification of its origin and integrity.
- Entity integrity - Entity integrity is the database principle that each row must have a dependable identity, commonly enforced through a primary key whose values are unique...
- Extrusion detection - Extrusion detection is a security-monitoring perspective that looks for harmful activity originating inside a system or network, especially through outgoing...
Sources
Sources: Australian eSafety Commissioner, Doxing, https://www.esafety.gov.au/industry/tech-trends-and-challenges/doxing , definition and explanatory sections read; CISA, Personal Security Considerations Action Guide, https://www.cisa.gov/sites/default/files/2024-06/personal-security-considerations-action-guide-critical-infrastructure-workers_06-07-2024_508.pdf , relevant search excerpt consulted; eSafety, Identity theft, https://www.esafety.gov.au/key-topics/staying-safe/identity-theft , relevant excerpt consulted. Examples and AI-product applications are original synthesis. Current jurisdiction-specific legal obligations and removal processes are outside the reviewed scope.
Previous: Downward refinement property Next: DPLL algorithm