Doxxing Defense Checklist

Search Google for the following, replacing the example values with your real info:

• "555-867-5309" (your phone number)
• "Jamie Garcia" address (your name plus the word "address")
• "Jamie Garcia" phone number (your name plus the word "phone number")
• "Jamie Garcia" "Springfield High School" (your name plus your high school or college)
• "Jamie Garcia" employer (your name plus the word "employer," or try the name of your actual workplace)

Using quotes is helpful but not required. If you can't find anything, try without quotes.

Your task: How long does it take you to find your home address?

Most likely not very long. The rest of this guide will help you remove a lot of this information.

Time required: 5–15 minutes

1. Sign up for EasyOptOuts ($20/year)

2. Enter your personal information: Follow the prompts. It is most important to include your current information (address, phone number, email). If you can't find all your past addresses, that's okay.

   Warning: Do NOT enter alias names or burner phone numbers that you use exclusively for activism that are already fully separated from your true identity. You wouldn't want those linked up inside this system.

3. Continue to the next checklist item to do manual opt-outs for the sites that EasyOptOuts can't handle.

4. Consider asking anyone who lives at your house to sign up as well. If someone finds out you live together, they could look up that person just as easily and then target you.

Timing: It can take a few days for the initial removals to complete and sometimes up to a couple of months for certain sites.

FYI: We don't get any commissions for any paid services we link to. We recommend them because they're the most effective ones we've found.

Start by manually opting out of the most high-risk sites:

1. Opt-out of People Connect (Intelius) - They own many people search sites, so one opt-out goes a long way. Fill out the "suppression form." You will be asked to verify your email/phone.
   • If the site asks you to verify a phone number or email that you don’t have access to, call their technical support (877) 564-3253 and request to have your "personal information suppressed." Calling is much more effective than emailing them, in our experience.
2. Search for yourself on National Public Data. If you find a result, scroll to the bottom of the page and click Do Not Sell My Info to opt-out.

There are other sites you'll only find by searching for your info manually on Google (explained in a later checklist item).

Each of these sites will (ironically) require you to upload a headshot. This is a necessary evil if you want to be removed. You have to decide if the risk of giving them more data is worth the payoff of being opted out.

Sites to opt-out from:

1. Opt-out of Clearview.ai - Only requires a photo, not a government ID. Frustratingly, opt-outs are only possible in states that have passed privacy laws. Clearview is used primarily by law enforcement agencies, so it is important to opt-out of.
2. Opt-out of PimEyes - Requires a photo of your government ID. (Block out your ID number!)
3. Opt-out of FaceCheck.ID - Instead of uploading a government ID, you can upload a selfie you take with two fingers touching your chin. Also, you must manually select which photos you want them to remove.

1. Enable Google "Results About You": Fill in your full name (and any other names you use), addresses, phone numbers, and email addresses.

   Warning: Do NOT enter alias names or burner phone numbers that you use exclusively for activism that are already fully separated from your true identity. You wouldn't want those linked up inside Google's systems.

2. Wait for the initial scan to complete (a few hours)

3. Review the results and find ways to get them taken down:

   1. Using the "request removal" button inside Google's tool is usually not helpful for two reasons: 1) Google will deny most requests unless they are from a "people search" site or intentional doxxing. And 2) the original information is still out there even if Google does remove it. People can find it on other search engines or the original site directly.
   2. Instead, you want to try to contact the site owner to get the information removed. On websites, this means finding a contact form/email and telling them the page that has information you're asking to have removed. On social media sites, this might mean removing a post you made or asking the author to remove it.
   3. Click "mark as reviewed" as you handle each item.

4. Submit a Google "removal request": Use this removal request form to ask Google to remove search results that have your personal information or other doxxing content. This is different than Google's "Results About Me" feature.

5. Watch for notification emails about new results as they come up. You'll usually see the most in the first couple weeks after you sign up.

While you can do this manually (see below), we recommend using Block Party because it will help guide you through which privacy settings to change. It will help you lock down Facebook, LinkedIn, Instagram, X/Twitter, TikTok, Snapchat, Reddit, Strava, Venmo, Google, Google Maps Reviews, YouTube, and Bluesky. The free tier is helpful, and we've reviewed their privacy policy and generally trust the creators.

1. Install the Block Party extension (free) for your browser. (This is a great time to install Brave if you haven't yet!) Follow the installation prompts.
2. Press "Start Scan" and select which social media sites you use. Let it run for a few minutes while it checks all your settings.
3. Next to each site, click on "To Do" to see the recommended changes. You can start doing this manually or have Block Party automate a lot of them.
4. You can automate a lot of the changes: Block Party will make 50-70% of the settings changes for you automatically. This requires either a 7-day free trial or a paid account ($50/year if you use the promo code JOINTHEPARTY — we don't get any commission).
5. Do the remaining manual changes: Follow the "To Do" lists for each site that can't be done automatically.
6. Finally, consider what other social media sites you use that might not be covered by Block Party: Cash App, Venmo (if not already covered), Partiful, Nextdoor, AllTrails, Strava, Pinterest, Goodreads, MapMyRun, dating apps, etc. The Social Scrub app we built covers 160+ sites if you want a comprehensive list.

If you want to lock down all of your social media profiles, check out an app we built to help with that: Social Scrub.

If you want to delete your old X/Twitter posts or migrate to Bluesky, check out Cyd.

If you don't want to use Block Party, you can do the following steps with each of your main social media accounts.

Sites you might want to prioritize (roughly in order of risk):

• Facebook
• LinkedIn
• Venmo
• Cash App
• Google Maps Reviews
• Yelp
• Strava
• All Trails
• Instagram
• X/Twitter (To delete your old posts, check out Cyd.)
• Bluesky
• YouTube
• TikTok
• Snapchat
• Reddit
• Partiful
• Nextdoor

Steps for each site:

1. Consider deleting this profile if you don't need it anymore. Many sites (Facebook, Instagram, Google) let you download a copy of your data first so you don't lose photos or messages. If you delete it, you're done. If not, proceed.
   • Need just Facebook Marketplace? Consider creating a separate dummy Facebook account for Marketplace use, then deleting your main one.
2. Find the privacy settings screen and change all the settings to be as private as possible.
3. Remove your city
4. Hide your friends list
5. Prune your followers/connections. Remove people who don't have at least one or two friends in common with you, especially if you don't actually know them. Even on a "private" profile, anyone you've accepted as a follower can still see and screenshot your posts.
6. Remove old posts and photos that share detailed information about where you live, where you spend time, and who you spend time with.

As part of writing this checklist, we built an app to help you do the exact steps above on 160+ sites: Social Scrub.

Consider using Digital Footprint Check with usernames you commonly use to see where you might have profiles that you've forgotten about.

1. Change your profile display name: Open Signal → Tap your profile picture → Settings → Tap on your name/icon near the top → Click the top item with the silhouette of a person → Edit your profile display name
2. Change your profile photo: Open Signal → Tap your profile picture → Settings → Tap on your name/icon near the top → Edit photo → upload a generic photo that you found online that doesn't relate to your identity/preferences/interests/location.

1. If you want to change your username: Open Signal → Tap your profile picture → Settings → Tap on your name/icon near the top → Tap the @ symbol → Edit username → set the username to something completely unrelated to your identity, or any usernames you've used anywhere before. It must end in at least 2 numbers.
2. Hide your phone number: Open Signal → Tap your profile picture → Settings → Privacy → Phone Number → Under Who Can See My Number → Select Nobody.
3. Make your phone number not discoverable: Open Signal → Tap your profile picture → Settings → Privacy → Phone Number → Under Who Can Find Me By Number → Select Nobody.
4. Tell people your username instead of your phone number when you want to connect with them on Signal.

• Get an alternate phone number if you need to share a phone number publicly.
  • Google Voice is free, but Google is where the cops will go first to subpoena information, so it's the least private option.
  • MySudo is $2/month for 100 texts and 30 minutes of calling.
  • Sideline ($15/month) or Line2 ($10/month) if you need unlimited texting/calling
• When you need people to contact you on Signal, tell them your Signal username instead of your phone number. (Of course, use Signal whenever possible, especially when organizing. And make sure to turn disappearing messages on by default in settings.)

1. Ask each person you live with to remove their private info from "people search" sites. Example text/script:

   I'm working to remove our home address and my other private info from the internet, so we are more protected. Can you take a few minutes to do the first two items on this checklist so our address isn't easy to find online: https://activistchecklist.org/doxxing I'm happy to sit down and do this together if you have time this week.

2. If it's helpful, you can search for your address on Google and find specific pages where their name is attached to the address. You could send them the link to this page to help show why it's important. Most people are surprised to discover how easy it is to find information like this online.

3. Set a reminder to follow up with them in a week or so to see if they need any support.

You might also make the same request of people who used to live with you at your current address, since their former address is still on "people search" sites.

1. Do separate google searches for your info. Use quotes around your search to get more accuracy. Scroll through the first 2–3 pages on Google for each search (don't use Brave Search or other privacy search engines for this task).
   • Home address in quotes: "742 Evergreen Terrace, Springfield" or even just "742 Evergreen Tr" though that may turn up too many results that aren't in your city.
   • Phone number in quotes: "555-867-5309" or "5558675309" or "(555) 867-5309"
   • Full name plus city (each in separate quotes): "Jamie Garcia" "Springfield"
   • Just your full name in quotes: "Jamie Garcia" (will produce a lot of results that might not be you)
2. Keep a list of what you find that includes your sensitive private info. Prioritize sites that list your address or phone number.
3. Make a plan to get each one removed.
   • If it's a "people search" site, look for a "do not sell my info" or "opt out" form to fill out.
   • If it's a social media site, the author needs to remove it. Or you can try to press "report content" if they're unwilling to remove it.
   • If it's some other site, look for a contact form and ask them to remove it because you're concerned about being the target of online attacks. Most sites are willing to help.
   • Ask search engines to remove the result. For harassment, doxxing, or other harmful content, you can submit a removal request directly to Google (form) and to Bing (form). Success rates vary, but it's worth trying for the most harmful results.
4. Set a reminder to check back in. Check in after a week. If you didn't hear back from any of these sites, try to follow up.
5. Set up Google Alerts for each search above so you're notified when new items come in. (Google's "Results About You" is good but it definitely misses things.)
6. Refresh the Google results. If you got a listing removed on the source site, but it's still showing up in Google's results, you can request the content be updated.
7. Try other search engines too. Different search engines surface different results, and an attacker isn't limited to Google. Run the same searches on Bing and DuckDuckGo to see what else turns up.

You must manually place a "freeze" on all three of the credit bureaus:

• Equifax
• Experian
• TransUnion

This is always free. Don't accept any paid offers they make.

You will need to remember to temporarily lift the freeze when you need to run a credit report to open a new account in the future.

Note: You cannot undo a blur once you request it. For most folks, there's very little upside to having your house visible on street view.

Blur your house on Google Maps (details):

1. Find your home on Google Maps.
2. Open the Street View image that you want to blur.
3. In the bottom right, click “Report a Problem” and complete the form indicating that you want to blur your house for privacy reasons.

Blur your house on Apple Maps:

1. Email mapsimagecollection@apple.com. Include your home address and explain that you'd like it blurred for privacy reasons.

If you do not own the home, you may need to ask your landlord to do these removals since they require an account on each site. They have to "claim" the house on each real estate site.

You can also first search on the site to see how detailed the photos are and whether you want them removed.

1. Remove from Zillow
2. Remove from Redfin
3. Realtor.com: Log in → Claim Home → Edit Photos
4. Ask your real estate agent to remove the photos from the MLS so they disappear from any other sites.

This feature is available for iOS version 16 and above.

Note: The location of this setting may vary between Android devices, so we recommend searching for 'Advanced Protection' in the Settings search bar.

This feature is available for Android 16 and above.

Enable registration lock: Open Signal → Tap your profile picture → Settings → Account → Enable Registration Lock

Upgrade your PIN: You had to set a Signal PIN during setup. If you don't remember it or want to use a stronger PIN, here's how you can do that:

1. Generate a strong PIN: For maximum security, use a PIN that is 8 or 10 digits and make sure it is computer-generated. Here's a random PIN generator you can use.
2. Set a Signal PIN: Open Signal → Tap your profile picture → Settings → Account → Create/Change PIN (If you don't already know what your PIN is).
3. Save your PIN or enable PIN reminders: If you have a password manager you use reliably, save your PIN there. If you think you might forget where you saved your PIN, leave "PIN reminders" enabled.

Start by upgrading your automated data removal tool from EasyOptOuts to something like Optery Ultimate ($250/year). It is among the most comprehensive automated opt-out tools. You can also consider Kanary Pro plan ($10/month) for some additional coverage.

Depending on your risk level, you may want to invest in a high-end service that can do thorough data scrubbing for you.

Activist-aligned data scrubbing and doxxing response services:

• Brightlines
• Convocation Research & Design

You can also check out the Access Now Helpline which is usually free, but much slower and less thorough.

Getting started

1. We built Social Scrub to help you track your progress while you lock down dozens of social sites. It supports over 160 and you can add your own.
2. It reminds you of the main steps for each site:
   • Delete the profile if you don't need it anymore
   • Change display name (it generates a random one)
   • Change your username (it helps you generate a random one)
   • Remove your profile picture
   • Remove your location from your bio
   • Hide posts and photos that might reveal your location
   • Hide your friends list
   • Change your email address (consider DuckDuckGo Email Protection or the Gmail "plus trick".
   • Change your privacy settings.
3. This may take many hours to complete. Bookmark the link or email it to yourself so you come back to it.

Tip: You can also use this identity generator if you need a random profile picture.

Make sure each of these is unique for each site, whenever feasible:

• Display name: Use this random identity generator.
• Username: Use this identity generator or this specific username generator.
• Profile photo: Leave it blank or use this identity generator. If you use the same photo on all sites, an attacker can do a "reverse image search" to find all your accounts.
• Email address - Use an email alias service like:
  • Qwacky to use @duck.com email alias (free, Chrome/Firefox extension)
  • Proton Mail (free/paid)
  • Addy.io (free/paid)
• Phone number: Try to just not enter a phone number when prompted. If you need to enter a phone number just for verification when you sign up, try renting a phone number from SMSPool ($0.50 per registration). If you need a long-term phone number, consider MySudo.

Here are some of the accounts you'll want to secure.

1. Bank, credit card, loan, mortgage, and investment accounts
2. Your cell service provider (Verizon, T-Mobile, AT&T, etc.)
3. Internet provider
4. Utility companies
5. Insurance (health, home, auto, etc.)

How to add a PIN for each account:

1. Call their customer service line.
2. Ask if you can add a verification PIN.
3. Generate a random PIN for each account.
4. Save it in your password manager.
5. If you can't add a PIN, ask what other security features they offer to prevent someone from pretending to be you and accessing your account.