To prevent doxxing as a creator, find the links between your creator identity and your private life before a stranger does. Search yourself the way they would, list every place that connects your legal name, stage name, phone number, email or address, then remove, restrict or replace each one through that source's own removal route. Nobody becomes unfindable, but every link you close makes a dox slower to assemble and less complete.
Search yourself the way a stranger would
The eSafety Commissioner's guidance on doxing recommends making a habit of searching for yourself in incognito mode, so you see roughly what other people see rather than results shaped by your own history. Do it signed out, in a private window, and run each of these searches separately:
- Your legal name together with your suburb, city, old school or previous employer.
- Your stage name together with your legal first name, in case someone has already connected them.
- Every phone number and email address you have ever put on a public profile, including retired ones.
- Current and past usernames in quotation marks, since a reused handle can surface forgotten accounts.
- Your street name with your surname, the pairing a person-search result usually shows.
- An image search with the profile photo you use most, which finds old accounts that share the picture.
Write down what you find in a document only you can open, not a shared drive. The same eSafety page suggests unique usernames for each online account, and the audit usually shows why: one old handle shared by a gaming profile, a hobby forum and a creator account is often enough to join the dots. If you work under a pseudonym, the separation itself is covered in our anonymous creator OPSEC guide; this page is about the public records and search trails that undo it.
The exposure audit worksheet
Work down the rows, note what each place shows about you, and fill in the date once you have acted. The removal routes are explained in the sections that follow.
| Place to check | What it can reveal | Removal or restriction route | Date done |
|---|---|---|---|
| Google results for your names and contact details | Pages that print your phone, email or home address beside your name | Google's Results about you dashboard, or its doxxing removal request | ____ |
| Bing and other search engines | The same pages, which may linger after Google drops them | Ask the website owner to delete the page, then report the stale result | ____ |
| People-search and data-broker sites | Current and past addresses, relatives, phone numbers, approximate age | Each site's opt-out page; Californians can also use DROP | ____ |
| Australian electoral roll | Your name and enrolled address to anyone inspecting the public roll | Silent elector application, explained in our Australian registers guide | ____ |
| Business name and ABN records | The holder's legal name, a service address, a suburb and postcode | A PO Box for published addresses, plus ASIC and ABR privacy requests | ____ |
| Domain registration records | Registrant name, contact name and contact email | Registrar privacy settings and role-based contact details | ____ |
| Newsletter footers | Whatever postal address your email platform prints on every send | Replace it with a PO Box or business address | ____ |
| Old accounts and reused usernames | Real name, early photos, school, friends lists, check-ins | Delete, rename or lock each one, then use unique handles | ____ |
| Your own photos and videos | Street views, letters, parcels, window views, location tags | Edit or archive the posts and fix the set before you film again | ____ |
| Friends' and family posts | Tagged photos, birthday posts, your workplace or neighbourhood | Ask them to untag or remove, and tighten who can tag you | ____ |
| Breaches involving your email addresses | Old passwords and contact details circulating in leaked lists | Change affected passwords and stop reusing them anywhere | ____ |
For the photo and video row, our background privacy check covers what to look for in a set before it is ever published.
What search engines will remove, and what they won't
Google's Results about you tool lets you enter your name and the contact details you want to track, checks search results for them, and can notify you when new matches appear. You request removal from the same dashboard. The page sets out limits worth knowing before you rely on it: the details must be your own personal information, you must not control the page yourself (your own blog or social profile is your job to edit), and Google says it won't remove results from government or educational sites or newspapers because it treats them as valuable to the public.
Google's separate policy on removing private information names doxxing directly. It covers pages that show your personal information alongside explicit or implicit threats, or calls for others to harm or harass you, and pages that aggregate a significant amount of personal information without a legitimate purpose. An approved request can be a full removal or a partial one that only hides the page from searches on your name, and Google is clear that the page itself stays online and may still be found through links, social media or other search engines.
Bing is narrower. Microsoft's page on how to report a concern to Bing says reporting does not necessarily lead to removal, that it limits removals to a narrow set of circumstances, and that the most reliable fix is asking the website that published the content to delete it. In practice that means the people-search opt-outs below matter more than any search-engine form, because they remove the source rather than one view of it.
People-search sites and data brokers
People-search sites assemble public records and bought data into profiles that can show where someone lives now, where they lived before and who they live with. Most opt-outs happen one site at a time: find your own listing, use the site's opt-out page rather than an emailed link, and expect to confirm the request by email. Some ask for the exact profile URL, so save it before you start.
California residents have a shortcut. CalPrivacy's Delete Request and Opt-out Platform (DROP) sends one deletion request to registered data brokers, who must start processing DROP requests from 1 August 2026 and return to the platform at least once every 45 days; the agency warns it could take up to 90 days for statuses to update. Eligibility is limited to California residents, but the agency's data broker registry is public, which makes it a useful checklist of companies to search even if you live elsewhere.
Australia has nothing equivalent. The OAIC's summary of your rights under the Privacy Act lists access, correction, opting out of direct marketing and making a complaint, not a general right to have your information deleted, and it notes the Act mainly applies to organisations with an annual turnover above $3 million, subject to exceptions. An Australian opt-out therefore often depends on the site's own policy, so record every request and response in a tracker like this one:
| Stage | What to record | Why it helps later |
|---|---|---|
| Listing found | Site name, the exact profile URL and a screenshot of what it displayed | Proves what was public and lets you confirm the listing really went |
| Request sent | Date, method (web form, email or post) and the inbox you used | A single dedicated inbox keeps confirmations together and your main email out of broker files |
| Verification asked for | Email link, phone code, or a request for identity documents | Flags sites that want more ID than the removal seems to need, so you can decide before sending it |
| Removal confirmed | Confirmation email or a screenshot of the empty search | Evidence to quote if the profile resurfaces under a slightly different name |
| Next check | The date you will search that site again | Listings can return when a site refreshes its data, so a removal is not permanent |
Records you create: business names, domains and newsletters
Some of the most precise links are ones creators create themselves when they go professional. Registering a business name puts the holder and a service of documents address on ASIC's public register, and ABN Lookup shows a sole trader's legal name as the entity name. Our guide to business name registration for creators explains those two records and their privacy requests, and our register-by-register guide to keeping your address private in Australia covers the electoral roll and company records.
Domains are next. auDA's WHOIS policy for .au names says a registrant's street address and phone number are never disclosed, but the registrant's legal name is, along with a contact name, and the web lookup also shows a contact email. auDA's guide to the .au WHOIS tool suggests role-based contacts, such as a job title and a generic inbox, and the policy itself now says the Registrant ID field should be left blank for someone registering as a citizen or resident. For .com and other generic domains, ICANN's Registration Data Policy makes redaction of personal data mandatory only where applicable law requires it and optional otherwise, so whether your name and address show depends on your registrar. Look up your own domain with ICANN's lookup tool rather than assuming.
Newsletters are the one creators forget. The FTC's CAN-SPAM compliance guide says a commercial email must include a valid physical postal address, which can be a post office box or a private mailbox registered under US Postal Service rules rather than your street address. Open the last newsletter you sent and read the footer: whatever address it shows is visible to every subscriber and anyone they forward it to.
Old accounts and the username trail
Make a list of every account you can remember opening, from school onwards: social apps, gaming platforms, forums, marketplaces, fitness trackers and anything with a public profile. For each one, decide whether to delete it, rename it, make it private or strip out photos and personal details. Accounts you can no longer sign in to are worth a recovery attempt purely so you can remove them, because an abandoned profile with your real name and an early photo can sit in search results for years.
Then check what your current profiles say about each other. Linked accounts, mutual follows, shared profile pictures and identical bios all connect identities that you meant to keep apart. On Discord, connected accounts can appear on your profile unless you hide them, which our Discord safety settings guide walks through, and our Reddit privacy guide covers separating a promotion account from a personal one.
Keep the audit current
An audit is a snapshot. Turn on the notifications in Google's Results about you so new matches reach you, and rerun the full search after anything that changes your footprint: moving house, registering a business or domain, starting a newsletter, a post that travels well beyond your audience, or a new collaboration that tags you. Keep the worksheet and tracker afterwards. If someone does publish your details, the record of what was public and what you had already removed helps you work out where the information came from, and our doxxing response plan picks up from there.
Geo-blocking is a different control that limits who can see your content in particular regions; it does nothing about records held elsewhere, and our guide to blocking countries on OnlyFans explains what it misses.
Limitations of an exposure audit
This is general information, not legal advice, and it reflects the official pages we read on 1 October 2026; tools and policies change. Some records cannot be removed at all, including court documents and information a search engine considers to be in the public interest. Delisting a page hides it from one search engine without deleting it, brokers can relist people, and suppression requests on government registers can be refused. Nothing here stops someone who already knows you, follows you home or recognises a landmark in a video. If you are being threatened, or someone has come to your home, call Triple Zero (000) in Australia or your local emergency number and report it to police. For legal remedies against the person or site publishing your details, speak to a lawyer.