Your address, phone number or ID posted on X? What X counts as private, how to report it from the post or by form, and what to do first if unsafe.
Report the post on X from the more icon, choose Report, then say it is about you. You can also use X's Private Information form and choose Private content is being posted. X bans sharing home addresses, ID documents, non-public phone numbers and bank details without permission. If you feel unsafe, contact the police first.
SummaryA stranger has posted your home address on X. Or your personal phone number, a photo of your ID, or the name behind your anonymous account. Replies are piling up and you do not know who has seen it. This is frightening, and the first thing to think about is your physical safety, not the post.
This guide follows X's Help Center pages as they read today. It covers what X counts as private information, what it does not, who can report, the form options, what X can do, and a safety checklist. One wrong step can cost you the account, so know what you are doing before you start, especially before you reply to the person who posted it.
Last checked: 29 October 2026.
X's Private information policy says you may not threaten to expose, encourage others to expose, or post other people's private information without their express permission. Report the post through X's normal reporting flow, which the Report abusive behavior page describes: select the more icon on the post or profile, select Report, and choose who the report is for, such as Myself. X also has a Private Information form.
The policy splits information into what you cannot share without permission and what X does not treat as private. This table puts the two side by side.
| X treats as private | X does not treat as private |
|---|---|
| Home address or physical location, such as street addresses or GPS coordinates | Names |
| Identity documents, such as government IDs or national identity numbers | Birthdates or ages |
| Non-public personal phone numbers, email addresses or passwords | Places of education or employment |
| Bank account or credit card details | Business locations that are publicly available |
| Health information, such as biometric data or medical records | Descriptions of physical appearance |
| The identity of an anonymous user, such as their name or media of them | Gossip, rumours, accusations and allegations |
The policy also bans threatening to expose someone's private information, sharing details that would let others hack into someone's accounts, offering or asking for a reward to post someone's private information, and asking for a reward in exchange for not posting it, which X calls blackmail. It says screenshots of messages are not a violation unless they contain private information such as someone's phone number.
This part of the policy matters if your details were already online. The policy says that if information was shared somewhere else first, such as someone putting their own phone number on their public website, X may not treat it as private. It then adds an important exception: X may take action against home addresses being shared even if they are publicly available, because of the potential for physical harm. X also says it considers physical location and phone numbers to be higher risk than other types of information, and that it looks at why the information was shared, acting where it believes the intent is abusive or to harass.
The policy says anyone can report private information when it has been shared in a clearly abusive way. When it is not clear, X says it may need to hear directly from the owner of the information or an authorised representative, such as a lawyer, before taking action. So a friend's report can help, and filing your own report as Myself means X hears from you directly. For photos and videos of you, X's Right to Privacy section says it needs a first person report from the person shown or a representative such as a parent, legal guardian or lawyer, and that this part of the policy does not apply to public figures.
When we opened the form in a desktop browser on 29 October 2026, it loaded normally and showed these two questions. If it does not load for you, use the report option on the post instead.
These steps are our own suggestions, not X instructions. Do them in the order that fits your risk.
Our guide on making a police report for online harassment in Malaysia explains what to bring. For the legal position on doxxing in Malaysia, see our guide to online harassment law and the Online Safety Act.
The policy lists the enforcement options: X may require the person to remove the post and spend a period in read-only mode before they can post again, with account suspension possible for repeat violations. It may also suspend accounts whose sole purpose is to post others' private information or media. The person can appeal if they believe X got it wrong.
X cannot unshare what people have already seen or saved. The report page also says X does not release account information except as required by valid legal process, so if you need to know who is behind an account, that goes through the police or a lawyer. You can block the account, but X's blocking page says blocked accounts can still see your public posts.
The steps above come first, and you should start there. It gets harder when your details spread across several accounts, when information was already public elsewhere and X does not see it as private, or when the person keeps reposting from new accounts. A report that does not show why the information is private may not lead to action, and anyone promising instant removal for a payment is not using X's routes.
If you are unsure how to show X that your information is private, or the post is spreading, having an experienced team handle it is the safer choice. AwareXone helps people document doxxing and file through X's official routes. See our content removal help, or apply for a case review.
A review helps when your details are posted on several platforms, when you are a public facing person who is a repeat target, or when reports have been closed without action. AwareXone is independent of X, that works only through X's own reports and forms. We never ask for your password or login codes, and X makes the final decision. Read how we work on our trust page.
More free guides on the same kind of problem.
