How to report impersonation or doxxing on X and Twitter

Separate deceptive identity from harmful content

On X, an impersonation report targets an account posing as another person, group or organization in a confusing or deceptive way. Not every pseudonym, themed account or critical account is impersonation. X's authenticity policy permits parody, commentary and fan accounts when they clearly disclose the lack of affiliation and satisfy X's labeling conditions.

Doxxing is different: it concerns publishing or threatening to disclose private information without authorization. One account may create both problems, but the evidence record should separate the deceptive profile from each post exposing information.

• Account copying an identity to deceive
• Clearly labeled parody or commentary
• Post containing an address, private contact detail or document
• Threat to expose data or intimate media
• Criticism, rumor or allegation without private data

Preserve URLs and context without repeating the exposure

Save the profile URL, @handle, display name, biography, photograph and posts in which the account claims to be the affected person or brand. For private information, record every post URL, date, author and data category while redacting unnecessary details from screenshots shared with wider teams.

Do not quote or repost an address, phone number, document, credential or intimate material to warn others. Repetition can increase harm. Physical threats, extortion, unauthorized access, child-safety issues or immediate danger should be escalated to appropriate security, specialist and official support.

• Complete profile URL
• @handle and copied identity elements
• Individual URL for each post
• Date, language and thread context
• Public proof of the authentic identity

Report impersonation through the identity route

X says the affected person or an authorized representative can file through its Help Center. A bystander who sees impersonation can report directly from the profile. X's official help also states that an X account is not required to report impersonation.

After receiving a report, X investigates whether the account violates its rules. The platform may suspend it or require changes so the account no longer violates policy. A report does not automatically transfer a username or guarantee suspension, and account verification is a separate process.

• Affected person or representative: Help Center form
• Bystander: report from the profile
• Brand: consider the trademark route where applicable

Use the privacy policy for data and media

X's policy covers categories such as home address or private location, identity documents, non-public contact information, financial details, health information and the identity of an anonymous person. It also prohibits threats, rewards and blackmail connected to disclosing private data or intimate media.

X says anyone can report private information shared in a clearly abusive manner. In other cases it may need a report directly from the owner or authorized representative. For private media, the platform normally requires the depicted person or representative to report. X also considers whether information was already public, intent, public interest and public-figure status, so not every post is removed.

• Classify the data or media type
• Explain lack of consent and risk
• Identify who is eligible to report
• Do not present ordinary public information as private

Record outcomes without promising an X decision

Measure each item separately: report submitted, reference received, post removed, profile changed, account suspended, request declined or content still active. Screenshots and copies on other platforms require separate review at every location.

X makes independent decisions and may retain content it considers permitted, newsworthy or in the public interest. No responsible agency controls the outcome or coordinates false or mass reporting. When removal is not available, a security notice, verifiable correction, authentic-account protection or monitoring may be more appropriate.

• Status of every profile and post
• Users or customers warned
• Authentic accounts secured
• Copies outside X
• Next review date

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks