What counts as personal information
- Home address, phone numbers, private email addresses and government ID numbers.
- Financial details, private documents and private messages.
- Photos that identify you or your family, and details that let people find or contact you.
- Your employer or workplace being named in order to harass you.
Step by step
- If you feel unsafe, contact the police as well. A platform report is not a substitute.
- Capture the permalink and a dated screenshot of every post and comment showing the information.
- Report each one to Reddit as personal information (Rule 3).
- Check edits, reposts, cross-posts and replies for the same details, and report those too.
- Once Reddit removes the source, ask Google to remove the same details from search results using its personal information and doxxing policy.
In the EU and the UK
Where GDPR applies, Article 17 gives a right to erasure in defined circumstances, and the Google Spain ruling lets individuals ask search engines to delist results that are inadequate, irrelevant or excessive. Both have exceptions for freedom of expression and for people with a role in public life.
What Reddit's privacy rule covers
Reddit's rules prohibit instigating harassment, for example by revealing someone's personal or confidential information. They also prohibit posting, or threatening to post, intimate or sexually explicit media of a person without their consent, and that includes sexually explicit AI-generated content depicting a real, identifiable person. The community usually calls this the "no doxxing" rule.
Reddit's guidance draws a line between public figures in a public context and private individuals. Naming and showing a public figure in a public setting is treated differently from posting the full name and address of a private person. Historically the policy has also barred links to personal information, such as public social media pages, and screenshots that show a private person's name. Read the current wording before relying on any detail.
How to report personal information
Report the content as soon as you see it. Use the report option on the post or comment, and, where more space or evidence is needed, Reddit's reporting form on its website. The form asks for details of the problem and lets you attach files.
- Report each item separately, with its permalink.
- Say what the information is, whom it identifies and why it is private.
- Do not repeat the private details in your report if you can describe them instead.
- Also report to the community's moderators. They can often remove content faster than an administrator can review it.
- Keep a record of each report and every reply.
Intimate images shared without consent are handled separately. Tools such as StopNCII.org let a person create a digital fingerprint of an image on their own device so that participating platforms can block it. Check on that site whether Reddit takes part before you rely on it. Content involving minors should be reported to Reddit straight away and, in serious cases, to the authorities.
Getting it out of Google: Results about you
Removing the Reddit post fixes the source. Google has two separate tools to help with search results. The first is "Results about you", a free tool for adults in supported regions. You enter your name, address, phone number and email, Google looks for matching results, and you can ask it to remove them from a dashboard or by choosing the remove option on a result. Google says it emails you once a request is received, that you can follow its status on the dashboard, and that there can be a delay between approval and removal.
The tool needs the information to match what appears on the page. Google may decline if the page is on an educational, government or news site, if it is considered valuable to the public, or if the information is professional rather than personal. It removes the result from Google Search only. The page stays on the site and on other search engines.
Getting it out of Google: the removal policy
Google's policy lets people ask for removal of certain categories of personal information from Search: contact details such as addresses, phone numbers and email addresses, government ID numbers, bank and card numbers, ID photos and signatures, medical records and confidential login details.
It also covers doxxing content: a page that contains your information together with explicit or implied threats or calls for others to harass you, or a large amount of aggregated personal data with no legitimate purpose. Newsworthy or public-interest content may stay, and public records and government sources are generally not removed. Removal can be complete or partial, where the page is hidden only for searches for your name or other identifier.
Google's own advice is to try to have the source changed first, and to use the removal request once the content has been taken down. If a page has been deleted but old text still appears in results, Google's outdated-content tool asks it to refresh the page.
If you are in the UK or the EU
Europe has an additional route. In Google Spain v. AEPD and González (2014), the Court of Justice of the EU held that individuals can ask a search engine to delist results for searches on their name when the data is inadequate, irrelevant, no longer relevant or excessive, balanced against the public interest. The right is now found in the GDPR, including the right to erasure in Article 17 and the right to object in Article 21. The European Data Protection Board has published guidelines on how delisting requests are assessed.
The UK Information Commissioner's Office explains the right to erasure in plain language. It applies when data is no longer needed, consent is withdrawn, your interests outweigh the organisation's, the data was unlawfully collected, or it was collected from you as a child for online services. You can ask in writing, and the organisation generally has one calendar month to reply, which can be extended if it tells you in the first month. Freedom of expression, legal obligations, public interest tasks and legal claims are among the exemptions. If you are unhappy, you can complain to the organisation, then to the ICO, or go to court.
Delisting removes a link from name searches. It does not remove the content at its source, so it works best alongside a report to Reddit.
Protecting yourself while the content is live
- Save dated screenshots and permalinks before anything changes.
- Change passwords and turn on two-factor authentication on important accounts.
- Tighten privacy settings on social media and remove location details from photos.
- Consider a credit freeze if identity numbers or financial details were exposed.
- Tell people who need to know, such as an employer, a school or your bank.
- If you are threatened, contact the police and keep a copy of the report.
People-search and data-broker sites compile information from public records and other sources, and opt-outs are scattered and often need repeating. In California, a state law known as the Delete Act is designed to give residents a single way to ask brokers to delete their data, and the state's privacy agency publishes the current details. Laws on doxxing differ by state and country, and some now give victims the right to bring a civil claim, so if threats are involved it is worth getting legal advice.
Quick reference: private information
- Home address, or a workplace address tied to a person
- Phone numbers and personal email addresses
- Government ID, financial or account numbers
- Private messages, photos and documents not meant to be public
- Real names linked to an anonymous account, posted to expose someone
- Information about family members or children
Common mistakes
Posting the details again to complain
Repeating them makes another copy. Describe the problem without the detail.
Waiting to see if it blows over
Private details spread quickly. Early reports have fewer copies to chase.
Assuming "publicly available" means allowed
Gathering scattered public facts to target a person can still break the rule.