Doxxing can feel terrifying because the harm is immediate: your address, phone number, workplace, school, private photos, government IDs, or family details may suddenly be exposed online, sometimes with threats or harassment. In the Philippines, “doxxing” is not always charged under one single law, but it can fall under several Philippine offenses depending on what was posted, how it was obtained, who posted it, and what harm followed. This guide explains what doxxing means legally, which agencies handle it, what evidence to save, how to report it to the PNP, NBI, CICC, DOJ, or National Privacy Commission, and what practical issues victims commonly face.

What Is Doxxing?

Doxxing means publicly revealing or spreading someone’s private or identifying information online without consent, usually to shame, threaten, harass, blackmail, or expose the person to danger.

Common examples include posting or sharing:

Home address, condo unit, dormitory, workplace, or school
Personal phone number, email address, or social media accounts
Government IDs, passport details, TIN, SSS, GSIS, PhilHealth, driver’s license, or PRC number
Bank details, e-wallet numbers, screenshots of transactions, or account information
Private chats, intimate photos, or videos
Names and photos of children, relatives, employers, clients, or co-workers
False accusations combined with personal information, such as “this person is a scammer” plus address and phone number
“Call this person,” “go to their house,” “make their life miserable,” or similar mob harassment posts

The important legal point is this: Philippine law looks at the specific act, not just the label “doxxing.” A doxxing incident may be treated as cyber libel, identity theft, unlawful data disclosure, grave threats, unjust vexation, gender-based online sexual harassment, photo/video voyeurism, violence against women, or a civil privacy violation.

Is Doxxing a Crime in the Philippines?

There is no Philippine statute that simply says “doxxing is punishable as doxxing.” But the same conduct may be punishable under several laws.

Main Legal Bases That May Apply

Situation	Possible legal basis	What it covers
Someone posts your private information to harass, shame, or expose you to danger	Republic Act No. 10175, Cybercrime Prevention Act of 2012	Cybercrime offenses, including identity theft, cyber libel, and crimes committed through information and communications technology
A person uses your name, photo, account, ID, or identifying data without authority	RA 10175, Section 4(b)(3)	Computer-related identity theft
The post contains false and defamatory accusations	Revised Penal Code, Article 353 and Article 355, in relation to RA 10175 Section 4(c)(4)	Cyber libel
The post includes threats to kill, hurt, rape, destroy property, or harm your family	Revised Penal Code, Articles 282 to 285, in relation to RA 10175 Section 6	Grave threats, light threats, or other threats committed online
The doxxing is meant to annoy, torment, or distress but may not fit a heavier offense	Revised Penal Code, Article 287, in relation to RA 10175 Section 6	Unjust vexation or other light offenses, depending on facts
A company, employer, school, lender, clinic, online seller, government employee, or data handler leaked your personal data	Republic Act No. 10173, Data Privacy Act of 2012	Unauthorized processing, malicious disclosure, unauthorized disclosure, breach duties, and data subject rights
The doxxing includes sexual harassment, misogynistic, homophobic, transphobic, or gender-based abuse online	Republic Act No. 11313, Safe Spaces Act of 2019	Gender-based online sexual harassment
The doxxing includes intimate photos, nude images, sex videos, or threats to release them	Republic Act No. 9995, Anti-Photo and Video Voyeurism Act of 2009	Taking, copying, reproducing, selling, distributing, publishing, or broadcasting private sexual photos/videos without consent
An ex-partner, spouse, or dating partner doxxes a woman or her child as part of abuse	Republic Act No. 9262, Anti-Violence Against Women and Their Children Act of 2004	Psychological violence, harassment, threats, and protection orders
You want damages or injunction even if the act is not clearly criminal	Civil Code, especially Article 26	Privacy, dignity, peace of mind, and civil damages

RA 10175 is especially important because Section 6 increases the penalty when crimes under the Revised Penal Code or special laws are committed by, through, and with the use of information and communications technology.

What Agencies Handle Doxxing Complaints?

Several offices may be relevant. Choosing the right one depends on the facts.

Office	Best for	Practical notes
PNP Anti-Cybercrime Group	Most cyber harassment, cyber libel, identity theft, threats, doxxing through Facebook, TikTok, X, Instagram, Telegram, Viber, or messaging apps	You may file through a Regional Anti-Cybercrime Unit or use the PNP-ACG e-complaint channel when available
NBI Cybercrime Division / Computer Crimes Division	Cybercrime complaints needing technical investigation, digital forensics, or suspect tracing	NBI’s citizen charter lists investigative assistance for victims of computer crimes; intake may be same day, but investigation can take longer
Cybercrime Investigation and Coordinating Center	Initial reporting, triage, scam or cyber incident referral, hotline-based assistance	CICC often coordinates or refers matters to enforcement agencies
DOJ Office of Cybercrime	Cybercrime policy, international cooperation, mutual legal assistance, cross-border cyber matters	Important when the platform, server, or suspect is abroad
National Privacy Commission	Data privacy violations, leaks by organizations, misuse or malicious disclosure of personal information	NPC formal complaints require a specific form and notarization
City or Provincial Prosecutor’s Office	Preliminary investigation after law enforcement builds the complaint, or direct filing in some cases	The prosecutor determines probable cause for criminal cases
Barangay / Women and Children Protection Desk	Immediate safety, VAWC-related harassment, local threats, protection concerns	Barangay conciliation is usually not the main route for serious cybercrime, but barangay protection measures may matter in VAWC cases

For urgent threats to life, physical safety, stalking, extortion, or sexual-image blackmail, the immediate priority is safety and evidence preservation. A cybercrime complaint can follow, but dangerous threats should also be reported to the nearest police station or appropriate protection desk.

Step-by-Step Guide: How to Report Cybercrime Doxxing in the Philippines

1. Preserve the Evidence Before It Disappears

Doxxing posts are often deleted, edited, hidden, or moved to private groups. Save evidence immediately.

Collect:

Screenshots showing the full post, comment, caption, profile name, date, time, reactions, and URL if visible.
Screen recordings scrolling from the profile/page/group to the post, showing the account identity and link.
Exact URLs of the post, profile, group, page, channel, or message thread.
Usernames, handles, account IDs, display names, and profile photos.
Copies of private messages where the person admits posting, threatens you, demands money, or coordinates harassment.
Witness details from people who saw the post.
Proof of harm, such as threatening calls, messages from strangers, workplace reports, anxiety treatment, security incidents, or lost income.
Your proof of identity and connection to the exposed information, such as ID, account ownership, employment proof, or proof that the address or number belongs to you.

Do not rely on screenshots alone if you can still access the original post. Screenshots can be useful, but investigators and prosecutors usually prefer a complete evidence trail showing where the post came from, when it appeared, and how it connects to the suspect.

2. Avoid Actions That Can Damage Your Case

When people are angry or scared, they often do things that make the case harder.

Avoid:

Deleting the original messages or blocking the account before saving evidence
Editing screenshots
Cropping out dates, URLs, usernames, or timestamps
Doxxing the person back
Threatening the suspect
Posting accusations that may expose you to a counterclaim
Paying blackmailers without documenting the demand
Asking friends to mass-report before you preserve evidence

You can still report the content to the platform for takedown, but preserve the evidence first if it is safe to do so.

3. Report the Content to the Platform

Platform reporting is not the same as filing a Philippine criminal complaint, but it can reduce immediate harm.

Use the platform’s privacy, harassment, impersonation, non-consensual intimate image, or personal information reporting tools. For example:

Facebook or Instagram: privacy violation, harassment, impersonation, intimate image abuse
TikTok: harassment, bullying, personal information exposure
X: private information, abusive behavior
YouTube: privacy complaint, harassment
Telegram, Viber, WhatsApp, Messenger: account abuse, threats, non-consensual sharing

Save the report confirmation or ticket number. If the platform removes the post, that helps reduce harm, but it may also remove public access to evidence. This is why screenshots, screen recordings, URLs, and saved copies matter.

4. Prepare an Affidavit-Complaint

An affidavit-complaint is a sworn written statement explaining what happened. It is usually required for a formal criminal complaint.

A good affidavit should clearly state:

Your full name, address, contact details, and valid ID
The suspect’s name, username, account link, phone number, or other identifying details, if known
When you discovered the doxxing
What exact information was exposed
Where it was posted or shared
Why the information was private or sensitive
How the suspect may have obtained it
Whether threats, blackmail, sexual harassment, defamation, or impersonation were involved
What harm you suffered
What evidence is attached
Whether you want criminal investigation, preservation of data, takedown assistance, or referral to another agency

If you are filing with the NPC for a data privacy complaint, the NPC requires a formal complaint in a specific format, with notarization, and submission through its allowed channels.

5. File With the PNP Anti-Cybercrime Group or NBI Cybercrime Division

For most doxxing cases involving social media, messaging apps, fake accounts, threats, cyber libel, impersonation, or identity theft, file with either:

PNP Anti-Cybercrime Group, including the nearest Regional Anti-Cybercrime Unit; or
NBI Cybercrime Division / Computer Crimes Division.

Bring both printed and digital copies. In practice, investigators often ask for:

Requirement	Notes
Valid government ID	Passport, driver’s license, UMID, national ID, PRC ID, etc. Foreigners should bring passport, visa page, ACR I-Card if available
Affidavit-complaint	Some offices may help you draft or refine the narration
Screenshots and printouts	Include URLs, timestamps, account names, and captions
Digital copies	USB drive, phone, laptop, cloud folder, or email copy; keep originals on your device
Proof of account ownership	Email notices, profile settings, phone number, recovery email, or ID matching the account
Proof of exposed information	Documents showing the address, number, ID, workplace, or other data belongs to you
Witness statements	Useful if posts were in private groups or stories
Medical, psychological, HR, school, or security records	Useful when claiming harassment, threats, trauma, work consequences, or safety risk
For minors	Birth certificate, school ID if relevant, parent or guardian ID, and proof of authority to act
For representatives	Special Power of Attorney or written authorization, especially if the victim is abroad

There is generally no “filing fee” for reporting a cybercrime to law enforcement. Costs usually come from private notarization, printing, transportation, legal assistance, or expert preservation of digital evidence.

6. Ask About Data Preservation

Under RA 10175, service providers may be required to preserve traffic data, subscriber information, and content data for specific periods when properly ordered or requested by law enforcement. This matters because platforms, telcos, internet providers, and apps do not keep all useful data forever.

In practical terms, early reporting helps investigators seek preservation of:

Account registration details
Login records
IP logs
Device or session information
Subscriber data
Message or post metadata
Other technical traces linking the online account to a real person

This does not mean the police can instantly reveal the suspect. Access to subscriber or content data may require legal process, cyber warrants, cooperation from platforms, or international assistance.

The Supreme Court’s Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, provides procedures for warrants involving disclosure, preservation, interception, search, seizure, and examination of computer data.

7. File With the National Privacy Commission if Personal Data Was Misused

A complaint with the National Privacy Commission is especially relevant if the doxxing came from:

An employer or former co-worker using HR records
A school or university employee
A hospital, clinic, laboratory, or health worker
An online lender or collection agent
A seller, courier, payment processor, or marketplace
A government employee or contractor
A company database breach
A person who obtained personal data through an organization or system

Under the Data Privacy Act, personal information must be processed lawfully, fairly, and proportionately. Sensitive personal information includes, among others, health data, government-issued IDs, tax information, licenses, and information about proceedings or offenses.

The NPC’s formal complaint process requires downloading the complaint form, filling it out, notarizing it, and submitting it in person, by courier, or by email according to the NPC’s current instructions.

8. Follow the Prosecutor Process

After investigation, the case may be referred to the City or Provincial Prosecutor’s Office for preliminary investigation. This is where the prosecutor determines whether there is probable cause to charge the respondent in court.

Expect the following:

The complaint is docketed.
The respondent may be required to file a counter-affidavit.
You may be asked to submit additional evidence or a reply-affidavit.
The prosecutor issues a resolution.
If probable cause is found, an Information is filed in court.
Cybercrime cases generally go to the Regional Trial Court, often a designated cybercrime court.

Timelines vary widely. Simple intake can happen the same day. Technical investigation can take weeks or months. Cases involving fake accounts, foreign platforms, deleted posts, encrypted apps, or suspects abroad can take much longer.

Which Offense Fits Your Doxxing Case?

Doxxing With Defamatory Accusations: Cyber Libel

If the post says something defamatory, such as accusing you of being a scammer, thief, prostitute, adulterer, drug user, corrupt employee, or criminal, cyber libel may apply if the elements of libel are present.

Cyber libel is based on libel under the Revised Penal Code, committed through a computer system under RA 10175. The Supreme Court in Disini v. Secretary of Justice upheld cyber libel but also limited unconstitutional applications of parts of the Cybercrime Prevention Act.

A very practical timing issue: in Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. If the doxxing post is also defamatory, delay can become a serious problem.

Doxxing With Fake Accounts or Impersonation: Identity Theft

If someone uses your name, photo, personal data, ID, phone number, or account to pretend to be you, open accounts, scam people, or mislead the public, computer-related identity theft under RA 10175 may apply.

Useful evidence includes:

The fake profile URL
Screenshots comparing your real account and the fake account
Messages from people who were deceived
Platform notices
Proof that the name, photo, number, or ID belongs to you
Any admission or link between the fake account and the suspect

Doxxing With Threats

If the post includes “pupuntahan kita,” “alam ko address mo,” “ipapapatay kita,” “ilalabas ko nude photos mo,” or similar threats, investigators may consider threats under the Revised Penal Code, in relation to RA 10175 if done through ICT.

Threat cases are stronger when the words, context, and actions show seriousness. Save the full conversation, not just the scariest line.

Doxxing With Intimate Images

If someone posts, sends, sells, uploads, or threatens to distribute private sexual photos or videos, RA 9995 may apply. Consent to take a private photo or video is not automatically consent to share it.

If the victim is a minor, the case becomes more serious and may involve child protection laws, online sexual abuse or exploitation laws, and urgent intervention by specialized units.

Doxxing by an Ex, Spouse, or Dating Partner

If a woman or her child is doxxed by a husband, former husband, boyfriend, former boyfriend, live-in partner, or dating partner as part of intimidation, humiliation, stalking, or psychological abuse, RA 9262 may apply. This may also support requests for protection measures.

Evidence should show the relationship, pattern of abuse, threats, and effect on the woman or child.

Doxxing by a Company, School, Employer, or Online Lender

If the leak came from a business or institution, the Data Privacy Act becomes important. Common examples include:

Online lending apps posting a borrower’s photo and contacts
Collection agents messaging relatives or co-workers
HR staff leaking employee records
School personnel posting student details
Clinics or laboratories disclosing health information
Sellers or couriers exposing customer address and number

The NPC route can run alongside a criminal complaint if the facts justify both.

Common Problems in Doxxing Cases

“The Account Is Fake. Can the Police Still Trace It?”

Possibly, but not always quickly. Investigators need technical data, platform cooperation, cyber warrants, or provider records. Fake accounts are harder when the suspect used VPNs, public Wi-Fi, foreign SIMs, hacked accounts, or encrypted channels.

You can help by preserving every link between the account and a real person: writing style, phone numbers, payment details, mutual contacts, reused photos, recovery emails, transaction receipts, admissions, or screenshots showing the suspect controlling the account.

“The Post Was Deleted. Can I Still File?”

Yes, if you preserved evidence. Deleted content may still be supported by screenshots, screen recordings, witnesses, archived links, platform notices, or technical preservation if reported early enough.

“Can I Sue if the Information Was Already Public Somewhere Else?”

Possibly. Public availability does not automatically make malicious republication lawful. The legal question is not only whether the information existed somewhere, but how it was gathered, why it was posted, whether it was accurate, whether it was necessary, whether sensitive data was involved, and whether the post was intended to harass, threaten, shame, or cause harm.

“Can I File From Abroad?”

Yes, but expect extra documentation issues. If you are a Filipino abroad or a foreigner outside the Philippines dealing with a Philippine-based offender, evidence, or victim, you may start with online or email reporting, but formal affidavits may need to be notarized before a Philippine Embassy or Consulate, or notarized locally and apostilled if the country is part of the Apostille Convention.

If the suspect, platform, or server is abroad, Philippine authorities may need assistance through the DOJ Office of Cybercrime and international cooperation channels. RA 10175 has jurisdictional rules that may apply when elements occurred in the Philippines, a computer system in the Philippines was used, a Filipino national committed the offense, or damage was caused to a person in the Philippines.

“Should I Go to the Barangay First?”

For serious cybercrime, threats, identity theft, intimate image abuse, or data privacy violations, going directly to PNP-ACG, NBI, or the proper prosecutor is usually more practical. Barangay conciliation is limited and is not designed for technical cybercrime investigation.

However, the barangay may still matter for immediate local safety issues, especially in VAWC situations where a Barangay Protection Order may be relevant.

Practical Evidence Checklist

Before filing, prepare a folder with:

01_Affidavit_Complaint
02_Valid_ID
03_Screenshots_Posts
04_Screen_Recordings
05_Profile_and_URLs
06_Private_Messages_and_Threats
07_Proof_of_Identity_or_Data_Ownership
08_Witnesses
09_Platform_Reports
10_Proof_of_Harm

For each screenshot or recording, label:

Date captured
Platform
URL or username
Short description
Person who captured it
Device used

This makes the investigator’s job easier and reduces back-and-forth.

Frequently Asked Questions

How do I report doxxing in the Philippines?

Preserve screenshots, screen recordings, URLs, usernames, timestamps, and proof of harm. Then file with the PNP Anti-Cybercrime Group or NBI Cybercrime Division. If the issue involves misuse or leakage of personal data by an organization, also consider filing a complaint with the National Privacy Commission.

Is doxxing illegal in the Philippines?

Doxxing is not usually charged under a single law called “doxxing,” but it may be illegal under the Cybercrime Prevention Act, Data Privacy Act, Revised Penal Code, Safe Spaces Act, Anti-Photo and Video Voyeurism Act, Anti-VAWC law, or Civil Code, depending on the facts.

Can I report someone for posting my address online?

Yes, especially if the posting was meant to threaten, harass, shame, expose you to danger, or encourage others to contact or attack you. Save the post, URL, account details, comments, shares, and any threats or messages that followed.

What if someone posted my phone number and people are harassing me?

Save call logs, messages, screenshots of the post, and proof that the number belongs to you. Report the original doxxing post and the resulting harassment. If the harassment includes threats, sexual abuse, extortion, or defamatory accusations, mention those clearly in your affidavit.

Can I file a cybercrime complaint even if I do not know the real name of the person?

Yes. You can file against an unknown person identified by username, account link, phone number, email, or other digital identifiers. The challenge is tracing and proving who controlled the account, so preserve every technical and circumstantial clue.

Should I delete my account or change my number?

For safety, you may change privacy settings, limit visibility, remove public contact details, and warn trusted people. But before deleting accounts, messages, or posts, preserve evidence first. Deleting may make it harder to prove what happened.

Can the police force Facebook, TikTok, Telegram, or other platforms to reveal the user?

Philippine law enforcement may seek preservation, disclosure, or other cyber warrants when legally justified. For foreign platforms, cooperation may involve platform policies, legal process, and sometimes international assistance. It is not always immediate.

Can I get the doxxing post taken down?

Yes, you can report it through the platform’s privacy, harassment, impersonation, or intimate image reporting tools. For legal takedown or evidence requests, law enforcement or court processes may be needed depending on the platform and type of data.

What if the doxxing came from an online lender or collection agent?

Save the posts, messages to your contacts, caller IDs, collection texts, loan app details, and proof of disclosure. This may involve the Data Privacy Act, Cybercrime Prevention Act, lending or collection regulations, and possible harassment-related offenses. Filing with the NPC and law enforcement may both be appropriate.

Can a foreigner report doxxing in the Philippines?

Yes. A foreigner in the Philippines should bring a passport, visa or ACR details if available, evidence, and local contact information. A foreigner abroad may need a notarized and apostilled or consularized affidavit, depending on how the complaint will be filed and used.

Key Takeaways

Doxxing is not always a standalone offense in the Philippines, but it can be punishable under several laws.
The most common legal routes are RA 10175, RA 10173, cyber libel, identity theft, threats, Safe Spaces Act violations, RA 9995, RA 9262, and Civil Code privacy claims.
Preserve evidence before reporting the content for takedown.
File with PNP-ACG or NBI Cybercrime Division for most cybercrime doxxing cases.
File with the National Privacy Commission when the doxxing involves misuse, leakage, or unauthorized disclosure of personal data by an organization or data handler.
For cyber libel, the Supreme Court has clarified that the prescriptive period is one year from discovery, so delay can affect the case.
Fake accounts can still be investigated, but tracing takes time and depends heavily on technical records, platform cooperation, and well-preserved evidence.
Victims abroad can report Philippine-related doxxing, but affidavits and documents may need consular notarization or apostille.