Discovering that an online friend shared your private information can cause panic, anger, or embarrassment. The exposure may be a screenshot of a personal conversation, your real name, a photograph, your school or workplace, a phone number, an address, account details, or intimate content.
What you do next depends on what was shared, who can see it, and whether there is an immediate threat. You do not need to solve everything at once. Start with safety, preserve what you may need, contain the exposure, and bring in appropriate support.
If someone is threatening to come to your location, harm you, or harm another person, move somewhere safer and contact your local emergency services now. If you are under 18, involve a parent, guardian, school safeguarding lead, or another trusted adult as soon as possible.
Is this a privacy breach or doxxing?
A privacy breach is a broad term for information being accessed or shared without permission. Doxxing usually means publishing identifying information with the aim, or foreseeable effect, of enabling harassment, intimidation, or harm. Definitions and laws differ by location, and a platform may use its own policy terms.
Do not wait to settle the label before taking action. A private-message screenshot may need a different response from a public post containing your home address, but both can violate trust and deserve a proportionate response.
Before acting, sort the exposed material by risk:
- Conversation content: private messages, personal stories, or private group posts
- Identity clues: real name, face, usernames, date of birth, relatives, or location history
- Location details: home address, school, workplace, live location, routine, or travel plans
- Contact information: phone number, email address, or private account handles
- Account access: passwords, recovery codes, security answers, or session links
- Financial or identity data: bank details, payment cards, government identifiers, or identity documents
- Intimate material: sexual images, recordings, or manipulated intimate content
The following ten steps move from immediate safety to longer-term recovery.
1. Get to safety and avoid negotiating under pressure
If the information creates a physical risk, go to a secure place with people you trust. Tell household members, building security, school staff, or workplace security only what they need to help protect you. Do not meet the person, travel to confront them, or announce where you are going.
If someone demands money, more images, account access, or continued contact in exchange for removing the information, do not pay or send more material. Payment rarely gives you control over copies and may lead to further demands.
Pause before responding publicly. An angry quote-post can show more people where the material is located and may reveal additional details. Your first objective is containment, not winning the argument.
2. Find out exactly what was shared and where
Make a limited inventory without repeatedly searching every platform. Record:
- What information or files appeared
- The exact account and platform involved
- Direct URLs, post IDs, group names, or message channels
- Whether the audience is public, private, or unknown
- When it was posted and whether it has been copied
- Any threats, demands, or encouragement to contact you
Ask a trusted person to help if viewing the material is distressing. They can collect URLs and report copies without engaging with the poster.
Avoid asking many people to send the content back to you. That can create more copies. If the material contains sexual content involving anyone under 18, do not download, forward, or redistribute it. Involve a trusted adult and use the specialist resources described below.
3. Preserve relevant evidence safely and lawfully
Content can disappear after a report, so preserve the information you may need first when it is safe and lawful to do so. Useful evidence can include:
- Full-page screenshots showing the account, date, context, and URL
- The direct link to each post or profile
- Usernames, display names, and profile links
- Dates and times with your time zone
- Messages containing threats, demands, or admissions
- Report confirmation numbers and platform responses
- A short written timeline of what happened
Keep the evidence in a secure folder that is not publicly shared. Do not edit the originals; make a separate copy if you need to highlight something. Laws about recording, possession, and evidence vary, so seek local advice when necessary.
Never save or circulate sexual imagery involving a minor as ordinary evidence. The eSafety Commissioner's doxing guidance also recommends collecting evidence before reporting, then using platform, support, and law-enforcement options appropriate to the risk.
4. Report the content through official channels
Use the platform's reporting flow for privacy violations, sharing personal information, harassment, impersonation, non-consensual intimate imagery, or threats. Choose the most precise category available. Include direct URLs and state what identifying information is exposed.
If the content appears on a website, look for its abuse, privacy, or legal contact. A hosting provider or search engine may have separate processes, but removal from search results does not remove the source page.
Keep your request factual:
This post shares my private phone number and home location without my consent. It creates a safety risk. Please restrict access, preserve relevant records, and remove the content under your privacy and harassment policies. The direct URL is [link].
Do not include more private information than the service needs to locate and assess the post. If identity verification is required, confirm that you are using the service's genuine help center before uploading a document.
5. Secure every account the exposure could affect
If a password, recovery answer, email address, phone number, or identity detail was exposed, assume it could be used against related accounts.
Start with your primary email because it can reset other accounts. Then:
- Change reused or exposed passwords to long, unique passwords.
- Turn on multifactor authentication, preferably with an authenticator or security key when available.
- Sign out unknown devices and revoke unfamiliar sessions or connected apps.
- Review recovery email addresses, phone numbers, forwarding rules, and backup codes.
- Update security questions whose answers may now be public.
- Check privacy settings, contact visibility, tagged posts, and location sharing.
Use official apps or type the service's address yourself. A person exploiting the incident may send a fake "security" link to steal your login. Our anonymous chat safety tips explain additional ways to keep separate identities from becoming connected.
6. Protect exposed financial or identity details
The right action depends on the data and your country. Contact the relevant institution through the number on its official website, app, card, or statement—not through contact details in a message about the incident.
If payment information was exposed, ask the card issuer or bank about locking or replacing it and monitor transactions. If a government identifier or identity document was shared, contact the issuing authority and the official identity-theft service in your location.
In the United States, IdentityTheft.gov provides a recovery plan based on the information exposed. Credit freezes or fraud alerts may be appropriate for some identity breaches. Other countries have their own national cyber, consumer-protection, or identity services.
Do not post the leaked details again while asking whether they are dangerous. Give sensitive information only to a verified organization that needs it for the response.
7. Warn affected people or organizations proportionately
Your leaked information may create risk for someone else: a family member named in a message, a coworker shown in a photo, a shared household, or an organization whose access details appeared.
Tell the relevant person privately and stick to the facts:
A post shared my private messages, and one screenshot includes your first name and workplace. I have reported it. I am sending the URL so you can make your own report; please do not repost the image.
If a home, school, or workplace location was exposed, alert the people responsible for safety there. Give them the account name, a description of any threat, and a way to reach you. Ask them not to confirm your schedule or contact details to unknown callers.
Avoid a mass warning unless the audience truly needs it. Broad announcements can amplify the original information and attract curiosity.
8. Block, report, and stop feeding the escalation
After preserving what you need, report and block the responsible accounts. Tighten who can mention, tag, message, add to groups, or view older posts. Ask friends not to argue with the poster on your behalf.
If one safe written boundary is useful, keep it short:
I did not consent to you sharing that information. Remove it and do not post or send any copies. I will communicate through the platform's reporting process from here.
Do not continue negotiating after threats begin. Repeated responses can supply attention, new quotations, or information about what frightens you. If the person creates new accounts, document and report the pattern rather than restarting the conversation.
The fact that this person was once a friend does not require private mediation. Compare their behavior with these online friendship red flags and prioritize safety over preserving the relationship.
9. Monitor for copies without making the incident your whole day
Check the original URLs and a limited set of relevant searches at planned intervals. Search for the exposed phone number, email, username, or distinctive phrase in quotation marks only when doing so will help you find actionable copies. Use image-search tools cautiously for photos.
Keep a simple log: date checked, copy found, report filed, and result. Enlist a trusted person if monitoring is harming your sleep or concentration.
Do not click unknown download links, enter credentials into "removal" sites, or pay unverified reputation services. Scammers target people who urgently want content erased. A realistic goal is to reduce visibility and risk, document important copies, and secure what the information could unlock—not to prove that no copy exists anywhere.
10. Get support and decide what happens to the friendship
A privacy breach by a friend is also a betrayal. Tell someone who can help you think clearly: a trusted friend, parent, guardian, counselor, school safeguarding lead, workplace security contact, victim-support service, attorney, or local law enforcement, depending on the harm.
Use local professional advice for legal questions. Privacy, harassment, stalking, extortion, and intimate-image laws vary by jurisdiction, and a general article cannot determine which law applies to your case.
You do not owe the person continued access because they apologize or delete one post. Consider:
- What they shared and how dangerous it was
- Whether the act was deliberate, reckless, or repeated
- Whether they removed copies without bargaining
- Whether they accept responsibility without blaming you
- Whether renewed contact would expose more information
You may end contact immediately. If you are grieving the relationship afterward, how to get over an online friend addresses the emotional side without minimizing the safety problem.
If your home, school, or workplace was exposed
Treat precise location information as higher risk, especially when it appears with threats or a predictable schedule.
- Tell household members or the responsible security contact
- Ask people not to confirm whether you are present
- Review deliveries, visitor access, location sharing, and public directories
- Change routines temporarily when local professionals advise it
- Preserve any threat and contact emergency services if danger is immediate
- Avoid posting your current location or your safety plan
A city or general region is not the same as a street address, but several small clues can combine into a precise location. Review old profiles, tagged photos, event posts, fitness routes, and public wish lists for connected details.
If private messages or personal stories were shared
Separate embarrassment from risk. A screenshot may be painful even when it contains no address or account credential. Report it if it violates platform rules, ask participants not to forward it, and correct dangerous falsehoods only where necessary.
Do not publish the entire conversation to prove context. That often widens the exposure. A concise statement may be enough:
Private messages were shared without my permission. I have reported the posts and will not repost the conversation. Please do not send or request copies.
If the breach followed pressure for increasing personal details, review how to stop oversharing online. The responsibility for sharing without consent remains with the person who did it; improving future privacy does not transfer blame to you.
If intimate images or videos were shared
Do not negotiate, pay, or send more content. Save URLs, account names, and written threats, but do not redistribute the imagery.
If the image was taken when the person shown was under 18, use NCMEC's Take It Down, involve a trusted adult, and follow local reporting guidance. Do not download an image you do not already have in order to submit it.
Adults can review StopNCII.org to see whether its participating-platform process applies. Platform reporting and local victim-support or law-enforcement options may also be appropriate.
Visit the Chats Only Safety Center for broader crisis and reporting resources. If you are in immediate danger, contact local emergency services rather than waiting for a platform response.
Copy-and-adapt reporting messages
A platform report
This account published my private [address/phone number/messages/photo] without permission on [date]. The content creates [a safety/privacy/harassment] risk. Please remove it under the applicable policy and preserve records associated with my report. URLs: [links].
A request to a group moderator
A member posted private information about me in [channel/group]. I have preserved the link and reported the account. Please remove the post, stop reposts, and avoid quoting the information in moderator announcements.
A notice to a trusted contact
My private information was posted online. I am safe right now and working through reports. Please do not contact the poster or share screenshots. I may need help monitoring these specific links: [links].
A location-safety notice
My [home/school/work] location was shared online, along with [brief description of threat if any]. Please do not confirm my presence or schedule to anyone. I have saved the evidence and contacted [relevant service].
Frequently asked questions
Can I make an online friend delete my private information?
You can request removal and use platform reporting, but you may not be able to control every copy. Legal options depend on the content and jurisdiction. Focus on official removal processes, evidence, account security, and qualified local advice.
Should I publicly call them out?
Usually, public confrontation risks amplifying the information and escalating the conflict. Report first. If a public clarification is necessary, share the minimum needed and do not repost the private material.
What if they say sharing it was an accident?
An accident may affect whether trust can eventually be repaired, but it does not remove the need for containment. Ask them to delete the material, identify where it went, request removal from recipients, and stop discussing it publicly. Judge the response by action, not only apology.
Should I contact the police?
Contact local emergency services for immediate danger. For threats, stalking, extortion, identity theft, intimate-image abuse, or persistent doxxing, local law enforcement or a victim-support professional can explain reporting options. Practices and laws differ by location.
What if the friend lied about sharing it?
Preserve the conflicting messages and focus on verifiable facts: URLs, recipients, timestamps, and account activity. You do not need a confession to report exposed information. Our guide for when an online friend lied to you can help with the separate trust decision.
Can the friendship recover?
Possibly, when the harm was limited, the person acts quickly to contain it, accepts responsibility, respects every new boundary, and does not repeat the behavior. Recovery is not required. Serious or deliberate exposure may make ending contact the safest decision.
Move from panic to a documented response
An online friend sharing your private information can make the internet feel suddenly uncontrollable. Narrow the problem: protect immediate safety, identify what was exposed, preserve relevant evidence, report the source, secure affected accounts, and involve people who can help.
You are allowed to choose safety over confrontation and distance over reconciliation. The person who violated your privacy does not get to control how quickly you respond, whom you ask for help, or whether the friendship continues.