Skip to content

Online Safety & Harassment

Visible trans people online are targeted at high rates. Harassment is not a sign that you have done anything wrong; it is a structural feature of the current internet for trans people, especially trans-feminine people, and especially those with public-facing accounts. The skill on this page is operational — preparing your account hygiene, document hygiene, and escalation paths before you need them, and triaging incidents when they happen.

This page coordinates with Legal § Discrimination for legal escalation paths and with Mental Health → Minority Stress for the underlying stress framing. For evaluating online communities themselves see Online Communities.

Threat-model basics

Threat modeling means choosing defenses that match the actual threat rather than buying generic "security." Wrong-target defenses waste effort and leave real gaps open. Three axes structure the choice.

Targeted vs broadcast harassment

  • Broadcast harassment. High-volume replies, pile-ons, quote-dunks. The attacker rarely knows or cares who you are individually; you are an avatar in a crowd. Defenses: reply filtering, mute, lock-down posture, riding it out.
  • Targeted harassment. An attacker has chosen you, individually, and is willing to invest time. Defenses: account hardening, doxxing prevention, a documentation pipeline, legal escalation.

The same incident can shift axes. A broadcast pile-on can spawn one obsessed follower who then becomes a sustained targeted threat; treat axis shifts as their own re-evaluation point.

Anonymous troll vs known-person stalker

  • Anonymous troll. The threat is reputational and emotional, not physical. Blocking and muting are usually sufficient. Reporting is low-yield but free.
  • Known-person stalker — ex-partner, transphobic family member, hostile former coworker. The threat is physical, financial, and informational. They already have data brokers don't. Defenses must include legal options (restraining orders; see Legal § Discrimination) and physical security, not only account hygiene.

Pile-on incident vs sustained campaign

  • Pile-on. 24–72 hours of intense activity that decays as the algorithm moves on. Survival posture: lock down, do not engage, let it pass.
  • Sustained campaign. Weeks-to-months of coordinated harassment, often with named-target lists. Requires durable infrastructure: lawyer on retainer for serious cases, documentation discipline, mental-health support.

Trans-feminine-specific risk profile

Trans-feminine people, particularly trans women of color, are over-represented among victims of fatal anti-trans violence relative to population. The Human Rights Campaign's Epidemic of Violence annual reports document this pattern year over year. Online harassment is part of a continuum with offline violence — credible online threats against visible trans-feminine people merit the same seriousness as their offline equivalents, not dismissal as "just the internet."

The minority-stress framework (Hendricks & Testa, A Conceptual Framework for Clinical Work with Transgender and Gender Nonconforming Clients) explains why repeated low-grade harassment compounds: each incident adds to a chronic stressor load rather than resetting between events. See Mental Health → Minority Stress.

Account hygiene before you need it

The cheapest time to harden accounts is now, not during an incident. The items in this section are routine maintenance, not emergency response.

Strong passwords and a password manager

  • Use a reputable password manager (Bitwarden, 1Password, KeePassXC). Generate unique random passwords for every account. Reuse is the single largest individual-account compromise vector.
  • Master password: a long passphrase (5–7 random words), memorized.
  • Audit the manager periodically against known-breach databases (Have I Been Pwned integration).

Multi-factor authentication

Tier MFA by account risk:

Tier Method Use for
Strongest Hardware security key (YubiKey, SoloKey) — FIDO2/WebAuthn Primary email, password manager, financial accounts, anything whose compromise unlocks others
Strong TOTP app (Authy, Aegis, 2FAS, Google Authenticator) Most accounts
Last resort SMS Accounts with no other option

SIM-swap attacks against trans women are documented. SMS MFA is better than no MFA on accounts with no other option, but never on the recovery path of your password manager or primary email.

Recovery email compartmentalization

  • The recovery email should not be the daily email. Create a dedicated recovery address, give it its own strong password and hardware-key MFA, and do not use it for anything else (no signup lists, no public posting).
  • This contains blast radius: a compromise of your daily email cannot cascade into "reset password on every account."

Phone-number deattachment

  • Remove your phone number from accounts that don't strictly require it. Many platforms now allow full detachment once another MFA method is configured.
  • Consider a dedicated VOIP number (Google Voice, MySudo) for accounts that insist on a phone number. Carrier numbers leak through data brokers.

Legacy-account audit

This is the trans-specific step most people miss.

  • List every account opened pre-transition: old email providers, forums, gaming services, LinkedIn, Facebook, school portals, loyalty programs, shopping sites.
  • For each, decide: delete, rename, or abandon-with-cleaned-data.
  • Pay particular attention to:
  • Old email addresses that contain a deadname (often impossible to rename; delete after migrating any salvageable data).
  • Public forum posts under deadname-tied usernames (cross-platform username overlap is a major doxxing vector — see below).
  • Profile photos showing pre-transition appearance no longer wanted public.
  • Search engines cache aggressively. Removal from the source plus a Google Search Console removal request is more effective than source-only deletion. See Legal § State ID for the legal-name side.

Login alerts and session management

  • Enable login-from-new-device alerts on every account that supports them.
  • Periodically review active sessions and revoke ones you don't recognize or no longer need (old phones, old browsers).
  • For high-risk accounts, enable login-location notifications even for known devices — geographic anomalies are a useful signal.

Doxxing prevention

Doxxing is the public exposure of private identifying information — legal name, address, employer, family, phone. For trans people it routinely also means deadnaming. Prevention has two halves: reducing what's findable and knowing what's already out there.

Removing yourself from data brokers

People-search sites (Spokeo, BeenVerified, Whitepages, Intelius, Radaris, PeopleFinder, MyLife, TruePeopleSearch, FastPeopleSearch, and dozens of others) aggregate public records, marketing data, and prior-relationship inferences into a one-click profile. Most include opt-out mechanisms, but each must be opted out of individually, and many re-list after a few months.

  • DIY. Maintain a list — the EFF's Surveillance Self-Defense and Yael Grauer's Big Ass Data Broker Opt-Out List are starting points — and submit opt-outs on a recurring schedule (every 3–6 months).
  • Paid services. DeleteMe, Kanary, Optery, Privacy Duck submit opt-outs on your behalf and re-submit when relistings occur. Cost is the tradeoff.
  • Priority order. Start with sites that show home address and phone number, then sites that show relatives, then everything else.

What's already public — discover before attackers do

Adopt the attacker's view of yourself.

  • Reverse-image search profile photos (Google Images, Yandex, TinEye, PimEyes where available). If selfies appear on forums, dating sites, or scraper archives you forgot about, surface them now.
  • Cross-platform username search (knowem, namechk, Sherlock-style tools). If @yourhandle exists across thirty platforms, an attacker linking any one of them to your real identity links them all.
  • Search your own data. Run searches on Google and DuckDuckGo for your legal name, deadname, phone numbers, email addresses, and current and past addresses. Include quoted variants.

Photo metadata (EXIF)

  • Photos taken on a smartphone may embed GPS coordinates, device serial numbers, and timestamps in EXIF metadata.
  • iOS strips location data when sharing via the share sheet to most messaging apps and social networks (configurable per share). It does not strip metadata when AirDropping or attaching the original file directly.
  • Android behavior varies by manufacturer and app. Default share behavior is inconsistent.
  • Major social platforms (Twitter/X, Instagram, Facebook) strip EXIF on upload. Forums, Discord, Mastodon instances, and personal websites often do not.
  • Strip EXIF deliberately before posting via tools like ExifTool, ImageOptim, or built-in OS options ("Remove location" in the iOS share sheet).
  • Watch for background leakage in photos: address numbers, license plates, visible mail, work badges, prescription bottles with full names, distinctive apartment-window views.

Cross-platform username overlap

Treat your username as identifying information.

  • Use different usernames on accounts tied to your real identity (LinkedIn, professional Twitter), accounts tied to your trans identity (community Discord, support forums), and accounts tied to nothing (throwaway research accounts).
  • Keep a password-manager note mapping which username belongs to which identity. Cross-contamination is easiest to commit when the username registry lives only in your head.

Real-name leakage from family or employer accounts

You can lock down your own accounts and still be doxxed via:

  • Family members' public Facebook posts tagging you under your legal name.
  • Employer staff directories and "meet the team" pages.
  • School alumni directories.
  • Wedding announcements, obituaries, and old news articles.
  • Public real-estate records and voter rolls.

Mitigations: ask family to detag and lock down posts that include you; request removal from employer pages where possible; check voter-roll public-record opt-out provisions in your jurisdiction.

During an active incident

When harassment is happening right now, working from a checklist beats working from feelings. The decision tree below is the centerpiece of this page — it is what to consult when the notifications start.

The decision tree

The seven actions below are not strictly sequential. Block and Document typically run together from the first incident onward; Report, Escalate to platform, Escalate to law enforcement, and Engage a lawyer escalate as severity warrants.

Block

Use as the default first move for any account harassing you. Block does not need justification. Do not threaten to block, just block. Blocking removes the harasser's most direct access vector and starves their feedback loop.

When block is the primary tool: ordinary trolls, one-off insults, not-yet-escalated accounts.

Mute

Mute when block is overkill — you don't want to see them, but you also don't want them to know they're blocked (which on some platforms motivates account recreation or escalation). Mute is also useful for keyword-level filtering of slurs and your deadname during pile-ons.

Report

Be realistic: platform reporting is rarely effective for individual incidents on most major platforms. Trans-targeted harassment is frequently deemed not to violate policy even when it clearly does. Report anyway, because:

  • Aggregate reports can sometimes trigger action when individual reports cannot.
  • A documented report history is useful for later legal escalation.
  • Some platforms have higher-touch trust-and-safety pathways for active mass incidents (see "Escalate to platform" below).

Document

This is the step most people skip and most regret skipping.

  • Screenshots with visible timestamps, usernames, and URLs. Whole-screen captures, not cropped — cropped screenshots are easier to dismiss as fake.
  • Archive the original via archive.today (archive.ph) and the Internet Archive's Wayback Machine (web.archive.org). These create dated third-party copies that survive deletion by the harasser.
  • Preserve URLs, not only screenshots. URLs are necessary for platform reports and legal filings.
  • Keep a log file with date, time, platform, harasser handle, archive URL, and a one-line summary. This file is the artifact you hand to a lawyer.

Escalate to platform

When an incident is large enough or the threats credible enough:

  • Major platforms have trust-and-safety contacts that route faster than the generic report flow. Trans-supportive legal and advocacy orgs sometimes hold direct channels and can refer.
  • Identify a single point of contact at the platform if you can. Send your documentation file rather than asking them to reconstruct incidents.

Escalate to law enforcement

Threats can cross legal lines. True threats, stalking, swatting threats, and certain kinds of doxxing are criminal in most US jurisdictions and many others.

  • Police response to trans victims has historically been uneven. Expect to educate the responding officer, bring documentation, and be prepared to escalate to a supervisor.
  • File a report even if you expect inaction — the report number is required for some downstream remedies (civil suits, platform escalations, victim compensation).
  • Federal options exist for cross-state stalking and threat cases via the FBI Internet Crime Complaint Center (ic3.gov) for cyber-enabled crime.
  • For swatting risk specifically, see "Doxxing and SWATing risk" below.

Engage a lawyer

When harassment crosses into actionable territory — defamation, criminal threats, employer-targeted harassment, persistent stalking, NCII — bring in counsel early. Trans-supportive legal organizations (Lambda Legal, TLDEF, ACLU LGBT & HIV Project) can sometimes refer or take cases pro bono. Cross to Legal § Discrimination for the broader intake landscape.

Signal-vs-noise — when to read replies

During a pile-on, stop reading replies. There is no useful information in the 800th hostile reply that wasn't in the first ten. You are looking only for two specific signals:

  1. Credible threats — specific time, place, weapon, plan.
  2. Doxxing — your real address, employer, family appearing in the thread.

Everything else is noise. Hand the "scan for signal" job to a trusted friend (the incident-buddy pattern, below) and stay off the thread yourself.

Lock-down posture

  • Switch to private / followers-only / friends-only on each platform.
  • Disable replies from non-followers; restrict DMs to followers; turn off quote-tweet/quote-post if available.
  • Schedule a 24–72-hour away period. Pile-ons decay; stepping away starves the feedback loop.
  • Pre-stage a "lockdown profile" — private settings written down, ready to toggle in two minutes — so you don't have to figure it out under stress.

Specific harassment categories

The decision tree above applies across all of these. The notes below are the category-specific deltas.

Misgendering harassment

  • Often combined with deadnaming. Block early and aggressively.
  • Keyword-mute pronouns-as-weapons (e.g., the harasser's preferred wrong pronouns) during incidents.
  • On platforms that let viewers add pronouns to profiles, set yours. This does not stop motivated harassers but raises the cost and makes deliberate misgendering easier to flag in reports.

Deadnaming campaigns

  • Deadnaming is often used as a force-multiplier for doxxing. If your deadname is publicly searchable, every deadnaming post becomes an exposure event.
  • Aggressive cleanup of deadname-attached legacy accounts (see "Legacy-account audit") is the most durable defense.
  • Most major platforms now treat deadnaming-as-harassment as a policy violation; reports are slightly more likely to land than for misgendering alone.

Doxxing and SWATing risk

SWATing — falsely reporting an emergency at a target's address to provoke armed police response — is the highest-severity online-to-offline pivot in the harassment landscape.

SWATing is potentially fatal

People have been killed in SWATing incidents. If your home address has been doxxed, treat the elevated SWATing risk as serious enough to act on before anything happens, not after.

  • Make a preventive non-emergency call to your local police department. Identify yourself, explain that you have been doxxed, and ask that any 911 call to your address be flagged for cautious approach as a possible SWATing.
  • This works imperfectly and depends on your local department, but it has prevented tragic outcomes in documented cases. Get a name and a reference number for the call.
  • Concurrently: alert close neighbors, plan for the possibility of a forced entry (where to be in the home, how to identify yourself unambiguously to officers), and consider short-term relocation while the incident is active.
  • If you have a security system or doorbell camera, ensure footage is being preserved off-device.

For doxxing more broadly:

  • Document the leak (which fields, where posted, archive URLs).
  • Submit takedown requests to the host platform and to search engines for the cached versions.
  • Re-run the data-broker opt-out cycle — fresh public exposure tends to surface in broker datasets within days to weeks.

Image-based abuse / non-consensual intimate imagery (NCII)

  • The Cyber Civil Rights Initiative (cybercivilrights.org) maintains a 24/7 victim hotline and a Safety Center with platform-specific takedown procedures.
  • StopNCII.org and the NCMEC Take It Down service let you submit a hash of an image to participating platforms so the image can be matched and blocked without you having to re-upload it.
  • Document and preserve URLs for legal action; many US states and other jurisdictions have NCII-specific civil and criminal statutes, and documentation captured at the time of posting strengthens those cases substantially.

Identity theft and impersonation

  • Document the impersonating account and report under the platform's impersonation policy. These reports are usually higher-priority than generic harassment reports.
  • Place a credit freeze if financial impersonation is plausible — free in the US under federal law, at all three bureaus.
  • For identity theft proper, file at identitytheft.gov (FTC) for the official recovery plan and report number. The recovery plan is usable as evidence for downstream creditor and platform disputes.

Workplace contact

Harassers contacting your employer ("did you know you employ a trans person…") is a known tactic. Treat it as inevitable rather than surprising once you are visible.

  • Get ahead of it where possible. Tell your direct manager and/or HR before the harassment reaches them, framed as harassment of you, not as a question about you. This makes the contact much harder to weaponize as HR concern.
  • Forward harassing employer-directed emails to HR with a documentation note ("for the record; no action requested") rather than ignoring them.
  • If your workplace has a trans ERG or known trans-affirming HR contact, route through them where possible.
  • See Legal § Discrimination for the employment-discrimination protections that may apply if the employer responds badly.

Family contact

  • Warn close family in advance that this can happen and to forward, not respond to, suspicious contact.
  • Provide a short script for relatives ("we don't comment on our family member's life to strangers; please don't contact us again") so that good-faith but unprepared family members aren't drawn into engagement.
  • For estranged or hostile family who might cooperate with harassers: this is a stalking-equivalent threat, not a harassment threat. Restraining orders and address-confidentiality programs (where available in your state) become relevant — see Legal § Discrimination and Legal § State ID for the document-confidentiality side.

Recovery and aftermath

The incident isn't over when the notifications stop. Three categories of work follow.

Account cleanup post-incident

  • Rotate passwords on any account adjacent to the incident.
  • Re-audit active sessions and revoke unfamiliar ones.
  • Re-check what's publicly findable — data brokers will often pick up new information from incident-related public posts within weeks.
  • Update your "lockdown profile" notes with anything you learned about which platform settings actually helped versus which didn't.

Mental-health recovery — bringing in a therapist

Sustained harassment is traumatic. Symptoms — sleep disruption, hypervigilance, intrusive memory, avoidance, social withdrawal — are normal responses to abnormal pressure, not weakness. A trans-affirming therapist familiar with minority-stress framing (Hendricks & Testa, A Conceptual Framework for Clinical Work with Transgender and Gender Nonconforming Clients) and ideally with trauma modalities (CPT, EMDR, somatic) is the right match.

If acute crisis enters the picture — suicidal ideation, plans, or means acquisition — escalate to crisis support, not only therapy. See Mental Health → Suicide & Safety Planning. Internalized harassment rhetoric can also surface as a flare in internalized transphobia; see Internalized Transphobia.

Documentation that survives the incident

The documentation file built during the incident has long-term value:

  • Backed up to two locations (cloud + local encrypted volume).
  • Indexed by date and incident, so future you or a future lawyer can find a specific event in five minutes, not five hours.
  • Retained even after you "feel done" — patterns across incidents matter legally, and a third incident can reopen the file on the first two.

Building durable resilience

Harassment as a recurring fact of life calls for infrastructure rather than one-off responses.

Posting volume and visibility tradeoffs

  • Visibility is in tension with safety. A 100k-follower account will absorb more harassment than a 500-follower account by structural fact, regardless of what you post.
  • Choose your visibility level deliberately, not by drift. Periodically ask whether your current posting volume matches the resilience you can sustain.
  • The 2015 U.S. Transgender Survey and the 2022 USTS Early Insights Report both document harassment rates that scale with visibility; the underlying pattern is structural, not individual.

Account-compartmentalization strategy

Three-tier compartmentalization is enough for most situations:

Identity Audience Hygiene posture
Public-facing Anyone Limited personal detail, no doxx-relevant info, highest hygiene, hardware-key MFA
Community / friends Known network More personal, smaller audience, locked down by default
Private / utility Financial, medical-portal, government only Never used for posting, never linked to the others, separate password-manager folder

Cross-contamination is the failure mode to design against — a separate password-manager folder per identity, distinct usernames, and distinct recovery paths.

Trusted-friend incident-buddy pattern

Pre-arrange with one or two trusted friends:

  • During an active incident, they scan replies for credible threats and doxxing while you stay off the thread.
  • They keep a copy of your documentation file (encrypted, with shared decryption key arranged in advance).
  • They have a pre-shared list of who to contact (lawyer, HR, key family) if you become unable to act on your own behalf.

This is the single highest-leverage piece of resilience infrastructure for trans people online. The pattern works precisely because the people best suited to triage replies are not the people receiving them.

Sources

Operational guidance

Identity theft and cybercrime reporting

Population-level context

Theoretical frame

  • Hendricks ML, Testa RJ — A Conceptual Framework for Clinical Work with Transgender and Gender Nonconforming Clients: An Adaptation of the Minority Stress Model. See Mental Health → Minority Stress for fuller treatment.