Out Yourself Last: A No-Bullshit Digital Security Field Guide for Queer People Who'd Rather Not Get Doxxed

Mon, 31 Au

Punk-rock concert poster showing a queer young person securing their digital life: switching off precise location, replacing photos with screenshots to strip EXIF data, and writing a community privacy plan, set against a wheatpaste collage of surveillance and identity imagery.

Primary source: https://disruptarian.com/blog/r2dc

The Electronic Frontier Foundation and the Trevor Project sat down together and answered one of the most quietly panicked questions floating around queer group chats right now: what's a single thing an LGBTQ+ person can do today to be safer online? The joint advice, posted on EFF's Deeplinks blog, is short, sane, and refreshingly free of corporate gloss. We tore it apart, line by line, because the difference between "I read a privacy tip" and "I actually locked my life down" is about a hundred small habits. This is the street-level version.

The framing the two organizations use is the right one: digital safety is not a vibe, and it is definitely not one app. It is a series of trade-offs you make every time you upload, log in, or check in. Some queer people are terrified of being outed to family or employers. Some have already been outed and are now more worried about doxxing, swatting, or coordinated harassment. Some just want to stop a stalker ex from seeing their check-ins. The threat model is personal, and the advice has to bend to it source↗.

The Core Move: Audit What You've Already Shared

EFF and Trevor's headline recommendation is deceptively simple: go back through the information you have already handed to platforms and start pulling it back. They call it "revising" what you've shared. The Disruptarian translation is harsher and more accurate: you have been the product, and now you need to claw back inventory. The post walks through four concrete buckets, and each one is worth treating like a checklist item rather than a suggestion source↗.

1. Protect the obvious identifiers first

Full legal name. Home address. School. Phone number. Personal photos. These are the data points that turn a screen name into a person, and a person into a target. The Trevor Project contributors, including the team member Tommy who introduces the video, urge readers to be cautious about any detail that lets someone pin a real-world coordinate to your handle. If a photo of your face is part of your threat model, use an avatar instead. There is no virtue test in showing your face online; there is only a risk calculation, and that calculation belongs to you source↗.

The post also pushes two underused tactics that are worth amplifying. First, lowkey the workplace talk. The more specific you are about where you work, the easier it is to find you via LinkedIn, Glassdoor, Google reviews, or a company directory. Second, kill the background tells in your photos. A distinctive porch, a recognizable street sign, or a landmark in the frame is enough for a motivated attacker to narrow your location to a block, sometimes a building source↗.

2. Strip the metadata before you post the photo

This is the single most underrated piece of advice in the entire piece, and it deserves its own paragraph. EXIF data is the invisible backpack your phone straps to every JPEG: GPS coordinates, device model, timestamp, sometimes even the serial number of the camera. The original file can tell a harasser exactly where a photo was taken. The fix that EFF and Trevor recommend is brutally simple: take a screenshot of the photo and share the screenshot instead. Screenshots flatten the image and drop the metadata payload. It costs you a little resolution. It buys you a lot of safety source↗.

It is worth noting that the screenshot trick is a shortcut. If you want a cleaner solution, scrub EXIF in a dedicated app, disable location at the camera level, or use formats like PNG that handle metadata differently. But the screenshot method works on every phone on earth, in every app, right now. For queer people under immediate threat, "works right now" is the only spec that matters.

3. Treat your logins like a perimeter, not a habit

The post addresses a subtle trade-off in how you sign up for things. Using your phone number or a third-party login such as Facebook, Google, or Apple is convenient, but those providers can share data with the app you are logging into. The advice is honest about the trade-off: convenience in exchange for a smaller attack surface against password reuse, but a larger attack surface against platform-level data sharing. For high-risk users, the calculus is brutal. If you do not need the convenience, do not pay it source↗.

Two rules from EFF and Trevor that should not be negotiable for anyone under elevated threat: unique passwords per account, and two-factor authentication everywhere it is offered. "Unique" means a real, generated password stored in a manager, not "QueerBuddy1998" with a 1 swapped in. Two-factor means a second factor, ideally an authenticator app or a hardware key, not SMS, which is famously phishable and sim-swappable. EFF has long argued that strong authentication is one of the single highest-leverage moves a user can make, and the joint post carries that message forward source↗.

4. Audit app permissions like you audit your friends

Every social app on your phone is asking for two things it almost never needs: your precise location, and your full camera roll. The post pushes a permission audit, with a specific callout to location. Most modern phones and apps will let you downgrade "precise location" to a rough or manual entry, or to deny it entirely. Some apps will refuse to function without location, and that is information too: an app that breaks when you hide your coordinates is telling you, in plain text, that your data is part of its business model source↗.

What You Say, and to Whom, Matters as Much as What You Post

The fourth pillar of the EFF/Trevor guidance is the conversational one, and it is the part most guides skip. Be deliberate about what you disclose in DMs and group chats. Never share financial details. Trust your gut when something feels off, because social engineering is how most harassment pipelines start, not exotic zero-days. Review your profile's privacy settings on a schedule, not once-and-done, because platforms love to "improve" their defaults in your face and against your consent source↗.

Privacy Is a Communal Project, Not a Solo Hobby

The single sharpest sentence in the original post is this: "Good privacy decisions begin with proper knowledge about your situation and a community-oriented approach." That is EFF's institutional voice speaking, and it is the line that most consumer-facing "privacy tip" articles miss entirely. Individual hygiene is necessary and insufficient. The way queer people actually get doxxed is rarely through one leaked secret; it is through a chain of small disclosures across platforms and people that an adversary stitches together. The post points readers to two deeper resources: EFF's own "Building a Community Privacy Plan" explainer and the Trevor Project's "Guide to Online Safety for LGBTQ+ Young People." Both are worth the read, and both treat privacy as something a friend group or chosen family does together, not something you fix with one settings menu source↗.

The Threat Picture EFF and Trevor Are Responding To

The advice lands in a specific political moment, and it is worth naming. Anti-LGBTQ+ harassment campaigns have escalated sharply in recent years. Doxxing rings scrape dating apps, location check-ins, and pride event photos. State-level data broker pipelines buy and resell the kind of location data that apps vacuum up by default. Family-oriented "parental monitoring" apps are sometimes repurposed as outing tools against queer teens. Meanwhile, the platforms themselves have rolled back or weakened several internal safety teams, and end-to-end encryption is once again under legislative threat in multiple jurisdictions. EFF has tracked these regressions in its annual "Who Has Your Back" and surveillance legislation work for years; the Trevor Project sees the human cost in its crisis lines source↗. A defense guide that does not acknowledge the surrounding threat picture is just a product brochure, which is exactly what this guide is not.

A One-Day Field Plan, Reordered for People Under Pressure

If you only have an evening, do it in this order. First, change the password and enable two-factor on the three accounts that matter most: email, cloud storage, and your primary social profile. Email is the skeleton key to everything else, so it goes first. Second, audit app permissions, especially precise location, on every app you opened in the last week. Third, scrub or screenshot the last three photos you posted. Fourth, search your own name and your handle in quotes and see what surfaces. Fifth, sit down with one trusted person and write down what you would actually do if you were outed tomorrow. That last step is what EFF means by a community privacy plan, and it is the step that turns a checklist into a survival strategy.

None of this is paranoia. It is the boring, adult work of living online as a person a hostile world has reasons to harm. EFF and the Trevor Project are not selling a product. They are handing out a map. Use it, then hand it to someone you love.

Source: Electronic Frontier Foundation and the Trevor Project, "LGBT Q&A: What's One Thing I Can Do Today to Improve My Safety and Security Online as an LGBTQ+ Person?," published 31 August 2026, eff.org.