Serious answer: nothing except their own lack of access to anything except the ip address and whatever you give them.

But that's easy to counter with a VPN and a bit of common sense.

Technical measures are impossible in this particular case. However, I would say that the complete lack of benefits or incentives makes it very unlikely. Doing so could be illegal and collecting data which is otherwise useless is only a liability and a waste of resources. Basically the admin own self-interest I would say is what's stopping them. That said, if someone is individually afraid due to a bad relationship with an admin, then personal motives could void the above, in which case, they should change instance probably or use a VPN at least.

Always use a VPN. Its mandatory

Yes, there are laws against doxxing in several countries.

There is no technical aspect stopping it. Every website has your IP, sometimes also the people you chat with or write emails to, as this might (or might not) be part of the meta-information.

An IP address is a boring piece of information. Usually you can just infer the country and which internet service provider someone uses. You'd need to sue the ISP or get a court order to get the name and address of who's using that IP number.

Running these services is a lot of work and requires some skill, at least to do it sustainably. Usually it's certain people who are dedicated enough and willing to put in the effort... They are motivated to build something or help people. That's what drives them. It's somewhat unlikely but not impossible that they participate in malicious behaviour. Sometimes internet drama happens. But users aren't stupid either.

(But people who want to destroy and troll, rarely have the character traits to succeed at something like this. You'd pass on easier methods to wreak more havoc, to instead spend time learning webhosting, Linux, build up a community and maintain the server... You wouldn't do all of that unless it were worth it. I can only imagine that happening in a targeted attack that pays a good amount of money. Or a really good amount of internet fame because you doxxed a high-profile celebrity or something like that.)

I run an instance. I promise, I have literally 0 care about who you are. I have much more productive things to do with my time.

There's not much to prevent it from happening. They could lose standing in the community. They could be given legal trouble, and they could be attacked in return by people who knew which server owner was responsible. But that's pretty much it.

There's also a much lower bar for entry when it comes to running a server. All you need to "be" is technically competent. You don't need to be very good at security, and you don't need the temperament of a reasonable person.

And when that's the case, data might be leaked even indirectly.

Two Mastodon examples come to mind.

• One administrator shut down their servers after being accused of transphobia. They could have done anything after having a bit of a public meltdown, so that was the best case scenario.
• Another server administrator was raided by police, and all the contents on the server were made accessible to them.

Don't let your guard down but at some point trust and risk consideration is required for most systems to work. If you're after solutions; you could run your own node in the cloud and federate it.

Because its a waste of there time? What's stopping anyone from doxxing you?

An IP address by itself isn't going to let you dox users unless you have access to the databases that map these to the subscriber accounts. Typically, you would need to be an ISP or law enforcement to do this, but you can also purchase this information from a data broker if you know what you're doing.

With that said, there is absolutely nothing stopping the instance operator from getting your IP address. You're connecting to his or her computer which they own, so they can easily see where you're connecting from.

Ethically it'd be shitty and people don't want to be part of an instance with shitty admins so people would migrate away. Technically, nothing unless you're using a VPN. Welcome to the internet, the same is true for every website