Only the country is made public, but it is still doxing. If what X/Twitter is doing is not doxing, how do you define doxing? This being leaked would make some X/Twitter users concerned about their safety. Here I’m thinking activists, journalists and other high-risk actors who need to hide their location. Those people probably should already be taking countermeasures but that’s beside the point.
Which gets to the questions asked by OP. I wonder, can X/Twitter users just start using VPN or Tor or something to hide their real country/region, or will that not work retroactively (relates to question 2)? The X/Twitter settings screenshots in this article suggests it is possible, and when VPN use is detected X/Twitter also displays “Country or region may not be accurate.” Further, users can reveal just the continent/region and not the country.
I’m not a X/Twitter user but at this stage I would suggest that concerned users change the setting to continent/region and start using a VPN or Tor.
Aside, according to the same article I cited, other changes to user profiles include
- how many times the account has changed its username
- how the user downloaded the X/Twitter app.