It's worth noting that these sites in particular log absolutely everything. This information, in the hands of the right individual can also be used to correlate your identity.
Let's say you live in a dystopia such as the UK and you have expressed a haram thought on Twitter:
- This offends someone, so therefore you committed a crime
- So, they serve Twitter with a subpoena or probably ask really nicely and get your IP
- They go to your ISP and now you are doxed
- Optionally: they come to your workplace to "check your thinking"
OK, so you use a VPN:
- This offends someone, etc etc
- Twitter gives your info they have.
- They identify your IP pretty swiftly as being an IP used by a VPN
- They also give your gmail address, so they go to Google
- Google reports all the IP addresses you ever used
- At one point, you used your real ISP
- You are now doxed
So remember it's important to make sure that ALL traffic goes via your VPN if you want to avoid ending up in this situation.
However, let's say, I, a certain glowing individual, work for a large corporation which runs services that you and many people likely use:
- I am offended by your herecy against doctrine
- I trick you into visiting a site I control
- I scan access logs to find your IP address
- I pull up whatever info I find on you and delete all logs of my activity to cover my tracks
- You are now doxed
- Optionally: using parallel construction, I come up with another way to explain how I doxed you if anyone asked
This is likely how a few high profile doxings where the individual (despite being up to date with current opsec) was doxed anyway.
So, you'll see that even using a VPN doesn't always help. This is why I use a separate computer and a separate VPN account on that separate computer when I commit thought crimes.
You'd probably think that large corporations have checks and balances against this sort of thing happening. Some do, most don't, and if you have the right level of access you can often cover your tracks.