Summary. This article explains who owns a social media account when a company, an employee, a founder, an agency, or an influencer all have a claim to it, and what the law does when a handle is held hostage, squatted, or used to impersonate a business or a person. It breaks an account into its legal parts (the platform license, the handle, the credentials, the content, the audience, and the goodwill) and shows which body of law governs each. It tells the story of the leading cases, from PhoneDog v. Kravitz, Ardis Health v. Nankivell, Christou v. Beatport, and Eagle v. Morgan to In re CTLI, Mattocks v. BET, and the Second Circuit's 2024 decision in JLM Couture v. Gutman. It then covers the federal computer-access statutes after Van Buren, trade secret and contract theories, state employee password-privacy laws and the NLRA, the reasons the ACPA does not reach usernames, impersonation remedies under the Lanham Act and state statutes, and why Section 230 usually defeats suits against platforms over suspensions. An extended worked example, common mistakes, an FAQ, and practical takeaways close the article.

On a Friday afternoon, Fernhill Coffee Roasters fires its marketing manager, Dana Ruiz. Dana opened the company's Instagram account in 2017 from her own phone, using her personal Gmail address, and over seven years built it to 210,000 followers with a mix of roasting videos, café photos, and a running joke about her dog. By Monday morning three things have happened. The account is now called @danaroasts, its bio says "coffee person, formerly of Fernhill," and every post since 2017 is still there. Someone else has registered the now-vacant @fernhillcoffee and is offering it back to the company for $15,000 in a direct message. And a third account, @fernhill.giveaway, with Fernhill's logo and a blue check it bought for a monthly fee, is messaging the company's customers to say they have won a year of free coffee and need only enter a card number to cover shipping.

Fernhill's owner wants to know three things. Who owns the account Dana took? What can be done about the squatter? And how quickly can the fake giveaway be shut down before customers lose money?

Each question has an answer, but each is governed by a different body of law, and none of those bodies was written with social media in mind. Account ownership is decided by contract, property, trade secret, and agency principles. Lockouts implicate federal computer-crime statutes that the Supreme Court narrowed in 2021. Handles sit outside the federal anti-cybersquatting statute entirely. And the platform, the one party that can fix all three problems in an afternoon, is usually immune from suit and bound only by its own terms of service. This article explains how those pieces fit, how courts have actually decided these disputes, and what each side should do. The step-by-step response process is in Recovering or Defending a Social Media Account or Handle: A Practical Guide, the task list is in Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist, and the policies, clauses, and letters are in Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters.

The short answer

  • Nobody "owns" a social media account the way they own a car. The platform owns the system and grants a revocable, usually non-transferable license. What the parties fight over is the right, as between themselves, to control that license, plus the content, the audience, and the goodwill attached to it.
  • Written agreements decide most cases. Where an employment agreement, policy, or agency contract clearly assigns the account, courts enforce it. Where nothing clearly does, courts disagree about method. Some apply multi-factor tests looking at branding, purpose, and use; the Second Circuit in JLM Couture, Inc. v. Gutman, 91 F.4th 91 (2d Cir. 2024) rejected that approach under New York law and told courts to ask, as with any property, who owned the account when it was created and whether a contract later transferred it.
  • The early cases settled little and paid less. PhoneDog v. Kravitz (N.D. Cal. 2011) settled; Eagle v. Morgan (E.D. Pa. 2013) produced a liability finding and zero damages. The practical lesson is to decide ownership before a dispute, because litigation over it is slow and the damages are hard to prove.
  • Lockouts are rarely federal crimes after Van Buren. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, reaches access "without authorization" to a system, but civil plaintiffs must prove a qualifying "loss," and courts read authorization in terms of gates rather than purposes, Van Buren v. United States, 593 U.S. 374 (2021). A written revocation of access changes the analysis.
  • The ACPA does not cover handles. The anti-cybersquatting provision, 15 U.S.C. § 1125(d), applies to "domain names," a defined term in 15 U.S.C. § 1127. A squatted username is handled under platform policies and, if it is used to sell or confuse, ordinary trademark law.
  • Impersonation has fast and slow remedies. The fast one is the platform's impersonation or trademark report. The slow ones are Lanham Act false association under 15 U.S.C. § 1125(a), state right-of-publicity claims, and state online impersonation statutes such as Cal. Penal Code § 528.5 and Tex. Penal Code § 33.07.
  • Suing the platform over a suspension almost never works. 47 U.S.C. § 230 and the platform's terms defeat most claims, as in Fyk v. Facebook, Inc., 808 F. App'x 597 (9th Cir. 2020) and Murphy v. Twitter, Inc., 60 Cal. App. 5th 12 (2021). Escalation inside the platform is the real remedy.

What an "account" is, legally

Most disputes go wrong at the first step, because the parties argue about "the account" as if it were one thing. It is at least six things, each governed by different law.

Component What it is Governing law Who usually controls it
The platform relationship A license to use the service, on the platform's terms Contract (terms of service), Section 230 The platform, which can suspend or reclaim
The handle A unique string the platform assigns, such as @fernhillcoffee Platform policy; trademark law if used in commerce Whoever holds the credentials, subject to platform policy
The credentials The login email, phone number, password, and two-factor devices Agency, contract, computer-access statutes Whoever set them up, unless handed over
The content Posts, photos, videos, captions Copyright (17 U.S.C. § 106, § 201); publicity rights for people depicted The author or the author's employer
The audience Followers, friends, connections, subscriber data Trade secret, conversion, contract; platform terms on data use Contested; often no one has a property right
The goodwill The association between the account and a business or person Trademark and unfair competition; right of publicity The business whose mark it is, or the person whose identity it is

Three things follow from the table. First, the platform's terms are the outer boundary. Major platforms' terms generally prohibit selling, buying, or transferring accounts and usernames without permission, and reserve the right to reclaim handles, so a court order between two private parties cannot force a platform to do anything its terms do not allow (although platforms usually cooperate with a clear order). Second, control of the credentials is a fact, not a right. The person who holds the password has the account, whether or not they are entitled to it. Third, the audience is the prize in most disputes, and it is the component the law protects least.

Platforms also distinguish between personal and business accounts. LinkedIn profiles are personal by design, while company pages belong to the organization and are administered by individuals. Meta's business tools let a company own a "business portfolio" that holds pages and Instagram accounts and assign people roles in it. YouTube brand accounts can have multiple owners and managers. X and TikTok accounts are, at the system level, single logins, although both offer business features. These architectural choices matter in litigation: in Eagle v. Morgan, the fact that the disputed account was a personal LinkedIn profile bearing the founder's name was a large part of why the company's ownership claim went nowhere.

How the law got here

Social media account litigation began around 2010, when companies discovered that the employees they had asked to "do our Twitter" had built personal followings on company time. MySpace friends lists, Twitter followers, and LinkedIn connections were new kinds of business assets, and lawyers reached for the doctrines closest at hand: trade secret law for lists of contacts, conversion for things that were taken, the CFAA for unauthorized logins, and the Lanham Act for confusing uses of names.

The doctrines fit badly. Trade secret law protects information that is secret and subject to reasonable measures, but a follower list is often visible to anyone who clicks. Conversion historically required tangible property. The CFAA was written for hackers. And trademark law asks about consumer confusion in the marketplace, not about who built an audience. Fifteen years later, the case law is still thin, because most disputes settle quickly once the side without the password realizes how long litigation will take. What the cases do show is a set of practical factors that courts use, and a strong preference for enforcing whatever the parties wrote down.

The leading cases, as stories

PhoneDog v. Kravitz: the $340,000 follower list

Noah Kravitz reviewed phones and wrote for PhoneDog, a mobile-technology news site, and tweeted under the handle @PhoneDog_Noah. When he left in 2010, he changed the handle to @noahkravitz and kept the roughly 17,000 followers. PhoneDog sued in the Northern District of California, alleging misappropriation of trade secrets, conversion, and interference with economic advantage, and valuing the followers at $2.50 per follower per month for eight months, about $340,000.

Kravitz moved to dismiss, arguing among other things that the followers were worth far less and that PhoneDog had no protectable interest in them. In PhoneDog v. Kravitz, No. C 11-03474 MEJ (N.D. Cal. Nov. 8, 2011), the court declined to dismiss the trade secret and conversion claims, reasoning that the questions of whether the account's password and follower list were secret and valuable, and who had the right to the account, could not be resolved on the pleadings. The parties settled in December 2012 on confidential terms; counsel told reporters that Kravitz would keep the account.

The case decided nothing about ownership. Its influence came from the theory: that an employer-directed account, its credentials, and its follower list could be a trade secret, and that followers have a measurable value. Both propositions have been contested ever since.

Ardis Health v. Nankivell: the passwords as the thing that matters

In Ardis Health, LLC v. Nankivell, No. 11 Civ. 5013 (S.D.N.Y. Oct. 19, 2011), a company that marketed herbal and health products online had hired Ashleigh Nankivell as a video and social media producer. Her job included maintaining the passwords for the company's websites, email, and social media accounts, and her work product agreement provided that all work she created was the company's sole and exclusive property, prepared as a work made for hire. After she was fired, she refused to hand over the login information. Judge Buchwald granted a preliminary injunction requiring her to return it. The ruling turned on irreparable harm: without the credentials the company could not control its own online presence, and money could not repair that. The court found it unnecessary to resolve likelihood of success, and denied other parts of the motion where harm was not shown.

Two features of Ardis recur in later cases. The agreement was clear that the work product belonged to the employer. And irreparable harm was easy to see, because the company could not run its business while locked out of the channels it used to sell. The denied portions of the motion are just as instructive: conclusory assertions that confusion would cause harm were not enough. Ardis is the template for a fast credential-recovery motion: a clear contract, a clear lockout, and evidence that every day without access costs sales.

Christou v. Beatport: friends lists as trade secrets

Regas Christou owned a group of Denver nightclubs that promoted their events through MySpace pages with large lists of "friends." Bradley Roulier, his longtime talent buyer, co-founded the online music store Beatport and opened a competing club, and the clubs alleged that he took the MySpace login information and friends lists and used the clubs' MySpace pages to promote Beatport. In Christou v. Beatport, LLC, 849 F. Supp. 2d 1055 (D. Colo. 2012), the court held that the trade secret claim survived a motion to dismiss. The friends lists were more than names: they gave access to people who had chosen to receive the clubs' promotions, they were protected by passwords, and the plaintiff had alleged the effort that went into building them.

Christou is the most plaintiff-friendly statement that a social media audience can be a trade secret. Its reasoning depends on the list and the access being controlled. Where anyone can see the follower list, the trade secret theory weakens sharply, and courts have been reluctant to treat contacts that are freely visible on LinkedIn or other public sources as secret.

Eagle v. Morgan: winning and getting nothing

Linda Eagle co-founded Edcomm, a banking-education company, and built a LinkedIn profile under her own name that she used for Edcomm business. Edcomm employees helped maintain it and knew the password. After Edcomm was acquired and Eagle was terminated in 2011, company staff changed the password, and for a few weeks the profile displayed the new chief executive's name and photograph. Visitors searching for Linda Eagle found someone else.

Eagle sued in the Eastern District of Pennsylvania under the CFAA and the Lanham Act, plus state claims. The federal claims failed before trial: her claimed harm was lost business, not the kind of investigation and restoration costs the CFAA counts as "loss," and the Lanham Act claim did not hold up. After a bench trial on the state claims, in Eagle v. Morgan, No. 11-4303, 2013 WL 943350 (E.D. Pa. Mar. 12, 2013), the court found Edcomm liable for unauthorized use of her name under Pennsylvania's statute, 42 Pa. C.S. § 8316, and for misappropriation of identity and publicity, but awarded no compensatory damages because she could not prove them with reasonable certainty, and no punitive damages. Her conversion claim failed, and Edcomm's own claims to the account did not succeed either.

Eagle teaches two things. A personal profile carrying an individual's name is hard for a company to claim, even when the company helped maintain it. And a plaintiff who cannot show concrete, provable loss may win on liability and recover nothing, which is why the evidence of harm has to be built from the first day.

Mattocks v. BET: you cannot own a "like"

Stacey Mattocks created an unofficial Facebook fan page for the BET television show The Game and grew it to millions of likes. BET later reached an agreement with her under which both had administrative access to the page. When negotiations over a further deal broke down, Mattocks restricted BET's administrative access, contrary to the agreement, and BET asked Facebook to migrate the page's fans to BET's official page, which Facebook did. Mattocks sued for conversion, tortious interference, and breach of contract. In Mattocks v. Black Entertainment Television LLC, 43 F. Supp. 3d 1311 (S.D. Fla. 2014), the court granted summary judgment to BET. Among other things, it held that Mattocks could not show a property interest in the likes: a like is a user's expression of approval that the user can withdraw at any time, so if anyone owns a like, it is the user who clicked it. Her contract-based claims failed in part because she had breached the agreement first by cutting off BET's access.

Mattocks is the strongest authority against the idea that followers are property. It also illustrates a recurring move: the party with a trademark or a relationship with the platform can ask the platform to act, and the platform's decision is very hard to challenge.

In re CTLI: the bankruptcy court treats the account as an asset

CTLI, LLC operated a gun store and range in the Houston area as "Tactical Firearms." Its principal, Jeremy Alcede, ran the business's Facebook page and Twitter account. CTLI filed for Chapter 11, a confirmed plan gave control of the reorganized business to a new owner, and Alcede claimed the accounts were his personal property and kept control of them. In In re CTLI, LLC, 528 B.R. 359 (Bankr. S.D. Tex. 2015), the bankruptcy court held that the accounts were property of the estate under 11 U.S.C. § 541, likening business social media followers to subscriber and customer lists, which courts have long treated as property. Because the Facebook page was created in the name of the business, was linked to the business's web page, and was used for business purposes, and the Twitter account was named after the business, the fact that Alcede had also posted personal and political content did not make them his. The court ordered him to turn over control, allowing him to change the Twitter password first because he used it for other accounts. The court also observed that an individual's personal profile would likely not become estate property, while an official page of a public figure managed by employees might be treated differently.

In re CTLI is the clearest judicial statement that a business account is an asset of the business, at least as between the business and its insider. It also shows that bankruptcy is an unusually favorable forum for the business: the estate-property definition is broad, and, as a general matter, an act to obtain possession of or exercise control over estate property can violate the automatic stay, 11 U.S.C. § 362(a)(3).

JLM Couture v. Gutman: back to first principles of property

Hayley Paige Gutman designed wedding gowns for JLM Couture under an employment agreement that licensed JLM the use of her name in trade and made her bridal "designs, drawings, notes, patterns, sketches, prototypes, samples, improvements to existing works, and any other works conceived of or developed" in connection with her employment JLM's property as works for hire. She had opened the Instagram account @misshayleypaige, which grew to more than a million followers and mixed bridal-collection promotion with personal posts. After the relationship collapsed, JLM sued and won a preliminary injunction that, among other things, gave it control of the Instagram account and a Pinterest account.

The case went to the Second Circuit twice. In the first appeal, JLM Couture, Inc. v. Gutman, 24 F.4th 785 (2d Cir. 2022), the court vacated the account-control provision because the district court had not found that JLM was likely to succeed on its conversion or trespass claims, or tied the relief to the contract claim. On remand, the district court adopted a six-factor test drawn from In re CTLI and a Kentucky federal decision: whether the handle reflects the business name, how the account describes itself, whether the business promoted it, whether it links to the business's other platforms, the purposes for which it was used, and whether employees had access and helped manage it. Applying those factors, it gave JLM exclusive control, and expressly declined to consider who owned the account when it was created.

The second appeal, JLM Couture, Inc. v. Gutman, 91 F.4th 91 (2d Cir. 2024), vacated that ruling. The court held that the novelty of social media did not warrant a new test: under New York law, the accounts "should be treated in the first instance like any other form of property," which means starting with the original owner. If Gutman created the accounts using her personal information and for her personal use, the rights were hers at creation, and the question becomes whether the contract later transferred them. The court added that letting others help manage an account, or holding the account out as a business's, should not ordinarily decide ownership, and that rights in posted content are separate from rights in the account itself. It also held that the contract's "any other works" clause, read alongside the specific design items listed before it, did not plausibly sweep in the social media accounts. The court noted that ownership may depend in part on the platform's terms of service, citing Eagle's discussion of LinkedIn's user agreement, and that a business might have a superior right of possession even if it is not the owner, if it can identify the source of that right. The court separately vacated the district court's handling of a five-year noncompete for failure to assess its reasonableness.

JLM Couture is the most important appellate decision on the topic so far, and it changes how disputes should be argued, at least in New York. Evidence of branding and use still matters, but mainly to show what was intended at creation or what a contract transferred. The drafting lesson is sharp: a company that wants an employee's account must say so in writing, by naming social media accounts specifically, before the dispute starts. A general assignment of "works" or "work product" may carry the posts but not the account.

Maremont v. Susan Fredman Design Group: the employer that posted for the employee

In Maremont v. Susan Fredman Design Group, Ltd., No. 10 C 7811 (N.D. Ill. Dec. 7, 2011), a design firm's marketing director built a large personal Twitter and Facebook following that she used to promote the firm. While she was hospitalized after a car accident, firm staff accessed her personal accounts and posted promotions. She sued under the Lanham Act for false endorsement, the Stored Communications Act, and state publicity and privacy law. On cross-motions for summary judgment, the court held that her false-endorsement claim (which turned on whether followers would think she endorsed the firm's posts, and on whether she could show injury) presented fact questions for trial, while granting the firm summary judgment on her intrusion-upon-seclusion claim. The case is the mirror image of PhoneDog: here the employee claimed the account was hers and the employer had used her identity without consent. It is a reminder that companies should not post through an employee's personal account without written authority.

Case Account Who won what Lesson
PhoneDog (N.D. Cal. 2011) Twitter, employee handle with company name Claims survived dismissal; settled Follower lists can be pleaded as trade secrets
Ardis Health (S.D.N.Y. 2011) Company websites and social accounts Injunction ordering credentials returned Clear contract plus lockout equals fast relief
Christou (D. Colo. 2012) MySpace pages and friends Trade secret claim survived Controlled-access audience can be a trade secret
Eagle (E.D. Pa. 2013) LinkedIn, founder's personal profile Liability on state claims, zero damages Prove damages; personal profiles favor the person
Mattocks (S.D. Fla. 2014) Facebook fan page Summary judgment for brand owner No property interest in likes
In re CTLI (Bankr. S.D. Tex. 2015) Business Facebook and Twitter Estate owns accounts; turnover ordered Business accounts are business assets
JLM Couture (2d Cir. 2024) Designer's Instagram and Pinterest Account-control injunction vacated again Start with ownership at creation; contract must name the accounts

Two ways courts decide ownership

After JLM Couture, there are two competing methods, and the choice between them can decide the case.

The multi-factor approach. In re CTLI and International Brotherhood of Teamsters, Local 651 v. Philbeck, 464 F. Supp. 3d 863 (E.D. Ky. 2020), looked at how the account was held out and used: whether the handle reflects the business name, how the account describes itself, whether the business promoted and linked to it, what it was used for, and whether employees managed it. This approach favors the business whenever an account has been used as a marketing channel, whoever opened it.

The property-first approach. JLM Couture, applying New York law, asks who owned the account at creation (first possession), then whether a contract or other transfer moved ownership, and treats later management and public presentation as ordinarily irrelevant to title. This approach favors the person who opened the account with their own credentials, unless a contract clearly covers it, and it separates the account from the content posted on it.

Outside New York and the bankruptcy context, courts have not settled on either approach, and state law governs. Either way, the evidence to gather is the same:

  1. Agreements and policies. Is there an employment agreement, social media policy, contractor agreement, or platform-level designation (for example, a company-owned business portfolio) that addresses social media accounts specifically, by name or by clear category?
  2. Creation. Who opened the account, when, with what personal information, and for what stated purpose? Was it before or after the relationship began? Under JLM Couture, this is the first question.
  3. Platform terms. What did the platform's terms say about who holds the account, and whether it can be transferred? LinkedIn's user agreement mattered in Eagle, and the Second Circuit flagged the terms of service as relevant to what "ownership" even means.
  4. Name and branding. Does the handle or display name use the business's mark, the individual's name, or both? @PhoneDog_Noah used both, which is why it was litigated. JLM Couture cautions that a personal name in the handle does not by itself show a business purpose.
  5. Registration details and money. Is the login email a company address or a personal one? Whose phone receives two-factor codes? Who paid for advertising, verification, tools, and content?
  6. Purpose, use, and presentation. Was the account used to sell the business's products and linked from its website? These facts drive the multi-factor approach and can show intent at creation under the property-first approach.
  7. Control in practice. Who had the password, who approved posts, and did others in the business have access? Relevant to possession and to trade secret "reasonable measures," even where it does not decide title.

A company that loses on creation and registration can still win under the multi-factor approach, as the business did in In re CTLI, and can still win under the property-first approach if a contract transferred the account. An individual whose name is the handle can still lose if a contract assigned the account. Gather the evidence on every factor before sending the first letter, and brief both approaches unless controlling law has chosen one.

For the parallel question of who owns a brand name when founders, bands, or licensees split, see Who Owns the Brand: Trademark Ownership Disputes Between Co-Founders, Bands, Licensees, and Distributors. The same evidence (who used the name, who controlled quality, what the agreements said) often decides both the trademark and the account.

The lockout statutes: computer access, stored communications, and trade secrets

When a former employee or agency keeps the password, the instinct is to call it hacking. Sometimes it is. More often it is a contract dispute that the federal computer-crime statutes do not reach, and pleading them anyway invites an early motion to dismiss that hands the other side momentum.

The Computer Fraud and Abuse Act after Van Buren

The CFAA, 18 U.S.C. § 1030, punishes intentionally accessing a computer "without authorization" or in a way that "exceeds authorized access," and § 1030(g) gives a civil action to anyone who suffers damage or loss, if the conduct involves one of the factors in § 1030(c)(4)(A)(i). In account disputes the only realistic factor is "loss" of at least $5,000 in a one-year period. "Loss" is defined in § 1030(e)(11) as the reasonable cost of responding to the offense, assessing damage, and restoring data or systems, plus revenue lost or costs incurred because of an interruption of service. Lost customers and lost goodwill, without more, do not count, which is why Linda Eagle's CFAA claim failed. The civil action must be brought within two years.

In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court held that a person "exceeds authorized access" when they enter parts of a system (files, folders, databases) that are off-limits to them, not when they misuse information they are entitled to see. The Court described the inquiry as one of whether a gate is up or down. That framing matters in three common account scenarios:

  • The employee who still knows the password after termination. Authority to use the account came from the employer. Once the employment ends and the employer revokes permission, continued access is plausibly "without authorization." The Ninth Circuit's decision in Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), held that continuing to access a system after the owner sent a cease-and-desist letter revoking permission was access without authorization. A written revocation is therefore worth sending before anyone files.
  • The employee who changes the password while still employed. Access itself was authorized; what was done with it was not. After Van Buren, that looks more like a breach of duty than a CFAA violation, although the Court expressly left open whether the relevant limits must be technological or may be contractual.
  • The stranger who takes over the account by phishing or SIM swapping. This is the core CFAA case, and it is also a federal crime the FBI and local agencies investigate.

There is a further wrinkle: the "computer" accessed is the platform's server, not the company's. Courts have generally allowed a person whose account was accessed to sue under § 1030(g) if they suffered qualifying loss, but the company's authority to grant or revoke permission comes from its relationship with the platform, and the platform's terms may say the account belongs to the individual who registered it. For public pages, hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), adds that viewing data the owner has made public is not access "without authorization" at all. Scraping a company's public follower list is not a CFAA problem; logging into its account may be. The broader framework is in Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims.

The Stored Communications Act

The SCA, 18 U.S.C. § 2701, prohibits intentionally accessing without authorization a facility through which an electronic communication service is provided, and thereby obtaining, altering, or preventing authorized access to a communication in electronic storage. Section 2707 gives a civil action with actual damages and profits, a statutory floor of $1,000, punitive damages for willful violations, and attorney's fees, with a two-year limitations period. Courts disagree about whether a plaintiff must prove actual damages to recover the $1,000 minimum; the Fourth Circuit in Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199 (4th Cir. 2009), required actual damages for statutory damages but allowed punitive damages and fees without them.

The SCA fits account disputes in two ways. A person who logs into someone else's account and reads private messages has "obtained" stored communications. And a person who changes the password and locks the owner out has arguably "prevented authorized access" to the owner's messages. The defense is usually authorization. Section 2701(c)(2) exempts conduct authorized "by a user of that service with respect to a communication of or intended for that user," and courts read it carefully. In Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002), an airline executive viewed a pilot's restricted website using credentials borrowed from pilots who were eligible but had never used the site, and the Ninth Circuit held that the exception did not apply because those pilots were not "users." In Ehling v. Monmouth-Ocean Hospital Service Corp., 961 F. Supp. 2d 659 (D.N.J. 2013), by contrast, a nurse's privacy-restricted Facebook posts were covered by the SCA, but the exception applied because a coworker who was her Facebook friend showed them to management voluntarily.

For a company recovering its account, the SCA matters mostly on defense: the company should not read a departed employee's personal direct messages inside a shared or disputed account, and should not log into an employee's personal account even when it knows the password. The jury verdict for restaurant employees in Pietrylo v. Hillstone Restaurant Group, No. 06-5754 (D.N.J. 2009), where managers used a coerced password to read a private MySpace group, is the standard cautionary tale.

State computer-crime statutes

Most states have their own computer-access laws, and some are broader than the CFAA. California's Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502, covers knowingly accessing and without permission using or altering data, and provides a civil action with attorney's fees under § 502(e). Where the facts are a lockout by a California employee, § 502 is often the stronger statutory claim. Read each state's definitions of "without permission" carefully; some courts read them in the same gates-up-or-down terms as Van Buren.

Trade secret theories

The Defend Trade Secrets Act, 18 U.S.C. § 1836, gives a federal civil action for misappropriation of a trade secret, defined in § 1839(3) as information that derives independent economic value from not being generally known and is subject to reasonable measures to keep it secret. Applied to accounts, the candidates are the credentials (the password itself), non-public follower or subscriber data (direct-message histories, analytics, contact exports, private group membership), and drafts or scheduled posts. The public follower count and visible follower list are weak candidates, because anyone can see them. Christou and PhoneDog show the theory surviving the pleadings; the later cases show it struggling on the merits where the list is public.

Two features of the DTSA matter in practice. Injunctive relief under § 1836(b)(3)(A) may not prevent a person from entering an employment relationship, and conditions on employment must rest on evidence of threatened misappropriation, not merely on what the person knows. And the reasonable-measures requirement means a company that let four people share one password on a sticky note may have no trade secret to protect. For the full litigation picture, see Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide, and for the departure process that prevents these disputes, the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Contract, conversion, and the remedies that actually work

The claims that most often produce relief are the plain ones: breach of an employment or contractor agreement that assigns the account, breach of a duty to return company property, conversion (where state law recognizes conversion of intangible or electronic property), and breach of fiduciary duty or the duty of loyalty for an employee who diverted the account while still employed. The remedy that matters is an injunction ordering the credentials returned, under Fed. R. Civ. P. 65 and the four-factor test of Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008): likely success, likely irreparable harm, a favorable balance of equities, and the public interest. Ardis Health shows what a winning record looks like. JLM Couture shows what happens when the likelihood-of-success analysis skips the ownership question.

The employee's side: password-privacy laws and the NLRA

Employers who want to claim accounts must not overreach into employees' personal accounts. Two bodies of law police the line.

State social media password-privacy laws. More than twenty states, beginning with Maryland in 2012, restrict employers from requiring or requesting access to employees' and applicants' personal social media accounts. California's version, Cal. Lab. Code § 980, is typical: an employer may not require or request an employee or applicant to disclose a username or password for personal social media, to access personal social media in the employer's presence, or to divulge personal social media, except that an employer may request personal social media reasonably believed to be relevant to an investigation of employee misconduct, used solely for that investigation. The statute also says it does not prevent an employer from requiring an employee to disclose credentials for an employer-issued electronic device. Illinois's Right to Privacy in the Workplace Act, 820 ILCS 55/10, contains a similar prohibition alongside an express carve-out for accounts used for the employer's business. The common structure of these laws is that the employer may control accounts it provides or that are used for its business, and may not demand access to accounts that are personal. That is exactly why a written designation of which accounts are business accounts matters: it puts the company on the right side of these statutes before a dispute.

The National Labor Relations Act. Section 7 of the NLRA, 29 U.S.C. § 157, protects employees' concerted activity for mutual aid or protection, including on social media, and § 158(a)(1) makes it an unfair labor practice to interfere with that right. In NLRB v. Pier Sixty, LLC, 855 F.3d 115 (2d Cir. 2017), the Second Circuit upheld the Board's finding that a catering server's profane Facebook post about a manager, made days before a union election, was protected, and his firing unlawful. Social media policies that broadly forbid employees from criticizing the company online, or from mentioning their employer at all, are vulnerable. The Board's standard for evaluating work rules has shifted several times (most recently in Stericycle, Inc., 372 NLRB No. 113 (2023)); policies should be drafted to the current standard and checked when the Board changes course. An account-ownership policy is generally lawful; a policy that uses account ownership as a pretext to control what employees say on their own accounts is not. Background on what employers may and may not do is in Union Organizing and the NLRA: What Employers May and May Not Do, and the monitoring rules are in Employee Monitoring and Workplace Privacy: A Practical Guide.

Agencies, contractors, and influencers

The agency that holds the keys

Many small businesses outsource social media to an agency or freelancer, who opens the accounts, connects them to the agency's ad manager, and holds the only admin credentials. When an invoice goes unpaid or the relationship ends, the agency has leverage, and some use it. Four legal points shape these disputes:

  1. Agency law. A contractor who opens an account for a client, in the client's name, is ordinarily acting as the client's agent, and an agent must account for and return the principal's property at the end of the relationship. Holding the account as security for an unpaid invoice is risky for the agency unless the contract allows it.
  2. Copyright. Content an employee creates within the scope of employment is a work made for hire owned by the employer, 17 U.S.C. § 101 and § 201(b). Content an independent contractor creates is owned by the contractor unless there is a written assignment, because most social media content does not fall within the nine statutory categories of commissioned works that can be works made for hire by written agreement. A client that ends an agency relationship without an assignment may own the account but not the photos and videos in it.
  3. Platform architecture. If the agency created the client's page inside the agency's own business portfolio, the platform may treat the agency as the owner. Fixing that is a platform process, not a lawsuit, and it requires the agency's cooperation or proof of the client's rights.
  4. Contract. A clause that says the client owns the accounts, the handles, the content, and the ad accounts, that admin access will be held in the client's own business portfolio, and that credentials will be handed over on demand, regardless of any payment dispute, resolves nearly every case. The toolkit includes one.

Contractor status cuts both ways. A freelancer who is misclassified may be an employee for some purposes, which can help the client on work-made-for-hire analysis and hurt it on wage law; see Independent Contractor or Employee? Worker Classification Under the FLSA, the IRS Test, and State ABC Laws.

Influencers and brand accounts

Influencer arrangements raise the ownership question in reverse. A brand may hire a creator to run a brand account, or may build a campaign on the creator's own account, or may create a persona account that the creator fronts. Three points matter. First, the agreement should say who owns any account created for the campaign and what happens to it at the end, and should not claim the creator's personal account. Second, the FTC's Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 C.F.R. part 255, revised in 2023, require clear disclosure of material connections between brands and endorsers, and both the brand and the creator can be responsible for a missing disclosure; the FTC enforces them through 15 U.S.C. § 45. Third, the FTC's 2024 rule on consumer reviews and testimonials, 16 C.F.R. part 465, prohibits buying or selling fake indicators of social media influence, such as bot followers or fake views, where the buyer knew or should have known they were fake and used them to misrepresent influence for a commercial purpose. A brand that inflates an account's follower count to make it more valuable, or to win an ownership dispute about value, takes a regulatory risk. Contract terms are covered in Sponsorship, Endorsement, and Influencer Agreements: A Practical Guide.

Founders and personal brands

A founder's personal account that is also the company's loudest marketing channel is the hardest category. The Eagle and JLM Couture facts both involved individuals whose names were the brand. For a founder, the practical choices are to keep the personal account personal (and run a separate official company account), or to assign a specific account to the company in writing, with a license back to use the founder's name. The right-of-publicity dimension, including who controls a person's name after they leave the company, is covered in Licensing and Protecting Name, Image, and Likeness: A Practical Guide and Trademarking Your Own Name.

Username squatting: why handles are not domain names

When someone registers @fernhillcoffee to sell it back, the comparison to cybersquatting is irresistible. The law does not follow it.

The ACPA does not reach handles. The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), gives a trademark owner a claim against a person who, with a bad faith intent to profit, registers, traffics in, or uses a "domain name" that is identical or confusingly similar to a distinctive mark. Section 1127 defines "domain name" as an alphanumeric designation registered with or assigned by a domain name registrar, registry, or other domain name registration authority as part of an electronic address on the Internet. A username is assigned by a platform, not by a domain name registration authority, and it is not part of the Internet's domain name system. We are not aware of any reported appellate decision applying the ACPA to a social media username, and the statutory text makes the argument a long shot. The strong ACPA doctrine developed in cases like Sporty's Farm L.L.C. v. Sportsman's Market, Inc., 202 F.3d 489 (2d Cir. 2000), therefore does not help. For domain names themselves, see Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP and, when a domain has been stolen rather than squatted, Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back.

Ordinary trademark law reaches only some squatters. Infringement of a registered mark under 15 U.S.C. § 1114, and unfair competition under § 1125(a), require use of the mark in commerce in connection with goods or services, in a way likely to cause confusion. A dormant account that merely holds the handle, with no posts and no commercial activity, is a weak infringement target. An account that uses the handle to sell competing goods, to divert customers, or to post in the brand's voice is a much stronger one, and remedies include injunctions under § 1116 and damages and profits under § 1117. Offering to sell the handle back is evidence of bad faith but does not, by itself, make out infringement.

Platform policies do most of the work. Major platforms prohibit username squatting, the sale of usernames, and accounts that use another's trademark in a way that misleads. Most have a trademark reporting channel that will reassign or release a handle that infringes a registered mark, and some have inactive-account policies that may free a dormant handle. A federal registration under 15 U.S.C. § 1051, or a registration in the relevant foreign country, makes these reports far more effective, because the platform's reviewers can check a registration number in seconds and will not adjudicate common-law rights. Platforms generally will not take a handle from someone who has a legitimate claim to the same word (a person named Fernhill, or a Fernhill bakery in another country), and they will not resolve disputes between two trademark owners. The Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands has notice templates that adapt well to handle complaints.

Parody and commentary accounts are a separate category. An account that uses a brand's name to criticize or parody it raises speech questions. After Jack Daniel's Properties, Inc. v. VIP Products LLC, 599 U.S. 140 (2023), the heightened Rogers test does not apply when a defendant uses a mark as a designation of source for its own goods, but most parody accounts are not selling anything, and the core question is whether reasonable viewers would be confused about who is speaking. A clearly labeled parody account usually survives both a platform report and a lawsuit. The platform policies themselves typically require parody, commentary, and fan accounts to say so in the name and bio.

Prevention beats every remedy. Register the brand's handle on every major platform at launch, including platforms the brand does not plan to use yet, and when planning a rebrand, secure the new handles before the announcement. See Rebranding Without Regret: Clearance, Transition, and Protecting the Old Mark While Launching the New One.

Impersonation: brand fakes, personal fakes, and scams

Impersonation is the fastest-growing category of account dispute, and the most dangerous for third parties, because fake brand accounts are a standard tool for phishing, fake giveaways, investment fraud, and fake customer support. The bought verification badge, available on several platforms for a monthly fee, has made the fakes more convincing.

Platform remedies first

Every major platform prohibits impersonation, and every one has a reporting form for it, separate from its trademark form. Impersonation reports are usually faster, require proof of identity (a government ID for a person, or business documents and an authorized representative for a company), and do not require a trademark registration. Trademark reports are the better tool when the account is not pretending to be the brand but is using its mark in a confusing way. Many businesses file both. The platform's decision is discretionary, and the best predictor of success is a clean, complete report: the impersonating URL, the authentic account's URL, the specific elements copied (name, logo, photos, bio text), and evidence of harm such as messages sent to customers.

Federal law

  • Lanham Act false association and false endorsement. Section 43(a)(1)(A), 15 U.S.C. § 1125(a), reaches false or misleading representations likely to cause confusion as to affiliation, connection, association, sponsorship, or approval. It protects businesses and, in most circuits, individuals whose identities have commercial value. Standing follows Lexmark International, Inc. v. Static Control Components, Inc., 572 U.S. 118 (2014): an injury to a commercial interest in reputation or sales, proximately caused by the deception. A private individual with no commercial persona may lack Lanham standing and should rely on state law.
  • Criminal statutes. Impersonation used to defraud can be wire fraud, 18 U.S.C. § 1343, or identity fraud, 18 U.S.C. § 1028. Impersonation used to harass may implicate the federal cyberstalking statute, 18 U.S.C. § 2261A, and threats sent through a fake account may implicate 18 U.S.C. § 875, subject to the subjective-recklessness standard for true threats in Counterman v. Colorado, 600 U.S. 66 (2023).
  • The FTC Impersonation Rule. The FTC's Rule on Impersonation of Government and Businesses, 16 C.F.R. part 461, effective in 2024, prohibits materially misrepresenting, directly or by implication, that one is or is affiliated with a government entity or a business in connection with commerce. It gives the FTC civil-penalty and redress authority against scammers, though no private right of action. A business whose customers are being targeted should report the scheme to the FTC as well as to the platform.

State law

  • Online impersonation statutes. Cal. Penal Code § 528.5 makes it a misdemeanor to knowingly and without consent credibly impersonate another actual person through an internet website or other electronic means for purposes of harming, intimidating, threatening, or defrauding another person, and gives the victim a civil action for compensatory damages and injunctive relief. Texas's online impersonation statute, Tex. Penal Code § 33.07, makes it a felony to use another person's name or persona to create a web page or social media account, or post messages on a social networking site, without consent and with intent to harm, defraud, intimidate, or threaten; Texas appellate courts have rejected facial First Amendment challenges to the main subsection, as in Ex parte Bradshaw, 501 S.W.3d 665 (Tex. App. 2016). New York prosecutes online impersonation as criminal impersonation in the second degree, N.Y. Penal Law § 190.25, which covers impersonating another by communication through an internet website or electronic means with intent to obtain a benefit or to injure or defraud. Many other states have similar laws; check the elements, because some protect only natural persons and not businesses.
  • Right of publicity. For impersonation of a person, the right of publicity is often the strongest civil claim. California's statute, Cal. Civ. Code § 3344, provides statutory damages, profits, and attorney's fees for the knowing use of a person's name, photograph, or likeness for advertising or selling without consent; New York's, N.Y. Civ. Rights Law § 51, provides injunctive relief and damages for use of a living person's name, portrait, or picture for advertising or trade without written consent. Fake accounts that sell products or solicit money using a person's photos fit well; fake accounts that merely mock do not. See Right of Publicity Basics and, for AI-generated likenesses, Name, Image, Likeness, and Digital Replicas: The ELVIS Act, the NO FAKES Act, and Deepfake Law.
  • Defamation and false light. A fake account that attributes false statements to the victim can be defamatory, and the anonymous operator can be identified through the Doe process in Identifying an Anonymous Defendant Online: A Practical Guide.

Why the platform is usually not liable

Victims of impersonation often want to sue the platform that hosted the fake. Section 230(c)(1) of the Communications Decency Act, 47 U.S.C. § 230, bars treating a provider of an interactive computer service as the publisher or speaker of information provided by another, and courts apply it to impersonation. In Carafano v. Metrosplash.com, Inc., 339 F.3d 1119 (9th Cir. 2003), an anonymous user created a fake dating profile of an actress that led to threats against her, and the Ninth Circuit held the service immune. In Herrick v. Grindr LLC, 765 F. App'x 586 (2d Cir. 2019), a man whose former partner created impersonating profiles that sent strangers to his home could not sue the app on product-liability theories, because the claims treated the app as the publisher of the impersonator's content. The exceptions are narrow. Section 230 does not apply to federal intellectual property claims, and a platform that makes a specific promise to remove content may be liable on that promise, Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009). The framework is in Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops.

When the platform is the adversary: suspensions and terminations

Sometimes the dispute is not with an ex-employee but with the platform itself, which has suspended the account, removed the verification badge, or handed the handle to someone else. Account holders sue under breach of contract, the implied covenant, promissory estoppel, consumer-protection statutes, the First Amendment, and civil rights laws. They almost always lose.

The practical remedy for a wrongful suspension is internal: the platform's appeal process, its business or advertiser support channel (which is often faster for accounts that spend money on ads), a verified business program that comes with human support, and, in the European Union, the complaint and out-of-court dispute settlement rights created by the Digital Services Act. A demand letter to the platform's legal department can help when the suspension was triggered by a false report from a competitor or former employee, particularly if it is accompanied by evidence of the false report and an offer to verify identity.

Death, divorce, bankruptcy, and public office

Bankruptcy. In re CTLI treats a business's accounts as estate property under 11 U.S.C. § 541, and an insider who seizes them may violate the automatic stay, § 362. Trustees and buyers of distressed businesses should list social media accounts as assets, obtain credentials at closing, and confirm with each platform that the transfer is permitted. See Intellectual Property Licenses in Bankruptcy: Section 365(n), Mission Product, and Protecting Your License for the related treatment of licenses.

Death. Most states have adopted the Revised Uniform Fiduciary Access to Digital Assets Act, which sets a priority order for a fiduciary's access: the user's directions through an online tool (such as a legacy contact setting) come first, then directions in a will or other record, then the platform's terms. California's version begins at Cal. Prob. Code § 871. The Stored Communications Act does not stand in the way: in Ajemian v. Yahoo!, Inc., 478 Mass. 169 (2017), the Massachusetts Supreme Judicial Court held that a personal representative may provide lawful consent to disclosure of a decedent's email contents under 18 U.S.C. § 2702, although the provider is not compelled to disclose by the SCA itself. For a founder whose personal account is a business asset, the estate plan should say who gets it. See Digital Assets in Estate Planning: RUFADAA, Cryptocurrency, and Online Accounts and, for a deceased person's name and likeness, The Post-Mortem Right of Publicity: Who Controls a Deceased Person's Name, Image, and Voice.

Divorce and partnership breakups. A monetized account built during a marriage or a partnership is an asset to be valued and divided like any other, and the property-first approach of JLM Couture will likely influence how courts characterize it. Partnership and operating agreements should address accounts expressly.

Public officials. An official who runs a personal account that also discusses government business faces a different question: whether blocking critics is state action. In Lindke v. Freed, 601 U.S. 187 (2024), the Supreme Court held that an official's social media speech is state action only if the official possessed actual authority to speak on the government's behalf on the matter and purported to exercise it in the relevant posts. Governments should run official accounts in the government's name, with government credentials, and keep officials' personal accounts personal, which also settles who keeps the account when the official leaves office.

Splits and open questions

  • Which ownership test? Multi-factor (In re CTLI, Philbeck) or property-first (JLM Couture). Expect the answer to vary by state.
  • Are followers property? In re CTLI treats business followers like a customer list; Mattocks held there is no property interest in likes; Eagle rejected conversion of a LinkedIn account under Pennsylvania law; JLM Couture applied New York's recognition of conversion of electronic property. The answer depends heavily on state conversion law.
  • Are follower lists trade secrets? Sometimes, if access is controlled and the list contains non-public information (Christou). Rarely, if anyone can see it.
  • Does the CFAA cover the ex-employee with a still-working password? Probably, after written revocation (Power Ventures); less clearly without one; and Van Buren left open whether contractual limits can define authorization.
  • What "ownership" even means. If the platform's terms say accounts cannot be transferred, a court can allocate control between the parties but cannot make an account transferable. JLM Couture invited trial courts to consider what rights ownership includes.
  • Valuation. PhoneDog's $2.50 per follower per month was a pleading number. Courts have not adopted a method, and Eagle shows that uncertain damages may mean no damages.

Practical implications for each side

For businesses. Create accounts in the company's name using company-domain email addresses and company-controlled phone numbers or authenticator apps. Hold them in a company-owned business portfolio or brand account with at least two employee administrators and no single point of failure. Adopt a written policy that lists the official accounts, says they belong to the company, and says personal accounts belong to employees, consistent with password-privacy statutes. Put an account clause in every employment, contractor, agency, and influencer agreement that names social media accounts specifically and assigns content in writing. Register the main marks. Claim handles everywhere. Collect credentials at every departure, and rotate passwords and remove access the same day.

For employees and creators. Keep personal accounts personal: personal email, personal phone, personal content. If you are asked to promote the employer on a personal account, get in writing that the account remains yours. If you open an account for the employer, expect to hand it over, and do not rename it on the way out. Before taking an account with you, read your agreements and remember Ardis Health: a clear clause plus a lockout produces an injunction quickly.

For agencies. Build client accounts inside the client's business portfolio and add yourself as a partner or admin, rather than the reverse. Do not hold accounts hostage over invoices; sue on the invoice. Keep a contractual right to remove your own name and credentials at the end.

For anyone impersonated. Capture the evidence, report under both the impersonation and trademark policies, warn your audience from the authentic account, and escalate to a letter or lawsuit only when the platform fails and the harm is real. Report fraud to the FTC and, where money is lost, to law enforcement.

For the employment-agreement side, see Employee Invention Assignment Agreements: Drafting for Enforceability Across Jurisdictions; the same drafting principles apply to account clauses.

Extended worked example: Fernhill Coffee Roasters

Return to Fernhill, with three problems and one weekend.

The account Dana took. Fernhill's lawyer starts with the facts that matter under both ownership approaches. Dana opened the account in 2017, two weeks after she was hired, from her own phone, with her personal Gmail address, under the handle @fernhillcoffee and the display name "Fernhill Coffee Roasters." The first post announced the café's opening. The company paid for every ad, linked the account from its website and coffee bags, and gave two other employees the password. Dana's 2017 offer letter says nothing about social media, but the employee handbook she signed in 2019 lists "@fernhillcoffee on Instagram" among company accounts and says they are company property. Dana's dog appears in about one post in thirty.

Under the multi-factor approach, Fernhill's case is strong: business name, business purpose, business promotion, shared management. Under the property-first approach of JLM Couture, the question is who owned the account at creation. Dana used her personal information, which helps her, but she created the account in the company's name, for the company's opening, two weeks into a job that included marketing, which looks like an agent creating an asset for her principal. And the 2019 handbook acknowledgment is a writing that names the account. Fernhill's position is good under either test, and the lawyer decides to brief both.

The lawyer sends Dana a letter on Monday afternoon. It identifies the account by its numeric ID as well as its old and new handles, states that Fernhill owns it, quotes the handbook, revokes any authority Dana had to access it (setting up the Power Ventures argument if she keeps logging in), demands that she restore the handle and display name, transfer the login email and two-factor method to Fernhill, and refrain from deleting content or followers, and sets a 48-hour deadline. It asks her to keep her personal photos if she wants them and offers to let her download them first. It does not threaten criminal charges, and it does not claim her separate personal account, which she has had since 2012.

Fernhill does not log into the account itself, although the old password still appears in a shared document; Dana changed it on Friday anyway. It does not read her direct messages. And it collects evidence of harm from the first day: lost web traffic from Instagram, customer emails asking whether the company has closed, and the time staff spend answering them.

Dana's lawyer responds that the account was always Dana's personal brand. After a call, the parties agree that Dana will return the account with all content intact, Fernhill will pay her a modest sum for her time and release any claims about posts made during her employment, Dana will keep the right to use photos of her dog, and both sides will post a short, agreed statement. If Dana had refused, Fernhill's next step was a motion for a temporary restraining order and preliminary injunction on contract and conversion claims, modeled on Ardis Health, with a declaration about lost sales and the handbook acknowledgment as the centerpiece. A CFAA claim would have been weak unless Fernhill could document at least $5,000 in response and restoration costs.

The squatter. The new @fernhillcoffee account has no posts, so a trademark infringement suit would be a poor fit, and the ACPA does not apply to usernames. But Fernhill owns a federal registration for FERNHILL for coffee, and once Dana restores the original handle, the squatter's account will be using a different string. For any remaining look-alike handles (@fernhill_coffee, @fernhillroasters), Fernhill files platform trademark reports citing the registration number. It does not pay the $15,000, both because paying rewards the business model and because buying usernames violates most platforms' terms.

The fake giveaway. This is the urgent one. Fernhill files impersonation reports and trademark reports for @fernhill.giveaway the same morning, with screenshots of the fake account, the messages sent to customers, and the authentic account's URL. It posts a warning on its authentic channels and website that it never asks for card details in messages. It reports the scheme to the FTC (citing the Impersonation Rule, 16 C.F.R. part 461) and, because two customers report losses, encourages them to report to their banks and to law enforcement. The fake account is removed in two days. Fernhill keeps its evidence file in case the operator surfaces.

Total cost: a few hours of lawyer time for the letter and negotiation, a few hours of staff time for platform reports, and a modest payment to Dana. Litigation would have taken months and cost far more, which is why Fernhill's lawyer now spends an hour fixing the onboarding documents so the next departure is uneventful.

Common mistakes

  1. Pleading the CFAA by reflex. Without qualifying "loss" and a clear lack of authorization, the claim invites a motion to dismiss and a fee fight. Lead with contract and property.
  2. Relying on a general work-product clause. After JLM Couture, a clause that assigns "works" or "designs" may not reach the account. Name social media accounts specifically.
  3. Logging into the employee's personal account. Even with a known password, this risks SCA and state-law liability, as Pietrylo and Maremont show.
  4. Letting one person hold the only credentials. It defeats trade secret "reasonable measures," creates the lockout, and makes every departure a crisis.
  5. Building accounts inside an agency's business portfolio. The platform will treat the agency as owner.
  6. Paying squatters. It rarely ends the problem and may violate platform terms.
  7. Threatening criminal prosecution to gain leverage. In many jurisdictions, threatening criminal charges to gain advantage in a civil matter raises ethics and extortion concerns.
  8. Ignoring damages evidence until trial. Eagle won liability and recovered nothing. Track traffic, sales, and response costs from the first day.
  9. Suing the platform over a suspension. Section 230 and the terms of service will almost certainly defeat it. Use the platform's appeal and business channels.
  10. Overbroad social media policies. A policy that bans criticism of the company risks NLRA liability and undermines the ownership clause it contains.

Frequently asked questions

Can a company take back an account an employee created for it? Usually, if the account was created in the company's name, for its business, and especially if a written policy or agreement names it. Without a writing, the result depends on which ownership approach the court uses and on the facts at creation.

Are followers a trade secret? A public follower list usually is not. A list with non-public data, protected by restricted access, may be, as in Christou. The credentials themselves can be confidential information protected by contract even where the list is not a trade secret.

Can I sue someone for registering my brand name as a handle? Not under the ACPA, which applies only to domain names. You may have a trademark claim if the account is used in commerce in a confusing way. The faster remedy is the platform's trademark or impersonation report, which works best with a registration.

What if the person impersonating me is anonymous? Report the account first. If the harm is serious and continuing, you can sue a Doe defendant and seek early discovery to identify the operator. Platforms generally will not identify users without legal process.

Can I make my employees give me their social media passwords? Not for personal accounts, in a large and growing number of states, and not without NLRA risk anywhere. You may require credentials for accounts the company owns or provides, and you should hold those credentials yourself.

Can I sue the platform for suspending my business account? You can file, but Section 230, the platform's terms, and arbitration clauses defeat nearly all such claims. Escalate through the platform's appeal and business support channels instead.

Who gets a business account when the business is sold? Whoever the purchase agreement says, subject to the platform's terms. List the accounts as assets, transfer credentials and admin roles at closing, and confirm with each platform that the transfer is allowed.

Key takeaways

  • An account is a bundle: a platform license, a handle, credentials, content, an audience, and goodwill. Identify which piece is in dispute.
  • Write it down. Name social media accounts specifically in policies and agreements, and assign content separately.
  • Expect courts to split between a multi-factor test and the property-first approach of JLM Couture; build the evidence for both.
  • Hold credentials in company systems, with more than one administrator, and revoke access in writing at every departure.
  • The ACPA does not cover handles. Register marks and claim handles early; use platform policies for squatters.
  • For impersonation, report to the platform under both impersonation and trademark policies, warn customers, and use Lanham Act, publicity, and state impersonation statutes when the platform is not enough.
  • Do not sue platforms over suspensions; work their internal channels.
  • Build damages evidence from the first day, or a liability win may be worth nothing.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits