Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist

Summary. This checklist turns the law of social media account ownership and impersonation into tasks a business, its counsel, and the people on the other side of a dispute can check off. It starts with the ownership foundation: an account inventory, company-controlled credentials and business portfolios, a written ownership policy that respects employee password-privacy laws and the NLRA, and account clauses in employment, agency, and influencer agreements. It then covers onboarding and offboarding, first-hour triage of any incident, and separate response phases for hacked accounts, accounts held by insiders or agencies, impersonation, squatted handles, and platform suspensions. A litigation-readiness phase covers the demand letter and the injunction record, and a defense phase covers the employee, creator, agency, or parody account on the receiving end. Red-flag boxes, a deadlines table, common failure points, and a short worked example close the checklist.

Most social media account disputes are lost before they start. The business never decided who owned the account, one person held the only password, the agency built the page inside its own business portfolio, and the employment agreement assigned "work product" without mentioning social media. When the dispute arrives, the law offers slow and uncertain remedies, and the platform, which could fix the problem in an afternoon, asks for a court order. This checklist is designed to prevent that, and to organize the response when prevention fails.

How to use this checklist

• Phases 1 and 2 are prevention. Complete them once, then review annually and at every hire, departure, agency change, acquisition, and rebrand.
• Phase 3 is triage. Run it within the first hour of any incident, whatever kind.
• Phases 4 through 8 are scenario playbooks. Pick the one (or ones) that fit: hacked account, insider or agency holding, impersonation, squatted handle, platform suspension. Run them in parallel when an incident combines scenarios, with one owner for each.
• Phase 9 is for disputes that may go to court, and Phase 10 is for the other side: the employee, creator, agency, or account holder receiving a demand or complaint.
• Phase 11 closes out every incident.

Each item names the governing authority where one applies. For the doctrine, read Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account. For the step-by-step narrative, read Recovering or Defending a Social Media Account or Handle: A Practical Guide. The policies, letters, and complaint templates referenced below are in the Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters.

Phase 1: Build the ownership foundation

Inventory

• List every account the business uses or has ever used, on every platform: handle, display name, numeric account ID, URL, creation date, purpose, and follower count. Include dormant accounts, regional accounts, product accounts, and accounts on platforms the business has stopped using.
• Record the registration details for each account: login email (company domain or personal?), phone number for two-factor codes, authenticator app or hardware key, and who holds each.
• Record the platform-level owner. For platforms with business tools, identify which business portfolio, brand account, or organization owns each page or account, and who has admin, editor, or advertiser roles. Agencies and freelancers often appear as owners; fix that now (Phase 2).
• Record the ad accounts and payment methods linked to each social account, and who controls them.
• Identify hybrid accounts: founder, executive, or creator accounts that promote the business but carry an individual's name. Decide, with the individual, whether each is personal or a company asset, and put the decision in writing. After JLM Couture, Inc. v. Gutman, 91 F.4th 91 (2d Cir. 2024), an account an individual created with personal information for personal use may remain theirs absent a clear contract.

Credentials and control

• Move every business account to a company-domain login email (a role address such as social@ rather than an individual's mailbox) and a company-controlled two-factor method.
• Hold credentials in a company password manager with access logs, not in spreadsheets, chat threads, or personal phones.
• Assign at least two administrators on every business portfolio or brand account, neither of them a contractor.
• Add a port-out lock or PIN to every company phone number used for two-factor codes, to reduce SIM swap risk. The FCC's 2023 rules in 47 C.F.R. part 52 and 47 C.F.R. part 64 direct carriers to authenticate SIM change and port-out requests, though the FCC deferred compliance in 2024 pending federal paperwork review; a customer-set PIN adds a layer the business controls.
• Document reasonable secrecy measures for non-public account data (analytics exports, direct-message histories, customer lists). These measures matter if the business later claims a trade secret under 18 U.S.C. § 1839(3), which requires reasonable measures to keep information secret.

Policy

• Adopt a written social media account policy that lists the business's official accounts (by handle and platform, updated as accounts are added), states that they and their content, followers, and data belong to the business, and requires credentials to be held in company systems.
• State that personal accounts belong to employees. The policy should not require employees to disclose personal account credentials or to friend managers. Many states prohibit those demands; for example, Cal. Lab. Code § 980 bars employers from requiring or requesting personal social media usernames and passwords, subject to limited exceptions, and Illinois's 820 ILCS 55/10 contains a similar prohibition. Check the law of every state where employees work.
• Avoid speech restrictions that chill concerted activity. Section 7 of the NLRA, 29 U.S.C. § 157, protects employees' concerted activity about working conditions, including on social media; § 158(a)(1) makes interference an unfair labor practice. In NLRB v. Pier Sixty, LLC, 855 F.3d 115 (2d Cir. 2017), a profane Facebook post about a manager was protected. Review the policy against the Board's current work-rule standard.
• Get signed acknowledgments from every employee who touches company accounts, and keep them where they can be found.

Agreements

• Employment and offer letters: add a clause that names social media accounts specifically, assigns accounts created for the business and all content created within the scope of employment, and requires return of credentials at separation. A general "work product" clause may not reach the accounts themselves.
• Contractor and agency agreements: require accounts to be created in the client's name, inside the client's business portfolio, with the client as owner; assign copyright in all deliverables in writing (an independent contractor's work is generally not a work made for hire, 17 U.S.C. § 101, so ownership requires an assignment under § 201(d)); require handover on demand regardless of any payment dispute.
• Influencer agreements: state who owns any campaign account, prohibit claims to the creator's personal account, require FTC-compliant disclosures under 16 C.F.R. part 255, and prohibit buying fake followers or engagement, which 16 C.F.R. part 465 prohibits in commercial contexts.
• Founder and partnership agreements: address which accounts belong to the company, who keeps them on a split, and a license to use a founder's name. See Brand Ownership Toolkit: Assignment Agreements, Founder IP Clauses, and Ownership Evidence Files.
• Purchase agreements and asset schedules: list social media accounts as assets in acquisitions, financings, and bankruptcy schedules. In In re CTLI, LLC, 528 B.R. 359 (Bankr. S.D. Tex. 2015), a business's Facebook page and Twitter account were property of the estate under 11 U.S.C. § 541.

Brand protection

• Register the core marks under 15 U.S.C. § 1051 and in key foreign markets. Platform trademark reports depend on registrations.
• Reserve the brand's handle on every major platform, including platforms the business does not plan to use, and on new platforms as they launch.
• Before any rebrand announcement, secure the new handles everywhere. See the Rebrand Legal Checklist: A Practical Checklist.
• Set up monitoring for look-alike handles and accounts using the brand's name and logo.
• Enroll key accounts in verification or business programs where available, both to reduce impersonation and to get access to human support.

Red flag: the single point of failure. If one person (an employee, a founder, or an agency) holds the only admin role or the only working two-factor device for an account, the business does not control that account. Fix it before that person leaves, gets locked out, or gets hacked.

Phase 2: Onboarding and offboarding

Onboarding someone who will manage accounts

• Add the person to the business portfolio with the least privilege needed; do not share the master login.
• Have them sign the account policy acknowledgment and an agreement with the account clause.
• Record any personal accounts they bring that the business wants to use, and agree in writing whether they remain personal.
• For agencies: confirm that every new account is created inside the client's portfolio, and that the agency is added as a partner, not owner.

Offboarding

• Before notice of termination where practical, confirm that the business holds admin roles and credentials for every account the person manages.
• On the last day: remove the person's roles, rotate shared passwords, change recovery emails and phone numbers they controlled, and revoke active sessions.
• Collect a written credential certification listing every account and confirming handover, and remind the person of their continuing obligations. The toolkit's handover protocol includes one.
• Do not ask for personal account credentials. Ask only for the business accounts named in the policy.
• For agencies: confirm transfer of ownership of pages, ad accounts, and pixels; collect all creative files and a copyright assignment; and pay or escrow any undisputed amount so the handover is not held hostage.
• Add social media accounts to the general departure checklist. See the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Phase 3: First-hour triage of any incident

• Classify the incident: hacked by a stranger, held by an insider or former insider, held by an agency or contractor, impersonation, squatted handle, or platform suspension. More than one may apply.
• Assign owners: one person per scenario track, one person for the evidence file, one person for customer communications, and counsel if a demand or lawsuit is possible.
• Capture evidence before reporting: profile, posts, messages to customers, handle and display-name changes, numeric account ID, platform notification emails, URLs, displayed and capture timestamps, and the capturer's name. Keep native files and hashes. Authentication runs through Fed. R. Evid. 901; see the Messaging and Social Media Evidence Checklist: A Practical Checklist.
• Do not access anyone's personal account to gather evidence. Unauthorized access to stored communications can violate 18 U.S.C. § 2701, as the employer learned in Pietrylo v. Hillstone Restaurant Group, No. 06-5754 (D.N.J. 2009).
• Issue a short litigation hold if a dispute with an identifiable person is likely. See the Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
• Start a cost log: staff hours, vendor invoices, lost ad spend. These figures support a CFAA "loss" claim under 18 U.S.C. § 1030(e)(11), an insurance claim, and damages.
• Decide the goal: control returned, look-alike removed, handle released, public correction, money, or a deterrent order.

Red flag: scams in progress. If an account (hacked or fake) is soliciting money or card details from customers, warning customers comes before everything except evidence capture. Post on every authentic channel and the website within the hour.

Phase 4: Hacked account

• Secure the recovery email account from a clean device: change the password, revoke sessions, remove unknown forwarding rules, and switch to an authenticator app or hardware key.
• Call the mobile carrier: confirm whether a SIM change or port occurred, restore the number, and add a port-out PIN.
• Check every other account that shares credentials or the email: ad accounts, password manager, domain registrar, payment processors. If the domain or email system is compromised, escalate to incident response; see Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks for the incident-management structure.
• Start the platform's hacked-account recovery flow and identity verification. Open business or advertiser support tickets in parallel.
• Warn the audience from every account still under control.
• File an FBI IC3 complaint and a local police report. Unauthorized access is a crime under 18 U.S.C. § 1030; a demand for payment to return the account may be extortion under 18 U.S.C. § 875(d).
• Do not pay the attacker or any "recovery service." If payment is even being discussed, involve counsel and screen for sanctions risk.
• Notify the cyber insurer within the policy's notice period.
• Assess state breach-notification duties if customers' personal information in messages was exposed.
• If recovery takes more than a few days, consider a clearly labeled temporary account, linked from the website.

Phase 5: Account held by an insider or agency

Build the case

• Write a one-page ownership memo covering the documents, creation facts, platform terms, branding, payment, use, and control. Analyze it under both the multi-factor approach of In re CTLI and the property-first approach of JLM Couture, and list the weak points.
• Confirm whether the business can fix it through the platform (company-owned portfolio, admin removal, business claim process).
• Identify the claims realistically available: contract; conversion or trespass to chattels (check state law on intangible property); duty of loyalty; trade secret under 18 U.S.C. § 1836 where non-public data is involved; CFAA under § 1030(g) only after written revocation and with a qualifying loss; state computer-access statutes such as Cal. Penal Code § 502; and Lanham Act claims under 15 U.S.C. § 1125(a) if the account now speaks as or competes with the business.

Demand

• Send a written demand identifying the account by numeric ID and every handle used, stating the ownership basis, expressly revoking any authorization to access the account, demanding return of credentials and restoration of the handle, and requiring preservation of all content, followers, and messages. Continued access after a written revocation supported CFAA liability in Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), and Van Buren v. United States, 593 U.S. 374 (2021), frames authorization in terms of whether the gate is up or down.
• Offer a practical handover process (a call, a mutual checklist, a chance to download personal content).
• Set a deadline proportionate to the harm: 48 to 72 hours for an active lockout or misuse, longer for a dormant account.
• Do not demand personal account credentials, threaten criminal charges, or frame the demand as silencing criticism.
• For agencies: offer to pay the undisputed amount and escrow the balance in exchange for immediate transfer.

Red flag: the overreaching demand. If the account was created before the relationship, under the individual's name, with personal credentials, and no document names it, the business may lose. Send a measured letter, propose a split, and avoid claims (such as the CFAA) that will not survive a motion to dismiss.

Phase 6: Impersonation

• Capture the impersonating account and all messages sent to customers.
• File an impersonation report with proof of identity and authority.
• File a trademark report if the account uses the brand's name or logo, citing the registration number.
• File a DMCA notice for copied photos or videos the business owns, meeting 17 U.S.C. § 512(c)(3). Consider fair use before sending, as Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), requires, and avoid knowing misrepresentations, which create liability under § 512(f).
• Warn customers on authentic channels and by email.
• Report fraud to the FTC (its Rule on Impersonation of Government and Businesses, 16 C.F.R. part 461, covers false claims of business affiliation) and to IC3 where money was lost.
• Resubmit rejected reports with better evidence, and escalate through business support.
• If the operator is known, send a demand letter.
• If the platform fails and harm continues, evaluate claims: Lanham Act false association under § 1125(a) (commercial injury required under Lexmark International, Inc. v. Static Control Components, Inc., 572 U.S. 118 (2014)); right of publicity for a person, such as Cal. Civ. Code § 3344 or N.Y. Civ. Rights Law § 51; state impersonation statutes, such as Cal. Penal Code § 528.5 (civil remedy for impersonation of an actual person), Tex. Penal Code § 33.07, and N.Y. Penal Law § 190.25.
• If the operator is anonymous and harm is serious, plan a Doe action. See Identifying an Anonymous Defendant Online: A Practical Guide.
• Do not sue the platform. Section 230, 47 U.S.C. § 230, protects platforms hosting impersonating profiles, Carafano v. Metrosplash.com, Inc., 339 F.3d 1119 (9th Cir. 2003).

Red flag: parody. An account that clearly labels itself as parody, commentary, or fan content is usually protected and usually survives a platform report. Reporting it, or suing, can draw attention and an anti-SLAPP motion. Evaluate before acting.

Phase 7: Squatted handle

• Capture the account, its activity (or lack of it), and any offer to sell.
• Confirm the business holds a registration covering the relevant goods or services.
• File a platform trademark report or squatting report; request release under any inactive-account policy.
• Remember that the ACPA, 15 U.S.C. § 1125(d), covers domain names only, as defined in § 1127. Trademark claims under § 1114 require use in commerce and likely confusion.
• Do not pay. If the handle is held by someone with a legitimate claim, choose a variant and secure it everywhere.
• If the squatter is also using a look-alike domain, use the domain tools; see the Domain Name Security and Recovery Checklist: A Practical Checklist.

Phase 8: Platform suspension or reassignment

• Read the notice and the cited policy; identify whether the action came from automation, a report, or a policy decision.
• File the internal appeal with identity proof, ownership evidence, and evidence of any false reports.
• Escalate through advertiser, verified-business, or partner support.
• Send a short, factual letter to the platform's legal team if the suspension rests on a false report or a clear error.
• For EU accounts, consider Digital Services Act complaint and out-of-court dispute mechanisms.
• Before considering litigation, read the forum, arbitration, and limitation clauses, and recognize that Section 230 has defeated most such suits: Riggs v. MySpace, Inc., 444 F. App'x 986 (9th Cir. 2011); Fyk v. Facebook, Inc., 808 F. App'x 597 (9th Cir. 2020); Murphy v. Twitter, Inc., 60 Cal. App. 5th 12 (2021). A specific promise to act may support promissory estoppel, Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009).

Phase 9: Litigation readiness

• Confirm the forum: federal question (Lanham Act, DTSA, CFAA, SCA) or diversity, or a state court with faster emergency practice; check any forum clause in the agreement.
• Assemble the injunction record: the agreement or policy naming the accounts; a declaration from the account manager describing creation, use, and the lockout; captures of misuse; evidence of ongoing harm (customer confusion, lost traffic, lost sales); and the demand letter with proof of delivery.
• Address each Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008) factor: likely success, irreparable harm, balance of equities, public interest. Irreparable harm from loss of control over a business's online presence supported relief in Ardis Health, LLC v. Nankivell, No. 11 Civ. 5013 (S.D.N.Y. Oct. 19, 2011); conclusory claims of confusion did not.
• Brief ownership directly. A court that grants account control without deciding ownership invites vacatur, as in JLM Couture.
• Draft a narrow proposed order: return of credentials and admin roles, restoration of the handle, preservation of content and followers, and a bar on further changes. Avoid speech restrictions broader than the claims support.
• For a TRO without notice, prepare the specific facts and the attorney certification required by Fed. R. Civ. P. 65(b)(1); note that a TRO expires within 14 days unless extended; budget for security under Rule 65(c).
• If expedited discovery is needed (for example, to learn who changed the credentials), move under Fed. R. Civ. P. 26(d)(1) with narrow requests.
• Calendar limitation periods (see the deadlines table) and preservation obligations.
• Plan the damages case from the start. In Eagle v. Morgan, No. 11-4303, 2013 WL 943350 (E.D. Pa. Mar. 12, 2013), the plaintiff established liability for misuse of her LinkedIn profile and recovered nothing because damages were not proven with reasonable certainty.
• Consider early settlement structures (account returned, personal content copied, mutual releases, agreed statement). See the Settlement Negotiation Preparation Checklist: A Practical Checklist.
• Use the Preliminary Injunction and TRO Application Checklist: A Practical Checklist for the filing itself.

Phase 10: The other side (employee, creator, agency, or accused account)

Former employee or creator receiving a demand

• Preserve the account as it is: no deleting posts or followers, no further renaming, no posts about the dispute.
• Gather every document signed: offer letter, employment agreement, handbook acknowledgments, policy, assignment, separation agreement. Look for language naming social media accounts.
• Reconstruct the creation facts: date, email, phone, name, purpose, and whether creation preceded the job.
• Separate what is clearly personal (pre-existing personal accounts, personal photos, your own name and likeness).
• Note any request for personal account credentials; it may violate state law such as Cal. Lab. Code § 980.
• Note any effort to suppress protected concerted speech; an unfair labor practice charge must be filed and served within six months under 29 U.S.C. § 160(b).
• Respond in writing by the deadline, stating your position and proposing a process or split.
• Stop using the former employer's name and logo to promote anything new.

Agency owed money

• Check whether the contract allows withholding; if not, transfer admin roles and pursue the invoice.
• Confirm what creative work you own absent an assignment, and say so in writing.
• Remove your own credentials and payment methods from the client's accounts.

Account accused of impersonation or infringement

• Fix labeling first: parody, fan, and commentary accounts should say so in the name and bio.
• Appeal platform decisions with a short explanation and the account's labeling.
• For DMCA removals, consider a counter-notice under 17 U.S.C. § 512(g) only with a good-faith belief of mistake or misidentification; it is sworn under penalty of perjury and consents to jurisdiction. See Responding to a DMCA Takedown with a Counter-Notice: A Practical Checklist.
• If sued, assess speech defenses (including how Jack Daniel's Properties, Inc. v. VIP Products LLC, 599 U.S. 140 (2023), limits Rogers where a mark is used as a source identifier) and any available anti-SLAPP statute.

Phase 11: Close out

• Rotate credentials, remove stale roles, and confirm two administrators on every account.
• Move any account still held in an agency's or individual's portfolio into the business's own.
• Finalize the evidence file and cost log; submit any insurance claim.
• Update the account inventory, policy, and agreements; name any new accounts.
• Brief the team on what happened and what changed.
• Calendar the next annual review.

Deadlines and timing table

Common failure points

1. No inventory. The business cannot list its accounts, so it cannot prove what it owns.
2. Agency-owned portfolios. The platform treats the agency as owner, and the business has no admin role.
3. General assignment clauses. "Work product" language that never mentions social media accounts, which JLM Couture found insufficient to carry the accounts.
4. Shared passwords. They defeat trade secret claims, make offboarding impossible, and create SCA ambiguity.
5. Reporting before capturing. The evidence disappears.
6. Recovering the account while the email or phone is still compromised.
7. Leading with the CFAA. Without written revocation and a documented loss, it invites a motion to dismiss.
8. Overbroad policies. Bans on criticizing the company create NLRA risk and undercut the ownership clause.
9. Paying hackers or squatters.
10. Suing the platform.

Short worked example

Calder & Finch, a regional furniture maker, discovers on a Monday that its former social media manager, who left on Friday, has renamed the company's Instagram account from @calderfinch to @rowanmakes and is promoting his own woodworking studio to its 95,000 followers. A look-alike @calderfinch account has appeared, with no posts.

The team runs Phase 3 within the hour: captures of the renamed account, its new posts, and the look-alike; a hold notice; a cost log. The inventory from Phase 1 shows the account was created in 2019 with a company role email, sits in Calder & Finch's business portfolio, and is named in the social media policy the manager signed. But the manager removed the other admin on Thursday, and the two-factor codes now go to his phone.

Under Phase 5, counsel sends a demand that afternoon: it identifies the account by numeric ID and both handles, quotes the policy, revokes any authorization to access the account, and demands restoration within 48 hours. In parallel, the company uses its business-portfolio ownership to start the platform's recovery process. The manager's lawyer responds that he built the following. Counsel prepares a TRO motion on contract, conversion, and Lanham Act claims, with a declaration attaching the policy acknowledgment and captures showing customers asking whether the company had closed. Faced with the motion, the manager restores the account the next day and keeps copies of his own photos; the company releases claims for the four days of misuse.

Under Phase 7, the company files a trademark report against the look-alike @calderfinch, which is idle and, once the original handle is restored, is plainly a squatter. The platform removes it within a week. Under Phase 11, the company adds a second admin requirement, moves two-factor codes to a company authenticator, and adds the offboarding steps from Phase 2 to its HR checklist.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: the doctrine behind each phase.
• Social Media Law Basics: the broader legal framework for social media.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: why lawsuits against platforms rarely work.
• Who Owns the Brand: Trademark Ownership Disputes Between Co-Founders, Bands, Licensees, and Distributors: the trademark side of ownership disputes.

Related Guides

• Recovering or Defending a Social Media Account or Handle: A Practical Guide: the narrative version of these phases.
• Identifying an Anonymous Defendant Online: A Practical Guide: unmasking anonymous impersonators.
• Employee Monitoring and Workplace Privacy: A Practical Guide: limits on employer access to personal accounts.
• Sponsorship, Endorsement, and Influencer Agreements: A Practical Guide: account terms in creator deals.

Related Checklists

• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: the wider departure process.
• Messaging and Social Media Evidence Checklist: A Practical Checklist: capture and authentication tasks.
• Domain Name Security and Recovery Checklist: A Practical Checklist: the domain counterpart to this checklist.
• Online Marketplace Trademark Enforcement Checklist: A Practical Checklist: platform trademark complaints in marketplaces.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: the emergency filing.

Related Toolkits

• Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters: the templates referenced throughout.
• Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands: more platform notice forms.
• Brand Ownership Toolkit: Assignment Agreements, Founder IP Clauses, and Ownership Evidence Files: founder and assignment clauses.
• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: capture declarations for the evidence file.