Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters

Summary. This toolkit collects the documents a business, its counsel, and the people on the other side need for social media account ownership, impersonation, and handle disputes. Each template states its purpose, its owner, and when to use it, followed by the template with bracketed placeholders and drafting commentary tied to the governing authority. The prevention templates are an account inventory and ownership register, a social media account ownership policy, account clauses for employment, agency, and influencer agreements, and a credential handover protocol with a departure certification. The response templates are an ownership evidence memo, demand letters to a former employee and to an agency, platform impersonation and trademark complaints, a customer scam warning, and a narrow proposed order for credential return. For the other side, there is a response letter for an employee or creator who receives a demand. A running example involving a brewery, its former social media manager, its old agency, and an impersonating account ties the templates together.

Social media account disputes are won with paper written before the dispute. A policy that names the accounts, a clause that says the business owns them, an admin structure that leaves no single person holding the keys, and a handover certification signed on the last day will prevent most disputes and win most of the rest. When prevention fails, the response is also mostly paper: a demand that revokes access, a platform complaint that a reviewer can approve in two minutes, and a short warning to customers. This toolkit supplies all of it.

How to use this toolkit

Each template begins with Purpose / Owner / When to use, then gives the template, then drafting commentary. Bracketed capitals are placeholders. Adapt every template to the platforms in use and to the law of the states where the business and its people are located; platform reporting forms change often, so treat the complaint templates as content to paste into the current form rather than as letters to mail.

The doctrine is explained in Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account. The response sequence is in Recovering or Defending a Social Media Account or Handle: A Practical Guide, and the task list is in the Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist.

Running example. Juniper Ridge Brewing Co., a Colorado craft brewery with two taprooms, runs Instagram (@juniperridgebrew, 64,000 followers), TikTok, and a Facebook page. Its social media manager, Marcus Odell, opened the Instagram account in 2020 using his personal email, three weeks after he was hired, under the brewery's name. The Facebook page was built in 2021 by an agency, Pixelhaus Media, inside Pixelhaus's own business portfolio. Marcus resigns in [MONTH] and changes the Instagram password on his way out; Pixelhaus, in a dispute over a final invoice, stops responding; and a fake account, @juniperridge.promo, begins messaging followers about a "free keg giveaway" that requires a card number for "delivery." The sample entries below follow Juniper Ridge through prevention (what it should have had) and response (what it does now).

Template 1: Account inventory and ownership register

Purpose: prove what the business owns and who controls it. Owner: marketing lead, with IT. When to use: create now; update when accounts or people change; review annually.

Drafting commentary. The register is the first exhibit in every dispute and the first thing a platform asks for. The creation row matters most after JLM Couture, Inc. v. Gutman, 91 F.4th 91 (2d Cir. 2024), which directed courts applying New York law to start with who owned an account when it was created and whether a contract later transferred it, rather than with a multi-factor test of branding and use. Record the branding, linking, and payment facts anyway, because courts applying the multi-factor approach of In re CTLI, LLC, 528 B.R. 359 (Bankr. S.D. Tex. 2015), rely on them. The risk notes column turns the register into a to-do list. Juniper Ridge's row shows the three most common defects: personal email, personal two-factor, and a single admin. Each is fixable in an afternoon while the employee is still friendly.

Template 2: Social media account ownership policy

Purpose: establish in writing that business accounts belong to the business and personal accounts belong to employees. Owner: HR and counsel. When to use: adopt now; obtain signed acknowledgments at hire and on every update.

[COMPANY] SOCIAL MEDIA ACCOUNT OWNERSHIP POLICY

1. Company Accounts. The social media accounts listed in Schedule A, and any
   account, page, channel, profile, group, or handle created or operated by an
   employee or contractor for [COMPANY]'s business, in [COMPANY]'s name, or
   using [COMPANY]'s trademarks (together, "Company Accounts"), are the property
   of [COMPANY]. Company Accounts include their handles and usernames, content,
   followers, subscribers, connections, messages, analytics, and associated
   advertising accounts, to the extent the platform's terms permit ownership or
   control.

2. Creation and Credentials. Company Accounts must be created using a
   [COMPANY]-domain email address designated by [IT/MARKETING], with two-factor
   authentication controlled by [COMPANY], and must be held in [COMPANY]'s
   business portfolio or brand account where the platform offers one. At least
   two [COMPANY] employees designated by [ROLE] will hold administrator roles.
   Credentials must be stored only in [COMPANY]'s password manager.

3. No Personal Use of Company Accounts. Company Accounts may not be used for
   personal purposes, renamed, transferred, or deleted without written approval
   from [ROLE].

4. Personal Accounts. Accounts an employee creates for personal use, with
   personal information, and that are not listed in Schedule A ("Personal
   Accounts") belong to the employee. [COMPANY] will not require or request
   that any employee or applicant disclose a username or password for a
   Personal Account, access a Personal Account in [COMPANY]'s presence, add
   [COMPANY] personnel as contacts, or change privacy settings, except as
   permitted by applicable law. If an employee wishes to use a Personal Account
   to promote [COMPANY], the employee and [COMPANY] will confirm in writing that
   the account remains a Personal Account.

5. Departure. When employment or engagement ends, or on request at any time,
   the employee or contractor will (a) transfer all administrator roles and
   credentials for Company Accounts as [COMPANY] directs; (b) not change any
   Company Account's handle, display name, content, or settings; and (c) sign
   the Credential Handover Certification.

6. Protected Activity. Nothing in this policy limits any employee's right to
   discuss wages, hours, or other terms and conditions of employment, to engage
   in concerted activity protected by Section 7 of the National Labor Relations
   Act, to communicate with any government agency, or to use Personal Accounts
   for lawful purposes.

7. Schedule A. [LIST EACH COMPANY ACCOUNT BY PLATFORM, HANDLE, AND ACCOUNT ID.
   UPDATE WHEN ACCOUNTS ARE ADDED.]

Acknowledged: ______________________  Date: __________

Drafting commentary. Section 1 names the accounts (through Schedule A) and also covers accounts "created ... for [COMPANY]'s business," because JLM Couture rejected reading a general "any other works" clause to reach social media accounts that were not mentioned. Naming the accounts closes that gap. The "to the extent the platform's terms permit" qualifier reflects that platforms license accounts and often prohibit transfers; the Second Circuit flagged the terms of service as relevant to what ownership means. Section 4 tracks state password-privacy statutes, such as Cal. Lab. Code § 980 and Illinois's 820 ILCS 55/10, which restrict employer demands for personal account access while permitting control of employer accounts; drafting the policy around that line puts the business on the safe side of both. Section 6 protects the policy against a claim that it chills activity protected by 29 U.S.C. § 157; policies that prohibit employees from criticizing the employer online invite unfair labor practice charges under 29 U.S.C. § 158(a)(1). Keep this policy separate from any general conduct-on-social-media policy so the ownership rules are not entangled with speech rules. For where it sits in the handbook, see the Employee Handbook Drafting Checklist: A Practical Checklist.

Template 3: Employment agreement account clause

Purpose: contractually assign business accounts and content, and require return. Owner: HR and counsel. When to use: offer letters and employment agreements for anyone who will create or manage accounts.

Social Media Accounts. Employee agrees that any social media account, page,
channel, profile, group, or handle that Employee creates, registers, or
operates, in whole or in part, for the Company's business, in the Company's
name, or using the Company's trademarks, during Employee's employment (each a
"Company Account"), including any handle and username, all content posted to
it, its followers, subscribers, and connections, and its messages and data, is
and will remain the sole property of the Company, to the extent the applicable
platform's terms permit. To the extent Employee has or acquires any right,
title, or interest in any Company Account, Employee assigns it to the Company.
Employee will (a) create and operate Company Accounts only using credentials
and methods designated by the Company; (b) not rename, transfer, or delete any
Company Account without written authorization; and (c) upon the end of
employment or the Company's request, immediately transfer all credentials and
administrator roles for every Company Account to the Company and cease all
access. The parties acknowledge that the following accounts are Employee's
personal accounts and not Company Accounts: [LIST, OR "NONE"]. Content created
by Employee within the scope of employment is a work made for hire owned by the
Company under 17 U.S.C. § 101 and § 201(b); to the extent any such content is
not a work made for hire, Employee assigns all rights in it to the Company.

Drafting commentary. The clause does four things JLM Couture found missing: it names social media accounts, it operates as a present assignment of any rights the employee acquires, it separates accounts from content (the court treated them as distinct), and it lists personal accounts so there is no later argument about which is which. Employee-created content within the scope of employment is already a work made for hire under 17 U.S.C. § 101 and § 201(b); the backup assignment covers content created outside that scope. The return obligation sets up a later written revocation of authority, which matters under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030: after Van Buren v. United States, 593 U.S. 374 (2021), authorization turns on whether access is permitted at all, and a contract that ends permission on departure helps define the gate. For enforceability of assignment clauses across states, see Employee Invention Assignment Agreements: Drafting for Enforceability Across Jurisdictions. In Juniper Ridge's case, Marcus signed an offer letter with no such clause, so the brewery will rely on the 2022 handbook acknowledgment listing @juniperridgebrew and on the creation facts.

Template 4: Agency and contractor account clause

Purpose: keep accounts, ad assets, and content in the client's hands regardless of how the engagement ends. Owner: the client's counsel or marketing lead. When to use: every agency, freelancer, and contractor agreement involving social media.

Client Accounts and Materials.
(a) Ownership. All social media accounts, pages, channels, handles, business
    portfolios, advertising accounts, pixels, audiences, and analytics created
    or managed for Client under this Agreement ("Client Accounts") are owned by
    Client. Agency will create each Client Account in Client's name, inside
    Client's own business portfolio or brand account, using a Client-domain
    email, and will be added only as a partner, agent, or administrator with
    the least privilege needed.
(b) Deliverables. All content, creative, copy, photographs, video, and other
    deliverables created for Client ("Deliverables") are assigned to Client on
    creation [OR: on payment of the fees for the applicable Deliverable], and
    Agency will deliver native files on request. Agency retains ownership of its
    pre-existing tools and templates and grants Client a perpetual license to
    use any embedded in Deliverables.
(c) Handover. Within [two (2)] business days after Client's request, or after
    any termination or expiration, Agency will transfer ownership and all
    administrator roles for every Client Account to Client, deliver all
    credentials Agency holds, remove Agency's own access as Client directs, and
    deliver all Deliverables. This obligation applies regardless of any dispute
    about fees. Agency waives any right to withhold, suspend, or condition
    access to Client Accounts or Deliverables pending payment.
(d) Fee disputes. Any fee dispute will be resolved under Section [X]. Client
    will pay all undisputed amounts when due.
(e) Survival. This Section survives termination.

Drafting commentary. Subsection (a) solves the most common agency problem: pages built inside the agency's portfolio, which the platform treats as the agency's. Subsection (b) addresses copyright. An independent contractor owns what it creates unless there is a written assignment; most social media content is not within the nine categories of commissioned works that can be works made for hire by agreement under 17 U.S.C. § 101, and a transfer of copyright ownership requires a signed writing under 17 U.S.C. § 204(a). Agencies will often ask that assignment occur on payment; that is reasonable for content, but the account handover in (c) should not be tied to payment. The waiver of withholding rights in (c) prevents the "pay us and we will give you the keys" standoff. For a broader view of agency and technology-vendor disputes, see Technology Project Dispute Toolkit: Notice of Breach Letters, Cure Plans, and Project Record Protocols. Juniper Ridge's 2021 Pixelhaus contract had no such clause, which is why its Facebook page sits in Pixelhaus's portfolio.

Template 5: Influencer campaign account clause

Purpose: allocate ownership of campaign accounts and content between a brand and a creator, and keep disclosures compliant. Owner: brand counsel and the creator's representative. When to use: any influencer, ambassador, or creator agreement that involves a brand-run account or content on the creator's account.

Accounts. (a) Creator's personal accounts listed in Exhibit [X] ("Creator
Accounts") are and remain Creator's property. Brand acquires no right to access,
control, or receive credentials for any Creator Account. (b) Any account created
for the Campaign in Brand's name or using Brand's marks ("Campaign Account") is
Brand's property; Brand will hold the owner and administrator roles and grant
Creator a posting role for the Term. At the end of the Term, Creator's role ends
and Creator will not access the Campaign Account. (c) Content Creator posts to
Creator Accounts is owned by Creator, and Creator grants Brand a [non-exclusive,
royalty-free] license to [REPOST / USE IN PAID MEDIA] for [PERIOD] in
[TERRITORY]. Content created for a Campaign Account is assigned to Brand.

Disclosures. Creator will clearly and conspicuously disclose Creator's material
connection to Brand in each post, as required by the FTC's Guides Concerning the
Use of Endorsements and Testimonials in Advertising, 16 C.F.R. Part 255, and
Brand's disclosure guidelines in Exhibit [Y]. Neither party will purchase
followers, likes, views, or other indicators of social media influence that it
knows or should know are fake.

Drafting commentary. Subsection (a) protects the creator and avoids the Eagle v. Morgan problem from the other side, where a company's control of an individual's profile produced liability for misuse of her name. Subsection (b) keeps campaign accounts with the brand, and a posting role rather than credentials avoids any lockout at the end. Disclosures are the joint responsibility of brand and creator under 16 C.F.R. part 255, enforced by the FTC under 15 U.S.C. § 45. The fake-indicator sentence tracks the FTC's rule on consumer reviews and testimonials, 16 C.F.R. part 465, which bars buying or selling fake indicators of social media influence for commercial purposes. More detail is in Sponsorship, Endorsement, and Influencer Agreements: A Practical Guide.

Template 6: Credential handover protocol and departure certification

Purpose: transfer control cleanly at every departure and create a signed record. Owner: the departing person's manager, with IT. When to use: before or on the last day of any employee, contractor, or agency who managed accounts.

Protocol (run in order, ideally on a call with screen sharing):

1. Confirm from the register (Template 1) every account the person touches.
2. Confirm that at least two remaining company admins hold roles on each account; add them first if not.
3. Have the person transfer any owner role to the business, then remove their own roles.
4. Change the login email and two-factor method on any account still tied to the person.
5. Rotate shared passwords in the company password manager; revoke active sessions.
6. Export a list of account IDs, handles, and follower counts as of handover.
7. Offer the person a chance to download personal content (for example, their own photos) where appropriate.
8. Collect the certification below.

CREDENTIAL HANDOVER CERTIFICATION

I, [NAME], certify that as of [DATE]:
1. I have transferred to [COMPANY] all credentials, administrator roles, and
   ownership roles that I held for the Company Accounts listed in the attached
   schedule, and I no longer have access to any of them.
2. I have not changed the handle, display name, content, followers, or settings
   of any Company Account since [DATE OF NOTICE], except as directed by
   [COMPANY].
3. I hold no other credentials for any [COMPANY] social media, advertising,
   email, or domain account, except: [NONE / LIST].
4. The following accounts are my personal accounts and are not Company
   Accounts: [LIST].
5. I understand that I am not authorized to access any Company Account after
   today.

Signature: ______________________  Date: __________

Drafting commentary. Paragraph 5 is a written revocation of authorization. In Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), access after a cease-and-desist letter withdrawing permission was "without authorization" under the CFAA; the certification creates the same clarity without a dispute. Paragraph 4 protects the employee as much as the business, and helps avoid the impression that the business is seeking access to personal accounts in violation of password-privacy laws. Collecting the certification also documents reasonable secrecy measures for any non-public account data, which matters under 18 U.S.C. § 1839(3) if a trade secret claim is ever needed. Fold the protocol into the broader Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Template 7: Ownership evidence memo

Purpose: assess ownership honestly before sending a demand. Owner: counsel, shared with the client. When to use: in the first days of any dispute with an employee, founder, agency, or creator.

Drafting commentary. Prepare the memo in anticipation of litigation and label it accordingly under Fed. R. Civ. P. 26(b)(3), but write it as if the other side will read it, because the facts in it will be tested. The two-approach analysis is the heart of it: courts are split between the multi-factor test used in In re CTLI and in International Brotherhood of Teamsters, Local 651 v. Philbeck, 464 F. Supp. 3d 863 (E.D. Ky. 2020), and the property-first approach of JLM Couture. For claims, remember that the CFAA's civil remedy in § 1030(g) requires a qualifying loss (usually $5,000 in a year of response and restoration costs, not lost business), which is why the CFAA claim in Eagle v. Morgan failed. A trade secret claim under 18 U.S.C. § 1836 is realistic only for non-public data protected by reasonable measures, as in Christou v. Beatport, LLC, 849 F. Supp. 2d 1055 (D. Colo. 2012).

Template 8: Demand letter to a former employee (with revocation)

Purpose: recover control quickly, revoke authorization, and set up injunctive relief. Owner: counsel. When to use: when a former employee or insider holds, has renamed, or is misusing a business account.

[DATE]

BY EMAIL ([EMAIL]) AND [OVERNIGHT COURIER]

[NAME]
[ADDRESS]

Re: [COMPANY] Instagram account @[HANDLE] (account ID [ID])

Dear [NAME]:

This firm represents [COMPANY]. We write about the Instagram account with
account ID [ID], which operated as @[HANDLE] under the name "[DISPLAY NAME]"
from [DATE] until [DATE], when its password, handle, and display name were
changed (the "Account").

The Account belongs to [COMPANY]. You created it on [DATE], [TIME PERIOD] after
you joined [COMPANY] as [TITLE], in [COMPANY]'s name, to promote [COMPANY]'s
business. [COMPANY] paid for all advertising on it, linked it from its website
and packaging, and listed it as a company account in the [POLICY], which you
acknowledged in writing on [DATE]. [ADD CONTRACT LANGUAGE IF ANY.]

Any authority you had to access or use the Account ended with your employment
on [DATE]. To the extent any authority remains, [COMPANY] revokes it, effective
immediately. You are not authorized to access, use, change, or post to the
Account.

[COMPANY] requests that, by [TIME] on [DATE, 48 TO 72 HOURS]:
1. You restore the handle @[HANDLE] and display name "[DISPLAY NAME]";
2. You transfer the Account's login email, password, and two-factor method
   to [COMPANY] as [NAME/ROLE] directs, on a call we are happy to schedule;
3. You make no further changes and do not delete any content, followers, or
   messages; and
4. You confirm in writing that you have done so.

You and [COMPANY] are both obligated to preserve all documents and data
relating to the Account, including posts, messages, and records of access.

[COMPANY] does not claim any personal account of yours, and does not ask for
your personal account credentials. If there are personal photographs in the
Account that you would like to keep, tell us, and we will arrange for you to
download copies before the transfer.

If we do not receive confirmation by the deadline, [COMPANY] intends to seek
relief in court, including a temporary restraining order, without further
notice. We would prefer to resolve this quickly and cooperatively.

Sincerely,
[COUNSEL]

Drafting commentary. The account ID matters because handles change; platforms and courts track accounts by ID. The revocation paragraph does the work identified in Power Ventures and Van Buren. The preservation paragraph is symmetrical and supports a later spoliation argument if content disappears. The paragraph disclaiming personal accounts keeps the letter clear of state password-privacy statutes and makes the business look reasonable to a judge who reads it as Exhibit A. The letter does not threaten criminal prosecution, which can raise ethics and extortion concerns, and does not attack the employee's speech, which could implicate the NLRA. The court-relief sentence is credible only if the business is ready to file; prepare Template 13 before sending. For general demand-letter structure, see Writing a Demand Letter: The Basics, and for the emergency motion, Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

Template 9: Demand letter to an agency

Purpose: separate the account from the invoice and obtain an immediate handover. Owner: counsel or the client's executive. When to use: when an agency or contractor holds admin roles and will not transfer them.

[DATE]

[AGENCY NAME]
Attn: [PRINCIPAL]

Re: Transfer of [CLIENT] social media accounts and materials

Dear [NAME]:

[CLIENT] ended its engagement of [AGENCY] effective [DATE]. [AGENCY] continues
to hold the owner and administrator roles for the following [CLIENT] assets,
and has not responded to requests on [DATES] to transfer them:

  - Facebook page "[PAGE NAME]" (page ID [ID]), held in [AGENCY]'s business
    portfolio [ID];
  - Instagram account @[HANDLE] (ID [ID]);
  - Advertising account [ID] and pixel [ID];
  - All creative files produced for [CLIENT].

These assets belong to [CLIENT]. They were created in [CLIENT]'s name, for
[CLIENT]'s business, and [CLIENT] paid for them. [CITE CONTRACT TERMS IF ANY.]
As [CLIENT]'s agent, [AGENCY] must return them at the end of the engagement.

We understand [AGENCY] has invoiced $[AMOUNT], of which [CLIENT] disputes
$[AMOUNT]. To remove any connection between the invoice and the handover,
[CLIENT] will (a) pay the undisputed $[AMOUNT] within two business days of the
transfer and (b) [place the disputed $[AMOUNT] in escrow with [ESCROW AGENT]]
[resolve the disputed amount under Section [X] of the agreement].

Please, by [DATE]: (1) transfer ownership of the page and advertising account to
[CLIENT]'s business portfolio [ID] and add [NAME] as administrator; (2) remove
[AGENCY]'s access as [CLIENT] directs; (3) deliver all credentials [AGENCY]
holds; and (4) deliver native files of all creative work [and a signed copyright
assignment in the form attached].

[CLIENT] reserves all rights, including claims for conversion and lost business
caused by any continued withholding.

Sincerely,
[NAME]

Drafting commentary. The escrow offer is the most effective sentence in the letter. It removes the agency's leverage and makes any continued withholding look like conversion rather than a fee dispute. The request for a copyright assignment is important because, without one, an agency generally owns the copyright in content it created as an independent contractor, and a transfer requires a signed writing under 17 U.S.C. § 204(a); the client may have only an implied license. Start the platform's own business claim process in parallel. Juniper Ridge sent this letter to Pixelhaus with an escrow offer for the disputed $1,900; Pixelhaus transferred the page two days later.

Template 10: Platform impersonation complaint

Purpose: get an impersonating account removed quickly. Owner: the marketing lead or the impersonated person, with counsel for difficult cases. When to use: as soon as an account pretends to be the business or a person, after evidence capture.

IMPERSONATION REPORT

Reporting party: [BUSINESS LEGAL NAME] / [PERSON'S FULL NAME]
Authorized representative: [NAME, TITLE, EMAIL]
Authentic account: [URL] (handle @[HANDLE], account ID [ID])
Impersonating account: [URL] (handle @[HANDLE], account ID [ID if visible])

What the impersonating account copies:
  - Name or display name: "[TEXT]" (authentic: "[TEXT]")
  - Profile image: our logo / photo of [PERSON] (authentic image attached)
  - Bio text: "[TEXT]" copied from our bio
  - Posts: [NUMBER] posts copied from our account on [DATES]

Harm: Since [DATE], the account has sent direct messages to our customers
claiming to be "[BUSINESS] Support" and asking for card numbers to process a
"[REFUND / GIVEAWAY]." Screenshots of [NUMBER] messages sent to customers are
attached. Customers have reported [LOSSES / CONFUSION].

Identity and authority: [Attached: business registration / government ID /
letter of authority.] We are the [BUSINESS / PERSON] that the account
impersonates. We have not authorized it.

Request: Remove the impersonating account. We also request that you preserve
records relating to it in case of legal process.

Drafting commentary. Platform reviewers decide in minutes; the report should let them compare authentic and fake side by side and see the harm. Use the impersonation channel for accounts pretending to be the business or person, and file a separate trademark report (Template 11) when the account uses the mark. Copied photos can also support a DMCA notice under 17 U.S.C. § 512(c)(3), but do not mix copyright claims into an impersonation report; platforms route them differently. If the platform refuses, the legal options are Lanham Act false association under 15 U.S.C. § 1125(a), right-of-publicity claims for a person (for example, Cal. Civ. Code § 3344), and state online impersonation statutes such as Cal. Penal Code § 528.5, which gives a civil action for credible impersonation of an actual person to harm, intimidate, threaten, or defraud. Report scams to the FTC as well; its Rule on Impersonation of Government and Businesses, 16 C.F.R. part 461, targets false claims of business affiliation. Do not plan a suit against the platform: Carafano v. Metrosplash.com, Inc., 339 F.3d 1119 (9th Cir. 2003), and the cases following it apply 47 U.S.C. § 230 to impersonating profiles. Juniper Ridge's report against @juniperridge.promo attached four customer messages; the account was removed the next day.

Template 11: Platform trademark complaint for a handle or account

Purpose: remove or reclaim a handle or account that uses the business's mark. Owner: counsel or the brand manager. When to use: for squatted handles, confusing look-alike accounts, and accounts selling goods under the mark.

TRADEMARK REPORT

Rights owner: [LEGAL NAME], [ADDRESS]
Contact: [NAME, TITLE, EMAIL, PHONE]
Mark: [MARK]
Registration: [COUNTRY] Reg. No. [NUMBER], registered [DATE], for [GOODS/
SERVICES, CLASS]. [Attach registration certificate or office record.]
Our authentic account: [URL]

Reported account: [URL] (handle @[HANDLE])
How it uses our mark: The handle @[HANDLE] is identical to our mark. The account
[is inactive and was registered on or about [DATE] after we changed our handle /
uses our logo as its profile image / offers [GOODS] under our mark / has offered
to sell the handle to us for $[AMOUNT] (screenshot attached)].
Why it is likely to confuse: [Customers searching for us find this account /
it presents itself as our official account / it sells goods that compete with
ours.]

We have not authorized this use. We request that you [remove the account /
release the handle to our account @[HANDLE] / remove the listed content].

I state in good faith that the information in this report is accurate and that
I am authorized to act on behalf of the rights owner.

Signature: [NAME], [DATE]

Drafting commentary. A registration is the single most important attachment: platform reviewers verify registrations and generally will not adjudicate common-law rights. Federal registration is obtained under 15 U.S.C. § 1051. Describe the use concretely, because a platform will not act against an account that has a plausible independent right to the same word. A sale offer is useful evidence of squatting and bad faith, but note that the ACPA, 15 U.S.C. § 1125(d), applies only to domain names as defined in § 1127, so the complaint should rest on the platform's trademark and squatting policies, not on cybersquatting law. If litigation becomes necessary, infringement under 15 U.S.C. § 1114 requires use in commerce and likely confusion; a dormant handle is a weak target. Never include a demand for payment or a threat in a platform complaint. More platform notice forms are in the Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands, and the rebrand context is in the Rebrand Toolkit: Clearance Memos, Transition Plans, and Legacy Mark Maintenance Records.

Template 12: Customer scam warning

Purpose: protect customers and reduce harm while platforms act. Owner: communications lead. When to use: within the hour of discovering a fake account or a hacked account soliciting money or information.

POST / STORY / EMAIL / WEBSITE BANNER

Heads up: an account pretending to be [BUSINESS] ([@FAKE HANDLE]) is messaging
people about a [GIVEAWAY / REFUND / PROMOTION]. It is not us.

[BUSINESS] will never ask for your card number, password, or a payment in a
direct message. Our only official accounts are:
  [PLATFORM]: @[HANDLE]
  [PLATFORM]: @[HANDLE]
  Website: [URL]

If you shared payment details, contact your bank right away. You can report the
fake account to [PLATFORM] and report fraud at [FTC REPORTING SITE / IC3]. Questions?
Email [ADDRESS].

Drafting commentary. Keep it short, factual, and free of speculation about who is behind the scam (a wrong guess is a defamation risk). Listing the official accounts helps customers and supports later Lanham Act and impersonation claims by showing the business's efforts to dispel confusion. If a hacked account had access to customer messages containing personal information, coordinate the warning with any breach-notification analysis. For helping customers who lost money, see the Fraud Response Toolkit: Freeze Requests, Dispute Letters, Reports, and Recovery Steps.

Template 13: Proposed order for return of credentials

Purpose: give the court a narrow order it can sign quickly. Owner: counsel. When to use: with a TRO or preliminary injunction motion when an insider will not return a business account.

[PROPOSED] ORDER GRANTING [TEMPORARY RESTRAINING ORDER / PRELIMINARY INJUNCTION]

Upon Plaintiff's motion, the declarations of [NAMES] and exhibits, [and after
notice and a hearing on [DATE]], the Court finds that Plaintiff has shown a
likelihood of success on its claims for [breach of contract and conversion],
that Plaintiff is likely to suffer irreparable harm absent relief because it
cannot control its own [PLATFORM] account, through which it communicates with
customers, and the account is being [used to promote a competing business /
used to speak in Plaintiff's name], that the balance of equities favors relief,
and that the public interest is served by preventing confusion. [For a TRO
without notice: The Court further finds, based on the specific facts in the
declaration of [NAME], that immediate and irreparable injury will result before
Defendant can be heard, and counsel has certified efforts to give notice.]

IT IS ORDERED that, pending [a hearing on Plaintiff's motion for a preliminary
injunction / final judgment]:
1. Within [24/48] hours of service of this Order, Defendant shall transfer to
   Plaintiff the login credentials, recovery email, two-factor method, and all
   administrator roles for the [PLATFORM] account with account ID [ID] (the
   "Account"), and shall restore the handle @[HANDLE] if available.
2. Defendant shall not access, post to, rename, or change the settings of the
   Account after the transfer, and shall not delete any content, followers, or
   messages.
3. Defendant shall preserve all documents and data relating to the Account.
4. Nothing in this Order restricts Defendant's use of any personal account
   other than the Account, or Defendant's lawful speech.
5. Plaintiff shall post security in the amount of $[AMOUNT] under Rule 65(c).
[6. This Order expires on [DATE, NOT MORE THAN 14 DAYS] unless extended.]

Drafting commentary. The findings track Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008). The irreparable-harm finding mirrors Ardis Health, LLC v. Nankivell, No. 11 Civ. 5013 (S.D.N.Y. Oct. 19, 2011), where loss of control over a company's own online presence supported an order to return login information. The likelihood-of-success finding must address ownership: in JLM Couture, an account-control injunction was vacated twice, first because the court had not found a likelihood of success on the property claims, then because it had not determined ownership under ordinary property principles. Paragraph 4 limits the order to the account and avoids a prior-restraint fight over speech. The TRO bracket and the 14-day limit come from Fed. R. Civ. P. 65(b), and paragraph 5 from Rule 65(c). Enforcement, if the defendant does not comply, is covered in Contempt and Enforcing Injunctions: Civil, Criminal, and What an Order Actually Compels.

Template 14: Response letter for an employee or creator who receives a demand

Purpose: preserve the recipient's position, avoid escalation, and propose a resolution. Owner: the employee's or creator's counsel. When to use: within the deadline in a demand like Template 8.

[DATE]

[COUNSEL FOR COMPANY]

Re: [ACCOUNT] (account ID [ID])

Dear [NAME]:

We represent [CLIENT] in connection with your letter of [DATE].

[CLIENT] has preserved the account and its content and has made no changes
since receiving your letter. [CLIENT] will continue to do so while we discuss
this matter.

[CLIENT]'s position is that the account is [his/her/their] personal account.
[CLIENT] created it on [DATE], before joining [COMPANY] / with [his/her/their]
personal email and phone, under [his/her/their] own name, for [personal
purpose]. No agreement [CLIENT] signed mentions social media accounts. [IF
APPLICABLE: The handbook acknowledgment you cite was signed in [YEAR], [YEARS]
after the account was created, and does not list this account.] Under the
property-first approach adopted by the Second Circuit in JLM Couture, Inc. v.
Gutman, 91 F.4th 91 (2d Cir. 2024), ownership begins with the account's
creation, and a general assignment of work product does not transfer the
account itself.

[CLIENT] does not claim [COMPANY]'s trademarks and will not use them to promote
any business. [IF APPLICABLE: [CLIENT] has removed [COMPANY]'s logo from the
profile.]

To resolve this without litigation, [CLIENT] proposes: [OPTION A: [CLIENT]
keeps the account, removes references to [COMPANY], and [COMPANY] receives a
copy of content it created / OPTION B: [CLIENT] transfers the account, keeps
copies of personal content, and the parties exchange mutual releases and agree
on a short public statement].

We note that [CLIENT] has not been asked for, and will not provide, credentials
to any other personal account.

Sincerely,
[COUNSEL]

Drafting commentary. The first paragraph neutralizes the most dangerous fact for a recipient: spoliation. The ownership paragraph uses JLM Couture where New York law or similar reasoning applies; where the account was created in the company's name for its business, the honest answer is often Option B, and the letter should not pretend otherwise. A CFAA threat in the demand is usually weak where the recipient has not accessed the account after a clear revocation and the company cannot show a qualifying "loss" under 18 U.S.C. § 1030(e)(11), but stop accessing the account if the facts are unclear. If the dispute involves the employee's protected concerted speech, note the six-month period for an unfair labor practice charge under 29 U.S.C. § 160(b). General guidance on responding is in Responding to a Cease and Desist Letter: A Practical Guide.

Running example: how Juniper Ridge used the toolkit

• Day 1 (Monday). Juniper Ridge captures the renamed Instagram account, the Pixelhaus-held Facebook page settings, and the fake @juniperridge.promo messages. It posts Template 12 on its stories and website and emails its mailing list. It files Template 10 against @juniperridge.promo and Template 11 citing its JUNIPER RIDGE registration.
• Day 1 (afternoon). Counsel completes Template 7. The multi-factor analysis strongly favors the brewery; the property-first analysis is closer but helped by the 2022 handbook acknowledgment naming the account. Counsel sends Template 8 to Marcus with a 48-hour deadline and Template 9 to Pixelhaus with an escrow offer.
• Day 2. @juniperridge.promo is removed. Marcus's lawyer responds with a version of Template 14, arguing that Marcus created the account with his own email. Counsel finalizes Template 13 and a supporting declaration, attaching the handbook acknowledgment, the website and can-label links, the ad invoices, and customer messages asking whether the brewery had closed.
• Day 3. Pixelhaus transfers the Facebook page to Juniper Ridge's portfolio after the escrow offer, and signs a copyright assignment.
• Day 4. Facing a TRO motion, Marcus agrees to Option B: he restores the handle, transfers the credentials on a call using Template 6, keeps copies of his own photographs, and signs the certification. The parties exchange releases.
• Week 2. Juniper Ridge adopts Template 2 with a Schedule A listing every account, adds Template 3 to its offer letters and Template 4 to its agency contracts, completes Template 1 for every platform, and moves all two-factor codes to a company authenticator.

Practical takeaways

• Name the accounts. Every policy and agreement should list social media accounts specifically and separate accounts from content.
• Keep accounts in the business's own portfolios, with company email, company two-factor, and two admins.
• Revoke authorization in writing at every departure; the certification and the demand letter both do it.
• Separate the money from the account in agency disputes; escrow the disputed amount.
• Make platform complaints easy to approve: side-by-side comparison, registration numbers, and evidence of harm.
• Warn customers fast and factually.
• Ask courts for narrow orders that address ownership directly.
• If you are on the receiving end, preserve everything, read your documents, and propose a practical split.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: the doctrine these templates implement.
• Social Media Law Basics: the broader social media legal framework.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: why complaints go to platforms rather than lawsuits against them.
• Who Owns the Brand: Trademark Ownership Disputes Between Co-Founders, Bands, Licensees, and Distributors: the trademark ownership counterpart.

Related Guides

• Recovering or Defending a Social Media Account or Handle: A Practical Guide: when and how each template is used.
• Sponsorship, Endorsement, and Influencer Agreements: A Practical Guide: the full influencer contract around Template 5.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: the motion behind Template 13.
• Responding to a Cease and Desist Letter: A Practical Guide: the recipient's playbook behind Template 14.

Related Checklists

• Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist: the tasks these templates support.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: where Template 6 fits in offboarding.
• Employee Handbook Drafting Checklist: A Practical Checklist: placing Template 2 in the handbook.
• Drafting a Demand Letter: A Practical Checklist: general demand-letter checks for Templates 8 and 9.

Related Toolkits

• Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands: more platform notice forms.
• Brand Ownership Toolkit: Assignment Agreements, Founder IP Clauses, and Ownership Evidence Files: founder clauses and ownership evidence files.
• Right of Publicity Toolkit: Releases, NIL Agreements, and Takedown Demands: takedown demands for personal impersonation.
• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: capture declarations for the evidence file.
• Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints: the domain-name counterpart.