Someone Is Impersonating You Online
Online impersonation — creating fake profiles, accounts, or websites using your name, likeness, or identity — can cause reputational, financial, and personal harm. This page explains the legal routes available in England and Wales and the practical steps to take.
Quick Answer
Online impersonation can engage the Protection from Harassment Act 1997, the UK GDPR Art 17 (right to erasure), defamation law, and the Online Safety Act 2023. The fastest remedy is usually a platform takedown. If the impersonator is unknown, a Norwich Pharmacal order can compel the platform to disclose their identity.
Full Explanation
There is no single impersonation offence in English law, but a range of legal provisions may apply depending on the nature and purpose of the impersonation. If the impersonation amounts to persistent unwanted conduct that causes distress, it may constitute harassment under the Protection from Harassment Act 1997 s.1 — the civil tort under s.3 allows an injunction and damages. If the impersonator gains access to your accounts or systems, the Computer Misuse Act 1990 applies.
If the fake account or content makes false statements of fact that damage your reputation, defamation law under the Defamation Act 2013 may apply. The serious harm threshold requires that the defamatory statement has caused or is likely to cause serious harm to your reputation. Online platforms are protected as secondary publishers under the Defamation Act 1996 if they remove content promptly after notification.
The UK GDPR gives you the right to erasure of your personal data (Art 17). A fake profile using your name, photographs, or other identifying information constitutes processing of your personal data. You can demand erasure from the platform directly; if they refuse, complain to the ICO.
Where the impersonator is anonymous, a Norwich Pharmacal order (from Norwich Pharmacal Co v Customs & Excise [1974]) can be sought from the court, requiring the platform to disclose the identity of the user. The test is that the platform is involved (even innocently) in the wrongdoing and has information necessary for the claimant to bring a claim.
The Online Safety Act 2023 imposes duties on user-to-user platforms to address illegal content, including harassment. Ofcom can require platforms to comply and impose fines for failure to do so.
Legal Basis
- §Protection from Harassment Act 1997 ss.1–3 — civil and criminal harassment; injunctions and damages available
- §UK GDPR Art 17 — right to erasure of personal data processed without a lawful basis
- §Defamation Act 2013 s.1 — serious harm threshold for defamation claims
- §Online Safety Act 2023 — duties on platforms to address illegal content including harassment
- §Norwich Pharmacal Co v Customs & Excise Commissioners [1974] AC 133 — pre-action disclosure orders to identify unknown wrongdoers
What To Do
Report the Fake Account to the Platform
Use the platform's impersonation reporting tool. Most major platforms (Meta, X, TikTok, LinkedIn) have a specific impersonation report category. Provide evidence of your real identity and links to your genuine profiles. Keep a record of the report reference number.
Preserve Evidence
Screenshot the fake profile, including the URL, profile picture, any posts, and the account creation date if visible. Evidence may be needed for legal proceedings or a police report.
Exercise Your UK GDPR Right to Erasure
Send a formal erasure request under UK GDPR Art 17 to the platform's data protection officer. The platform must respond within one month. If it refuses or fails to respond, complain to the ICO at ico.org.uk.
Apply for a Norwich Pharmacal Order If You Need to Identify the Impersonator
If you need to know who is behind the account — for example to bring harassment or defamation proceedings — instruct a solicitor to apply for a Norwich Pharmacal order in the High Court. The application requires evidence that wrongdoing has occurred, the platform has information about the wrongdoer, and you need that information to bring a claim.
Important Deadlines
Important Warnings
Platforms may be slow to act or may refuse removal if they do not consider the content to breach their terms. Escalate via the ICO or Ofcom if the platform fails to comply.
If the impersonation is being used to commit fraud — for example, deceiving people into sending money — this is a serious criminal matter. Report to Action Fraud (0300 123 2040) and your bank immediately.
Do not engage with the impersonator directly, as this can escalate the situation.