Who is behind a fake Instagram, TikTok or Snapchat account? Identifying the author of an anonymous account and filing a police complaint in France

Who is behind a fake Instagram account, or an anonymous TikTok or Snapchat account that harasses, insults, threatens or impersonates someone? Since 18 August 2026, the European e-Evidence Regulation allows a French prosecutor or judge to require Meta, TikTok, Snap or X directly, within ten days, to hand over the registration and login data of an account, without going through international mutual legal assistance. Two constraints remain: defamation and insults are time-barred after three months, and the Regulation does not require the platform to retain the data. This page sets out what the police can obtain, which complaint to file and how to preserve the evidence.

How to find out who is behind a fake Instagram, TikTok or Snapchat account

A reverse image search of the profile picture shows whether the image is published elsewhere under another name, an indication of a fake account. It does not give the name of the author. Nor can that name be obtained by breaking into the account: fraudulent access to an automated data processing system is punishable by three years’ imprisonment and a fine of 100,000 euros (Article 323-1 of the French Criminal Code).

The identifying information is held by the platform: the email address or phone number supplied on registration, the IP addresses used to log in. French law requires hosting providers to retain these data and to disclose them to the judicial authority that requests them (Article 6, V, of the Law on Confidence in the Digital Economy); the victim has no direct access to them.

Can the police track an anonymous account? IP address, phone number, requisitions

The IP address or phone number provided by the platform does not give a name: a second requisition is sent to the French operator, which keeps the data identifying the source of a connection for one year and the civil identity of its subscriber for five years after the contract ends (Article L. 34-1 of the Postal and Electronic Communications Code). The IP address of a virtual private network (VPN) or of public Wi-Fi does not lead directly to the user.

The offence named in the complaint governs what the police can request. The IP address can be requisitioned for the sole purpose of identifying the author only if the proceedings concern an offence punishable by at least one year’s imprisonment committed by means of an electronic communications network (Article 60-1-2 of the Code of Criminal Procedure). Online harassment, impersonation, death threats, and defamation or insults of a racist, sexist or homophobic nature or targeting a disability meet that condition. Defamation and insults against a private individual, punishable by a fine, do not: only the user’s civil identity and the data supplied when the account was created may then be requisitioned (Cass. crim., 14 March 2023, no 22-90.018). The content of messages, through a European order, requires a judge and an offence punishable by at least three years’ imprisonment, such as a death threat, or one of those listed in the Regulation.

European Production Order (EPOC): Meta, TikTok, Snap or X must answer within ten days

Meta, TikTok and X have their European headquarters in Ireland, to which the European Investigation Order does not apply. Before 18 August 2026, the French judge therefore had to use international mutual legal assistance, which the requested State could refuse. A television channel that had been looking for five years for the author of messages posted on a social network thus faced a dismissal of the case, the investigating chamber considering that requests for assistance would come up against the refusal of the American and Irish authorities (Cass. crim., 10 February 2026, no 25-81.762).

Regulation (EU) 2023/1543, known as e-Evidence, now allows the prosecutor or the judge to send a European Production Order, transmitted by a certificate called an EPOC, directly to the establishment that the platform has designated in the Union. The platform has ten days to hand over the data, and Member States must provide for financial penalties against a defaulting provider of up to 2% of its total worldwide annual turnover. For subscriber data and data requested for the sole purpose of identification, the Regulation sets no seriousness threshold and the prosecutor has jurisdiction (see already CJEU, 2 October 2018, Ministerio Fiscal, C-207/16). The full regime is set out in our page on the European Production Order (EPOC).

The victim cannot issue the order: the victim asks for it, through the complaint and then through requests for investigative steps. One question has not been settled: does the limit that Article 60-1-2 sets for IP addresses apply to the European order? Article 5 of the Regulation, which requires that a similar measure be available in a similar domestic case, suggests that it does.

Complaint dropped or investigation stalled because the platform did not respond: the firm, an English-speaking criminal law practice in Paris handling cybercrime, online harassment and defamation, asks the prosecutor or the investigating judge to issue a European Preservation Order and then a Production Order. Contact the firm →

Online harassment, defamation, impersonation, threats in France: which offence, which penalty, which deadline

The legal characterisation is chosen before the complaint: it determines the penalty, the data the investigation can obtain and the deadline for acting.

Online harassment consists of repeated statements or conduct whose purpose or effect is to degrade the victim’s living conditions to the point of impairing their physical or mental health. Committed online, it is punishable by two years’ imprisonment and a fine of 30,000 euros, and by three years where the victim is also a minor. It is also made out where several people, in concert or knowingly, target the same victim, even if none of them acted repeatedly (Article 222-33-2-2 of the Criminal Code). Impersonation, that is the use of a third party’s name or of any data identifying them in order to disturb their peace or harm their honour, is punishable by one year’s imprisonment and a fine of 15,000 euros, including online (Article 226-4-1). A death threat that is repeated or made in writing is punishable by three years (Article 222-17). These offences are time-barred after six years.

Defamation and insults against a private individual fall under the Press Freedom Act of 29 July 1881: defamation is a criminal offence in France, punishable by a fine of 12,000 euros, or one year’s imprisonment where the statement is racist, sexist, homophobic or targets a disability. They are time-barred after three months, or one year for those discriminatory statements, from the first time the message was put online and not from the day the victim discovers it (Cass. crim., 11 June 2024, no 23-86.920).

The deadline does not wait for the author to be identified: the civil-party complaint, or a prosecutor’s investigation requisition characterising the statements, must be made within three months, even against a person unknown. The choice between defamation and insults, which are mutually exclusive, and its consequences are discussed in our analysis of online reputation attacks.

How to file a police report in France against a fake Instagram or Snapchat account: complaint against person unknown, dropped complaint, civil-party complaint

A complaint against a person unknown (“plainte contre X”) is filed at a police station, with the gendarmerie or in writing with the public prosecutor; judicial police officers are required to accept it (Article 15-3 of the Code of Criminal Procedure). So that the order can be issued without delay, it states the address (URL) of the profile and of each post, the account identifier and not merely the username, which the author can change, the dates and times of publication, the characterisation and the applicable provision. A report to the platform or to Pharos, the French government’s online reporting portal, is not a complaint.

A decision to take no further action does not close the case. The victim may file a civil-party complaint before the senior investigating judge, which sets the prosecution in motion. For online harassment, impersonation or threats, that complaint is admissible only after an ordinary complaint, followed by a dismissal or three months without a decision by the prosecutor (Article 85 of the Code of Criminal Procedure).

For defamation and insults, the civil-party complaint may be filed directly. It interrupts the limitation period if the deposit set by the judge is paid within the time allowed (Cass. crim., 30 March 2016, no 15-81.606), and it must set out and characterise each statement complained of and cite the applicable provision. The limitation period then runs again from each investigative or prosecution step.

The civil route remains open: under Article 145 of the Code of Civil Procedure, the judge, seised by ex parte application or in summary proceedings, may order the platform to disclose the author’s identification data, for example for an anonymous Google review. The e-Evidence Regulation, which applies only in criminal matters, lends it neither its ten-day deadline nor its penalties.

Online defamation or insults: the civil-party complaint must be filed within three months of the first publication. The firm drafts it, as well as complaints for online harassment, threats and impersonation, and follows it through to the hearing. Contact the firm →

Screenshots, bailiff’s report, data preservation: the evidence to gather

In French criminal matters, evidence is free (Article 427 of the Code of Criminal Procedure): a screenshot is admissible. A report by a commissaire de justice (bailiff) carries no greater weight, since in criminal matters its findings count only as information, but it records the address, the date and the content of each post, which an isolated screenshot does not guarantee. Both come before any report to the platform, which may lead to the removal of the content.

The e-Evidence Regulation covers only the data that the platform stores when it receives the certificate, and imposes no retention obligation. The first request is therefore preservation: the European Preservation Order freezes the data for sixty days, extendable by thirty, and may be issued for any offence.

In a judicial investigation, the civil party asks for it by a written, reasoned request for investigative steps naming the platform, the account identifier, the data sought and the period. An investigating judge who does not intend to grant it issues a reasoned order within one month, which may be appealed (Articles 82-1 and 186-1 of the Code of Criminal Procedure).

Before any report to the platform: the firm has the posts recorded by a commissaire de justice and requests the preservation of the account’s data. Contact the firm →

Frequently asked questions

Can the police track a deleted Instagram account or a Snapchat account?

It depends on what the platform still holds when it receives the order: the e-Evidence Regulation covers only the data stored at that date and imposes no retention. A preservation order issued quickly is the only safeguard the Regulation offers.

Can the police track an anonymous account that uses a VPN?

The IP address provided by the platform is then that of the VPN server, not that of the user. The investigation relies on the account’s other data: email address, phone number, logins made without a VPN and, where relevant, what the VPN provider retains.

Are screenshots admissible evidence in France?

Yes. In criminal matters, offences may be proved by any means. A bailiff’s report carries no greater weight, but it fixes the address, the date and the content of the posts.

Can French police refuse to take a complaint for online harassment or defamation?

No. Judicial police officers are required to accept complaints from victims, even where their station does not have territorial jurisdiction, and to provide a receipt stating the limitation periods.

Is defamation a crime in France, and what is the deadline to file a complaint?

Yes, public defamation is a criminal offence. The deadline is three months from the first time the message was put online, one year for discriminatory defamation or insults. An ordinary complaint does not interrupt it; a civil-party complaint does, provided the deposit is paid.

Does reporting to Pharos or to Instagram count as a police complaint?

No. A report to the platform may lead to the removal of the content, and Pharos may pass the facts on to an investigation service, but neither counts as a complaint or interrupts the limitation period.

What can a victim do when someone makes a fake Instagram or Facebook account in their name?

Have the profile recorded, then file a complaint for impersonation: this offence, punishable by one year’s imprisonment, allows the IP address of the account’s creator to be requisitioned. The report form offered by Instagram or Facebook may lead to the removal of the profile, not to the identity of its author.

Since 18 August 2026, identifying the author of an anonymous account no longer depends on the answer of a foreign State, but on three decisions taken in the first days: the characterisation, the precision of the complaint and the preservation request. Our analysis of digital evidence and the end of the Irish safe haven describes what the Regulation changes depending on the position occupied in the proceedings.