Discovering that someone has created a fake social media profile using your name or photos is a deeply unsettling experience. The four major platforms—Instagram, Facebook, TikTok, and X—explicitly prohibit impersonation and provide dedicated reporting channels, with three of them allowing reports even without an account. In Spain, creating a fake profile with another person’s image can constitute a criminal offense if it causes harassment, stalking, or humiliation, as expressly covered by Article 172 ter of the Criminal Code since October 2022. If the profile distributes intimate or violent images, the Spanish Data Protection Agency (AEPD) offers a channel for urgent removal requests.
- Preserve evidence first: Take screenshots of the profile, its posts, and any messages, and record the username, profile URL, and date before reporting.
- Report on every platform: Each network has its own impersonation reporting flow, and most allow reports without an account.
- Know your legal options: Spain’s Article 172 ter.5 specifically criminalizes opening fake profiles that cause harassment, with penalties of three months to one year in prison or a fine.
- Urgent removal for intimate content: The AEPD’s priority channel can request immediate takedown of sexual or violent content.
Document Everything Before You Report
Before filing any complaint, capture screenshots of the profile, its publications, and any messages it has sent. Record three key details: the username, the profile URL, and the date. This is not optional. Instagram explains that without these three data points, it cannot identify an account when requested by a court. If the profile disappears after your report—or its creator deletes it—those screenshots will be your only evidence for a police complaint.
It is also wise to alert your contacts that the profile is not you. This is the fastest way to cut off a potential scam while the platform reviews the case. A fake profile that merely copies your photos today could be asking your contacts for money tomorrow, and removal becomes harder the longer it stays up.
How to Report on Each Network
Instagram and Threads
According to Instagram’s help center, the in-app process is straightforward: go to the impostor profile, tap Options next to the username, tap Report, then Report account, and select Pretending to be someone else. The report is anonymous—the reported account does not know who filed it. If you do not have an Instagram or Threads account, or if the impersonation targets someone you legally represent (such as your child), Instagram directs you to a Meta contact form. Note one limitation: the platform only allows reporting an account for impersonating someone, not for misrepresenting its own identity.
On Facebook, go to the profile, click Options under the cover photo, select Report profile, and follow the prompts. For pages, the path is the same with Report page. If you lack an account or have lost access, a contact form is available.
TikTok
TikTok’s guidance on impersonation accounts outlines these in-app steps: open the profile, tap Share, then Report, Report account, Impersonation, and finally Me if you are the victim. Outside the US, you can also use its web form: under Topic, select “Report a potential violation”; under Category, “Account violation”; and under Reason for report, “Impersonation.” If the impersonation involves intimate images or sexual deepfakes, TikTok requests reporting that conduct through a separate web form.
X
According to X’s help center, you or your authorized representative can report via its impersonation form, and you do not need an X account to do so. If someone else is being impersonated, you can flag it as a “non-affected party” from the profile.
What Spanish Law Says
Two articles of the Criminal Code apply to this scenario, and they should not be confused. The most specific is Article 172 ter.5, added by Organic Law 10/2022 with effect from October 7, 2022. It punishes anyone who, without consent, “uses a person’s image to place advertisements or open fake profiles on social networks, contact pages, or any public dissemination medium, causing that person a situation of harassment, stalking, or humiliation.” The penalty is three months to one year in prison or a fine of six to twelve months, imposed in its upper half if the victim is a minor or has a disability.
The classic provision is Article 401: “Anyone who usurps another’s civil status shall be punished with six months to three years in prison.” In practice, Article 172 ter.5 describes the typical fake profile far better because it focuses on the image and the harm caused. Ultimately, whether a specific act is a crime and which provision fits is for a judge to decide, not a guide. That is what the police report is for, filed with the evidence you have preserved.
Beyond criminal law, your photos and name are personal data. The GDPR grants you the right to erasure, which the AEPD summarizes: you can request deletion of your data when, among other cases, it has been processed unlawfully or you withdraw the consent on which its use was based. This right is not unlimited and yields to freedom of expression and information, for example. If you also want to know what data a platform holds about you, the same regulation lets you request it via the GDPR right of access.
One practical note on data platforms can provide: Instagram warns that it only discloses basic subscriber information (never content) when it receives a valid court order or subpoena directed at the appropriate entity for your residence, such as Meta Platforms Ireland Limited. If you want to know who is behind the profile, the judicial route is the way.
Urgent Removal for Intimate or Violent Content
When a fake profile distributes photographs, videos, or audio of a sexual or violent nature, the AEPD operates a priority channel. It allows requesting immediate removal of content whose unlawful dissemination “poses a serious risk to the rights and freedoms or the physical and/or mental health of the affected persons.” Minors aged 14 to 17 can also use it, and the Agency invites anyone under 18 to contact it.
If profiles use your face in AI-generated montages, it helps to understand how video, voice, and image deepfakes are detected, especially to explain to others that it is not you. For immediate guidance—particularly if the profile is already scamming your contacts—there is the 017 line from INCIBE: free, confidential, and offering technical, psychosocial, and legal advice from 8:00 to 23:00 every day of the year. It also responds via WhatsApp at 900 116 117.
Platforms have improved their reporting forms, but they still place the burden on the victim: you must find the profile, document it, report it separately on each network, and wait. The Criminal Code moved faster than they did in naming the problem in 2022. Until that changes, the sequence that works best is the one in this guide: evidence, platform report, warning to your contacts, and, if there is harm, a police complaint. And do not let anyone convince you it is “just the internet.”