Impersonation Takedowns — How Evidence Is Handled

Effective: 22 May 2026.

1. Context

The KnytX impersonation scanner (Pro tier and above) and the Vigil daily scan (Executive tier) discover social-media profiles that may be impersonating you. For each candidate the dashboard asks “Is this you?” with two buttons: This is me and Not me.

When you click “Not me”, you are telling us that the profile is an impersonator. That click triggers two things. First, we file a takedown report with the relevant platform on your behalf. Second, we retain a small evidence package about the impersonator, who is themselves a third party with data-protection rights.

This page explains how we balance your right not to be impersonated against the impersonator’s data-protection rights, and what specifically we store and for how long.

2. What we collect about the impersonator

When you confirm an impersonation, we snapshot the following from public sources only:

• The platform (Instagram, Facebook, Twitter/X, TikTok, LinkedIn, etc.)
• The profile URL (the public link to the impersonating account)
• The screen name / handle as shown on the platform
• The display name and bio (where publicly visible)
• The profile photo as it appeared at the time of detection (we store a hash and a low-resolution snapshot)
• The face-similarity and name-similarity scores our scanner computed
• The date and time of detection
• The date and time you confirmed “Not me”
• The takedown channel we used and the platform’s response

We do not collect:

• The impersonator’s posts beyond the bio
• The impersonator’s followers, friends, or social graph
• Any private data, login data, or anything behind authentication
• IP addresses, device fingerprints, or any data we could not see by visiting the public profile URL
• Real-name identification of the impersonator unless they have themselves published it on the profile

The snapshot exists for one reason. If the platform requires evidence, or the impersonator changes their profile after we report it, you can still show what the impersonating profile looked like at the time of detection.

3. Lawful basis for processing the impersonator’s data

In short: the impersonator has data-protection rights too. We rely on legitimate interest (your right not to be impersonated), we ran the balancing test, and we collect only what the takedown report needs.

The impersonator is a data subject under GDPR, UK GDPR, DPDPA, and other regimes. Those regimes protect data about identified or identifiable natural persons, regardless of whether the person is using their real name.

We process their public profile information under:

• GDPR Article 6(1)(f) — legitimate interest. The legitimate interest is your right not to be impersonated and the public interest in deterring identity fraud. We have conducted the three-part balancing test (purpose, necessity, balancing) and documented it in our DPIA. Protecting a real person from impersonation outweighs the impersonator’s interest in keeping a public deceptive profile up. And we collect only what the takedown report needs. The full cross-regime legal basis for our impersonation-defense activities is set out in the legal framework matrix.
• GDPR Article 9 — not invoked. We do not collect special-category data about the impersonator. The biometric comparison runs on your enrolled embedding against a publicly visible profile photo. The impersonator’s biometric data is not separately stored — only the similarity score and a snapshot of the public photo, both minimum-necessary for the takedown.
• DPDPA, 2023 §7 — voluntarily-disclosed publicly-available personal data of the impersonator, processed for a specified legitimate purpose (defending the Data Principal against impersonation).
• California CCPA — the impersonator may or may not be a California resident; processing of publicly-available information under the Act’s public-records / publicly-available carve-outs.

Sometimes a flagged profile turns out to be a legitimate look-alike — someone who happens to share your name and resemble you, but is not actually impersonating you. In that case the legitimate-interest balance shifts. We will, on the look-alike’s request, delete the snapshot and remove the takedown report from our system.

4. The takedown report

The takedown report we file with the platform contains:

• A statement that you (named) consider the profile to be impersonating you
• The URL of the impersonating profile
• The URL of your verified profile on the same platform, if any
• The similarity scores and a brief technical summary in plain English
• A sworn statement (some platform impersonation flows require one)
• KnytX’s identification as your authorised agent for the purpose of filing the report

Each platform has its own report endpoint:

• Instagram: Help Centre impersonation form
• Facebook: Help Centre impersonation form
• Twitter / X: Impersonation report form
• LinkedIn: Trust and safety report
• TikTok: Trust and safety report

We file through the platform’s own channels. We do not file under DMCA §512 unless the impersonation also involves copyright infringement — for example, the impersonator using your copyrighted photos. DMCA was designed for copyright, not for identity. Misusing DMCA notices is a federal cause of action, and we will not file them improperly.

5. Counter-notices and contested takedowns

If an impersonator contests the takedown — which they sometimes do, particularly on platforms that allow appeals — we surface the contest in your dashboard and stop. We do not:

• File a second report claiming the contest is fraudulent
• Threaten the impersonator or the platform
• Pursue litigation on your behalf

What we will do, if you ask:

• Provide you with the full evidence package we retained
• Refer you to relevant supervisory authorities (the EDPB has guidance; the California AG has an impersonation-and-identity-theft channel; the FTC accepts identity-theft reports)
• Refer you to attorneys who specialise in online impersonation in your jurisdiction. We do not maintain a referral business, so we give you a list of resources, not a single recommendation.

The line between an aggressive impersonator and a contested look-alike claim is genuinely hard; we are not going to pretend it is not. KnytX defaults to caution: we will not escalate without your fresh instruction.

6. Retention

In short: we keep full evidence only while the takedown is live. After it closes, we cut back to a minimal record (URL, date, outcome), and you can ask us to delete evidence sooner.

Minimised records contain only what is necessary to demonstrate, in a future audit or dispute, that a takedown was filed on a specified date and what the outcome was. The impersonator’s name, photo, and bio are removed at minimisation time.

You can request earlier deletion of evidence at any time. We will honour the request unless the matter is currently contested.

7. Your access and the impersonator’s access

In short: you can download your full evidence package any time. If the impersonator asks what we hold, we tell them the categories and basis, but we do not reveal who reported them unless the law forces it.

Your access. You can download the full evidence package for any takedown from your KnytX dashboard. The package includes everything in Section 2 plus the report we filed and any platform response.

The impersonator’s access. If the impersonator is identifiable and submits a verifiable data-subject access request to legal@knytx.com, we will:

1. Verify the request to the extent reasonably possible without further infringing on you.
2. Respond with the categories of data we hold about them, the lawful basis, the recipient (the platform we reported to), and the retention period.
3. Decline to name the person who reported them, unless a valid legal process compels it. Naming the reporter would risk further harm to the data subject who was being impersonated.
4. Refer disputes to the relevant supervisory authority where we and the impersonator cannot agree.

This balance — disclosing the existence and categories of processing, declining to disclose the reporter — is consistent with EDPB guidance on conflicting data-subject rights.

8. What this is not

• It is not defamation work. If you believe the impersonator has defamed you, you need an attorney.
• It is not criminal complaint work. If the impersonator’s conduct rises to fraud, harassment, or stalking, file with law enforcement; we can help you compile the evidence package, but we cannot file on your behalf.
• It is not litigation. KnytX does not sue impersonators.

9. Questions

Impersonation-evidence questions: legal@knytx.com, subject line “Impersonation Takedown”. Active impersonation in progress: security@knytx.com for emergency triage during business hours.