Right to digital identity

What it is

The right to digital identity is the right to be protected from online impersonation, that is when someone:

• creates fake accounts using your name, photos or data;
• pretends to be you on social media, by email or on websites;
• uses your identity for unlawful, harmful or fraudulent purposes.

Impersonation (Art. 494 Criminal Code)

It is a crime when someone:

• assumes a false name or a false status;
• passes themselves off as someone else;
• with the possibility of causing harm, even just potential.

Online, it occurs when someone:

• creates a social media profile with your name or photos;
• sends emails pretending to be you;
• comments or posts pretending to be you;
• uses your credentials to access your accounts.

How it differs from identity theft

Identity theft:

• use of forged documents or personal data for financial fraud;
• typically: credit cards, bank accounts, contracts.

Online impersonation:

• creation of fake accounts or profiles;
• impersonation on social media or by email;
• reputational damage, not always financial.

The most common cases

Fake social media accounts

Facebook and Instagram. Someone creates a “John Doe” profile:

• using your photos, taken from your real profile;
• with the same or a very similar name;
• in order to pass themselves off as you.

Typical purposes:

• damaging your reputation by posting offensive content;
• scamming your contacts by asking for money in your name;
• harassing other people using your name;
• spreading disinformation.

X (Twitter): tweets in your name, offensive opinions attributed to you, interactions with others pretending to be you.

LinkedIn. Particularly damaging, because:

• it hits your professional life;
• it allows contacting colleagues and recruiters as if it were you;
• it damages your professional reputation.

TikTok and YouTube: videos published in your name, offensive comments using your identity.

Fake email accounts

An address similar to yours is created:

• yours: john.doe@gmail.com;
• the fake one: johndoe@gmail.com or john.d0e@gmail.com.

It is then used to:

• write to your contacts pretending to be you;
• run scams (requests for money);
• send spam or phishing in your name.

Fake websites and blogs

• Blogs in your name with content you never wrote.
• Websites attributing to you activities you never carried out.
• Fake professional profiles (lawyer, doctor, consultant).

Fake reviews and comments

• Negative reviews on Google or TripAdvisor signed with your name.
• Offensive comments on forums or blogs using your identity.
• Posts on Reddit or other communities pretending to be you.

Account takeover (hacking)

Unauthorised access (Art. 615-ter Criminal Code): a hacker gets into your real account, posts content in your name, changes the password (locking you out) and uses the account for unlawful purposes.

It is a double offence:

• unauthorised access to a computer system (Art. 615-ter);
• impersonation (Art. 494), if they pass themselves off as you.

Video and audio deepfakes

• Video deepfakes: your face on someone else’s body.
• Audio deepfakes: your voice saying things you never said.
• Spread as if it really were you.

It is particularly serious when offensive or illegal content is attributed to you, or when your personal or professional reputation is damaged.

Why people impersonate others

To damage your reputation

• Posting offensive, racist or violent content in your name.
• Picking fights with people while pretending to be you.
• Spreading false news attributed to you.

To defraud (combined with Art. 640 Criminal Code)

• Asking your friends or family for money while pretending to be you.
• Selling non-existent products using your identity.
• Running fraudulent fundraisers in your name.

To harass

• Using your identity to harass other people.
• Sending inappropriate messages in your name.
• Putting you in embarrassing situations.

To sabotage your career

• Sending offensive emails to colleagues pretending to be you.
• Damaging your professional relationships.
• Ruining your career opportunities.

When it does not apply

Legitimate namesakes

• Someone else lawfully has the same name as you.
• They do not use your photos or pretend to be you specifically.
• The account is clearly distinct.

Obvious parody or satire

• A parody account clearly labelled as such (for example “@JohnDoeParody”).
• Obviously satirical content.
• Not credible as the real you.

Fan pages

• A fan page dedicated to you, if you are a public figure.
• Clearly labelled as a “fan page” or “unofficial”.
• It does not pretend to be you.