A Former Employee, an Agency, or a Stranger Controls Your Company's Social Media Handle. What Now?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

A company social media account held by a former employee, an agency, or a stranger can often be recovered, but the route depends on who holds it. Against an insider the issue is account ownership, and California law offers contract and computer access claims, with conversion less settled. (Pen. Code, § 502, subd. (e)(1).) Against a stranger using your name as a handle, the tools are platform trademark reports and, where customers are being confused, a trademark claim. Kolmogorov Law, P.C. handles these disputes in Orange County and Los Angeles.

Call (909) 235-6116 or contact us online to discuss a company account or brand handle you cannot get back.

Three problems that look alike

The first is the insider. A former employee, a marketing agency, or a co-founder set up or ran the account and now refuses to hand over the login.

The second is the stranger. Someone registered your brand as a username before you did. The account may sit empty, or it may be for sale.

The third is the impostor, an account that poses as your company to your customers. That situation moves faster and is covered on our page about business impersonation and fake websites.

The legal theories differ for each, so sort out which one you have before sending anything.

Who owns a company social media account

I know of no California statute that answers this directly. The answer comes from the contracts and the facts.

The facts that matter are ordinary ones. Who opened the account, and why? Whose email and phone number are attached to it? Was running it part of the person's job? Who paid for the content and the advertising? Did the account exist before the job began? Platform terms usually treat the registered user as the account holder, which is why the email on file carries so much weight.

One statute shapes the paperwork. An employer may not require or request that an employee disclose a username or password for personal social media. (Lab. Code, § 980, subd. (b).) That rule protects personal accounts. It leaves company accounts to contract and policy, so the line between the two should be drawn in writing before anyone leaves. Our departing employee checklist covers the handover.

Claims against a former employee or an agency

Contract comes first. An employment agreement, a social media policy, or an agency contract that requires the return of company property and credentials is the cleanest basis for relief.

Conversion is the second theory. The Ninth Circuit, applying California law, held that a domain name is intangible property that can be converted. (Kremen v. Cohen (9th Cir. 2003) 337 F.3d 1024, 1030, 1035.) Businesses make the same argument for social media accounts. At least one federal trial court in California has let such a claim go past the pleading stage without deciding who owned the account. The law is still developing, so I plead conversion alongside other claims and not alone.

The third is California's computer access statute. Its separate prohibitions include, when done knowingly and without permission, accessing a computer system, taking or using its data, and disrupting or denying computer services to an authorized user. (Pen. Code, § 502, subd. (c)(2), (5), (7).) An owner of data who suffers damage or loss may sue for compensatory damages and an injunction, and the court may award attorney fees. (Pen. Code, § 502, subd. (e)(1), (2).) That remedy belongs to the owner or lessee of the system or data, so ownership of the account is again the contested point. We pursue the civil remedy only. Permission that existed during the job can end with the job, which is why a written revocation matters. Our page on Penal Code 502 civil claims explains the limits.

The usual goal is a court order to turn over the login. Where the account is being misused, that can be sought through a temporary restraining order.

When a stranger holds your business handle

Registering a username is not, by itself, trademark infringement. The federal claim requires a use in commerce that is likely to confuse people about source or affiliation. (15 U.S.C. § 1125(a)(1)(A).) A dormant account with your name and no posts rarely qualifies. An account that uses your name and logo to sell to your customers usually does.

Owners often ask about the cybersquatting law. It is written for domain names, which the statute defines as designations registered with a domain name registrar or registry. (15 U.S.C. §§ 1125(d), 1127.) A handle on a platform is not registered that way, so it generally falls outside the definition. Federal courts in the Ninth Circuit have declined to treat a social media page address as a domain name. Our page on domain name disputes covers the statute where it does apply.

So the remedy for a squatted handle usually runs through the platform. Most large platforms accept trademark reports and have policies on impersonation and inactive accounts. A trademark registration usually makes those reports more effective.

What to do this week

• Preserve the evidence: dated screenshots of the profile and posts, and the emails that show who created the account.
• Secure what you still control, including linked ad accounts, connected pages, scheduling tools, and recovery contacts.
• File the platform's account recovery or trademark report.
• Send a written demand that revokes any permission to use the account and sets a short deadline.
• Do not guess the password or use an old logged-in device to seize an account whose ownership is contested. The computer access statute cuts both ways.

If you are the employee or agency holding the account

An account you opened for yourself before the job, in your own name, is probably yours even if you promoted your employer on it. An account opened for the business does not become yours because you know the password.

Holding a login as a bargaining chip over an unpaid invoice is risky. It invites the claims described above and an injunction motion. The safer course is usually to return the account and pursue the money separately.

What to bring to the first meeting

• Screenshots of the account and its history.
• The emails or records showing who created it and which address is on file.
• The employment agreement, policy, or agency contract.
• Any trademark registration, and messages exchanged with the person holding the account.

Frequently asked questions

A former employee still controls our company Instagram account and will not give us the password. What can we do?

Document that the account was created for the business, revoke the former employee's permission in writing, and use the platform's recovery process. If that fails, California law offers claims for breach of contract and for unauthorized access under Penal Code section 502, and sometimes conversion. A court can order the credentials turned over. Act quickly, because followers and content can be lost.

Who owns a company social media account?

Usually the party the account was created for. In a California dispute the evidence that tends to matter is who opened it, whose contact details are attached, whether managing it was a job duty, who paid for content, and what the contracts say. An account an employee built personally before the job is treated differently from one opened in the company's name as part of the work.

Someone registered my business name as a username and is not using it. Can I get the handle with my trademark?

Possibly through the platform, less likely through a lawsuit. A dormant account generally is not a use in commerce likely to cause confusion, which the federal Lanham Act requires. Most platforms have trademark and inactive-account policies, and a registered mark strengthens the request. The federal cybersquatting law covers domain names and generally does not reach platform usernames.

Is taking over a company social media account illegal in California?

It can be. California Penal Code section 502 separately prohibits, when done knowingly and without permission, accessing a computer system, taking or using its data, and denying computer services to an authorized user. It gives the injured owner of the system or data a civil action for damages and an injunction. Whether it applies depends on who owned the account and whether permission had ended.

Can my employer make me hand over a personal account that I used for work?

Generally not the login. Under California Labor Code section 980, an employer may not require or request an employee's username or password for personal social media. The harder question is whether the account is personal at all. If it was opened for the business, the employer may have a claim to it.

Talk to a California business litigation attorney

If your company's account or handle is in someone else's hands, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. Our IP litigation practice page describes the wider practice.

This page provides general information about California and federal law and is not legal advice. Outcomes depend on who created the account, the agreements in place, the platform's rules, and the court.