How to secure evidence from Instagram

What to capture on Instagram

Why Instagram evidence disappears so quickly

Instagram is built for content that moves fast. Stories expire after 24 hours. Authors can delete or edit captions, archive posts, hide or delete comments, switch the account to private or rename it. Instagram itself removes content after reports, and whole accounts can be suspended or deactivated.

For you, this means the post that damages your reputation, the fake profile using your photos or the shop that took your money may simply not exist anymore when your lawyer, the police or a court asks for proof. That is why the order matters: capture first, report second.

Typical Instagram situations where you need evidence

• Defamation, insults and harassment in posts, captions, comments, Stories or Reels, including pile-ons in the comments under your own posts.
• Fake or impersonation accounts that copy your name and photos, message your followers or ask them for money.
• Scam shops advertised through posts, Reels or sponsored ads that take payment and never deliver.
• Stolen photos, videos or designs reposted without permission, sometimes to sell counterfeit products.
• Influencer disputes: undisclosed advertising, a partner who breached a contract, or a creator who deleted agreed posts too early.
• Threats or harassment in direct messages, which are only visible inside your own account.

Someone is pretending to be you? Read our step-by-step guide for impersonation →

Your photos are used without permission? How to secure copyright evidence →

Identify the account properly: the @handle is not enough

On Instagram, the profile address is built from the username: instagram.com/username. The username can be changed by the account owner, and when it changes, the old profile link stops working and someone else can later take the old name. A screenshot showing only @fake_shop_123 may point to nobody a week later.

The links to individual posts and Reels are different. A post permalink like instagram.com/p/ followed by a short code keeps working even after the account renames itself, as long as the post exists. That makes it one of the most stable identifiers you can record.

• Copy the permalink of every relevant post, Reel and comment thread (three-dot menu, then Copy link).
• Capture the profile page with handle, display name, bio and profile photo.
• Open About this account in the profile menu, where Instagram may show the join date, the country the account is based in and former usernames. It is not available for every account, but when it is, capture it.
• Note any links in the bio, phone numbers, email addresses or payment details the account uses.

Stories and Reels: act within hours, not days

A Story is visible for 24 hours and then disappears from the profile, unless the author adds it to a Highlight or keeps it in a private archive only they can see. If a Story insults you, reveals private information or promotes a scam, you usually have a single day to capture it. After that, only Instagram and the author still have it, and getting it from Instagram requires a formal legal request.

• Capture every relevant Story frame separately, with the account name and the time label visible.
• If the Story is a video, record it with sound; a single frame may not show the full statement.
• Check the profile for Highlights; old Stories are sometimes kept there and can be deleted at any time.
• For Reels, capture the Reel page with its permalink, caption, author and the comments, not just the video.

Comments and direct messages

Comments load gradually. Under a busy post you first see only a few; the rest appear under View all comments and View replies. A capture that does not show the offending comment, its author and its date in context is weak evidence. Expand the full thread first, then capture, and capture the post itself as well, so it is clear what the comment responds to.

Direct messages are private and can only be seen inside your own account. No outside service can open them from a link. Capture the conversation in your own logged-in browser, scroll to the beginning of the relevant part, and make sure the other party’s name and profile are visible. You can also request a copy of your data from Instagram in the Accounts Centre as a backup, but it is not a substitute for a timestamped capture of what you saw.

Why a screenshot is weak evidence in court

A phone screenshot is the most common Instagram evidence, and also the easiest to attack. It is an image file that anyone can edit in minutes. It usually shows no URL, no exact date of capture and no proof that the content really came from instagram.com. If the other side says the screenshot was faked or taken out of context, you have little to answer with, especially if the post has meanwhile been deleted.

Courts in the EU assess evidence freely, so a screenshot is not automatically rejected. But the more serious the case, the more it helps to have evidence that shows the source, the exact time and that nothing was changed since.

Why screenshots are not enough, and what courts look for instead →

How to capture Instagram content properly

A forensic capture records the page as it was delivered: a full-page screenshot, the HTML source, the network log and metadata, sealed with SHA-256 hashes, an eIDAS qualified timestamp from an EU-accredited trust service provider and a Bitcoin anchor. Anyone can verify later that the files have not been altered since that moment.

Because Instagram often shows a login prompt to visitors who are not signed in, many posts, Stories and all DMs cannot be captured reliably from a link on a server. For those, GetProofAnchor’s browser widget, available on subscription plans, captures exactly what you see in your own logged-in browser. Clearly public pages, such as a scam shop’s website linked from Instagram, can be captured from the URL in the web app, or by our Assisted Capture team.

1. Open the post, Reel, Story or conversation in your own browser while logged in to your own account.
2. Expand all comments and replies, and play or pause the video at the relevant point.
3. Start the capture with the browser widget and repeat it for the profile, About this account and any linked website.
4. Save the Evidence ZIP and PDF report, unchanged, in at least two places.
5. Only then report, block or send a legal letter.

How the browser widget captures logged-in content →

Brands and influencer disputes

For businesses, Instagram evidence is often about money rather than insults: a creator who posted fewer pieces than agreed or deleted them early, a competitor promoting products without disclosing a paid partnership, or a counterfeit shop using your brand and product photos. Undisclosed advertising is prohibited under EU consumer protection law, and national authorities can act on it, but only if someone can show what was posted and when.

• Capture the sponsored post with the caption, hashtags and whether a Paid partnership label is shown.
• Capture posts on the agreed publication dates, and again later, to prove how long they stayed online.
• For recurring checks of a public website linked from Instagram, scheduled monitoring captures the page automatically and alerts you when it changes.

Evidence workflows for brand protection teams →

Reporting: Instagram, the DSA and the police

Once your evidence is secured, report. Every post, comment, Story, Reel, message and account has a Report option in its menu. For impersonation, Instagram also offers a separate form in its Help Centre that people without an Instagram account can use. Keep the confirmation and any reference numbers you receive.

If the content is illegal and not just against the rules, for example defamation, threats or a fraudulent shop, you can also send a notice of illegal content under Article 16 of the EU Digital Services Act. The notice should explain why the content is illegal, include the exact URLs and contain your name and email address. Instagram must process it and inform you of its decision, and you can challenge that decision.

How a DSA Article 16 notice works, and what evidence to attach →

For threats, extortion, stalking, fraud or serious defamation, file a criminal complaint with the police and bring your evidence on a USB stick or as a download link, together with the printed PDF report. Mention whether the content is still online. The police can request account data from Meta, which can connect a fake account to a real person.

Frequently asked questions

This article is general information, not legal advice. Rules on defamation, harassment and deadlines differ between countries; for a specific case, consult a lawyer or the police.