The curious case of Manti Te'o, his fake online girlfriend and a band of alleged hoaxers has brought a new question to the forefront: just what kind of crime is posing as someone else online, if it’s a crime at all?

Nuccio DiNuzzo / Chicago Tribune/ MCT via Getty Images Notre Dame linebacker Manti Te'o says he was the victim of an elaborate hoax that involved a fake online girlfriend. However, it's unclear whether Te'o's alleged hoaxers will face criminal charges.

If you’ve been following the increasingly convoluted saga of Notre Dame football star Manti Te’o and his fake girlfriend, Lennay Kekua, chances are it’s made you think twice about the interactions you have with people on the Internet. Te’o gained the admiration of football fans nationwide after revealing that his grandmother and girlfriend died within 24 hours of each other in September. Last week, after Deadspin published an article proving that Kekua wasn’t real, he claimed he was the victim of an elaborate hoax that was only possible because he and his beloved had a relationship that took place mostly online.

Looking beyond the heavily dissected interviews and nonstop jokes on Twitter, the Te’o saga has brought a new question to the forefront: just what kind of crime is posing as someone else online, if it’s a crime at all? It’s a challenging issue that state legislatures and courts have been quietly started grappling with in recent years, and there’s a growing consensus that masquerading as someone else on Facebook, Twitter or through email is no laughing matter—do it with just enough malice and you could wind up behind bars.

In New York and California, online impersonation is a misdemeanor punishable by thousands of dollars in fines and up to a year in jail. In Texas, the crime is a third-degree felony that could land perpetrators up to ten years in prison. The Arizona legislature is currently considering a bill almost as severe as Texas’s law. In total at least nine states have an online impersonation law on the books or are currently considering one. Even if the impersonation involves a fake persona, the use of any real names, business or photography could cross the legal threshold.

(MORE: Te’o to Be Interviewed by Katie Couric)

The wave of laws was sparked by the 2006 suicide of Megan Meier, a 13-year-old Missouri girl who entered an online relationship with teenager Josh Evans on MySpace. Meier hanged herself after he sent her a message saying that the world would be better without her. “Josh” was actually a fake account managed by a teenage girl and her mother, but no Missouri laws addressed online harassment at the time. State lawmakers soon updated their laws on child stalking and harassment to include online channels such as social media. While Missouri focused specifically on cyberbullying, other states broadened the scope of their laws to address online impersonation of adults as well.

“Unfortunately, people take advantage of any technology they can these days to hurt other people,” says John Brewer, an assistant district attorney in Harris County, Texas who has worked on identity theft cases for 20 years. “If one can live their life online and another person can come and hurt them online, then having these types of statutes does have value.”

While identity theft laws generally punish criminals for stealing someone’s money or financial information, online impersonation laws are aimed at protecting a person’s good name and preventing harassment. Brewer says he’s seen an uptick in cases in the past year, though the number is still small. Typically, the perpetrator knows the victim—it might be a frustrated ex-husband who wants to embarrass his former spouse by taking over her Facebook account or a recently fired employee who tries to sink a company by posing as the boss through email. In July two middle school girls were arrested on felony charges in Hood County, Texas for threatening other students with a Facebook page created under a classmate’s name. Last week a woman was arrested on the same charge in Denton, Texas for hacking into the Goodreads account of her boyfriend’s ex and making a bogus Facebook page in her name.

(MORE: When Colleges Look Up Applicants on Facebook: The Unspoken New Admissions Test)

In all of the state statutes, the key element that elevates social media shenanigans from the level of a simple prank to a punishable crime is the intent to do harm, threaten, intimidate or defraud another person. However, defining harm is a tricky proposition for the justice system.

“There are many kinds of harm,” says Joe Simitian, a former California state senator who drafted that state’s online impersonation law. “Emotional distress is a harm. Financial damage is a harm. When someone both steals your identity and damages your reputation, there ought to be consequences.”

Prosecutors acknowledge that the difference between being a jerk and a felon online can be tough to distinguish. “It doesn’t apply to every instance of somebody impersonating someone online,” says John Lopez, an assistant district attorney in Travis County, Texas. “If their goal is to annoy or embarrass, that may not necessarily fit the way the statute is.”

Some digital rights activists fear that the ambiguity baked into these laws could limit free speech online. Theoretically, law enforcement officials could target things like parody Twitter accounts, which are a form of online impersonation often used for satire and social commentary. “The concern is it gives a lot of discretion to law enforcement to go after First Amendment activity,” says Matt Zimmerman, an attorney for the Electronic Frontier Foundation. “The resulting consequence of that is that people will feel chilled and intimidated and hence decide to not engage in perfectly legitimate forms of social protest because they’re worried that not only might they be sued, but they could actually go to jail.”

The California law states that the impersonation must seem credible to a reasonable person to rise to the level of criminal activity, which Simitian says ensures that satirical free speech will remain safe. But with online hoaxes becoming more common and more sophisticated as a form of political activism (remember the fake Shell PR campaign for arctic drilling that was actually organized by Greenpeace?), Zimmerman worries that online impersonation laws could give powerful entities another weapon in trying to stamp out forms of protest. He says in many states current laws on fraud and identity theft should suffice to protect people from having their online lives hijacked.

The emerging laws would seem to dovetail nicely with the desires of social media companies, as they essentially criminalize activities that are already violations of many social networks’ terms of service. Facebook has specific guidelines for what to do if you suddenly find your digital doppelganger prowling the site or believe a friend has had their account hacked. However, the company declined to comment for this article.

(MORE: How Manti Te’o Could Have Fallen in Love With Someone He Never Met)

As for Te’o, lawyers doubt that his alleged hoaxer would face criminal charges as an online impersonator. To charge someone with the crime, most states require that the hoaxer mimic an actual person—Kekua, Te’o’s girlfirend, was fictitious, though an actual woman’s photos were used without her consent to represent Kekua. It’s also hard to distinguish between the harm caused by the hoax and the harm Te’o brought on himself by embellishing his online relationship in media interviews and continuing to propagate the lie after he discovered the truth in December.

“Harm is the weak link there,” Brewer says of the Te’o situation. “Is there some way to show that this prank is somehow going to disadvantage Mr. Te’o in the upcoming NFL draft? That would be something you’d want to establish firmly as a prosecutor before you filed a case hypothetically in this type of scenario.”

Te’o now claims that his acquaintance Roniah Tuiasosopo has confessed to organizing the hoax. According to Deadspin, Tuiasosopo resides in California, so it’s possible the impersonation law there may be put to the test. It will likely take a high-profile case that rises to higher courts to provide some clarity for a law that no one seems quite sure how to enforce yet.

“The laws over the years in the real world have adjusted,” Brewer says. “They’ve been clarified, they’ve been changed. We’re going to have to go through that same progression when we talk about cyberlaws.”