Also, forgive me for asking, but why would you want to do this in Production at all?
The only person(s) that should have this capability are surely the Admins and then sparingly.
Impersonation is useful for checking out an update but it also has impacts such as updating their ‘last seen’ stats.
From a legal perspective, the admin is probably an agent or the owner of the company running the website. They have licence to view the data as part of their role. Giving people without such licence the ability to see people’s private information is almost certainly a GDPR issue? I think for some jurisdictions this would be a non-starter.