Meta Platforms Ireland Limited lost a case before the Frankfurt Regional Court on September 16, 2026, in which the court ordered the operator of Facebook and Instagram to stop distributing third-party ads and profiles that impersonate the financial education brand Finanzfluss and its co-founder Thomas Kehl, to hand over data on the reach and revenue of those fakes, and to pay damages. The 6th Civil Chamber held that Meta cannot shelter behind the hosting exemption in the Digital Services Act because its ad auction and its feed algorithms give it control over what users see. Each future violation can be punished with an administrative fine of up to 250,000 euros. The judgment, case number 2-06 O 234/25, is not final.

In Short

A German court said Meta is responsible for fake ads on Facebook and Instagram that used a well-known finance creator's face and brand to lure people into investment scams. The reason is that Meta's own systems decide which ads and posts each person sees, so the court treated Meta as more than a neutral storage service. If more fake ads of this kind appear, the creator can go straight back to court, and Meta can be fined up to 250,000 euros each time.

What the court ordered

The judgment runs to 49 pages and was pronounced after an oral hearing on June 3, 2026. Its operative part contains five orders against Meta, and the detail matters because the popular summaries circulating since the verdict compress several of them together.

The first two orders are injunctions. Meta must refrain, without consent, from publishing or distributing third-party content on Facebook or Instagram that contains images of Thomas Kehl or the sign "FINANZFLUSS", whether written literally or in a modified spelling, where that content does not come from the company. A parallel injunction protects Kehl personally against third-party content carrying his likeness or his name "Thomas Kehl", written literally or in substance. Both injunctions are tied to specific examples in the court file, numbered as annexes K22 through K33, and to what the court called core-identical variations of them. During the hearing, the plaintiffs clarified that added digits such as "finanzfluss499" and special characters such as "finanz_fluss" or "thomas_kehl" fall inside the scope. For each violation, the court can set an administrative fine of up to 250,000 euros, and where that cannot be collected, coercive detention of up to six months, enforced against Meta's legal representatives.

The third order is an information claim. Meta must provide the plaintiffs with an ordered list, sorted by URL, of the extent to which the infringing content and content of the same meaning was distributed, accessed or made publicly available on Facebook and Instagram, together with the total number of views for each item and the revenue Meta earned from it. Because Finflow GmbH, the company behind Finanzfluss, is less than ten years old and damages claims in Germany become time-barred after ten years, the court imposed no time limit on this disclosure.

The fourth order declares Meta liable in principle. The company must compensate both plaintiffs for damage that has arisen or will arise from the distribution of the infringing content, including through further sharing by third parties. Kehl is additionally entitled to monetary compensation for non-material harm, with the amount left to the discretion of the court. The fifth order requires Meta to pay 3,568.81 euros in pre-trial legal fees plus statutory interest.

Not every claim succeeded. The court dismissed the abstract, broadly worded parts of the injunction requests as insufficiently specific, keeping only the portions linked to concrete examples. It rejected Finflow's copyright claim entirely. One trademark-based request was declared inadmissible because a reformulated neighbouring request already covered it. On costs, Finflow bears 10 percent of court costs and Meta 90 percent. The court also set the value in dispute at 300,000 euros, higher than the plaintiffs had proposed, citing the number of infringements and the plaintiffs' public profile.

One small inconsistency appears in the text itself. The operative part awards interest from July 26, 2026, while the statement of facts records that the complaint was served no later than July 25, 2025, and the plaintiffs had requested interest from the date the claim became pending. The document does not explain the one-year gap.

Why the hosting exemption did not apply

The most consequential part of the judgment concerns liability rather than the fake ads themselves. Under Article 6 of the Digital Services Act, a hosting provider is not liable for information stored at a user's request, provided it has no actual knowledge of illegal content and acts expeditiously once it gains that knowledge. Meta argued that it is a neutral hosting provider that merely supplies technical infrastructure and automated tools, with responsibility for content, targeting and placement lying with the user.

The Frankfurt chamber rejected that characterisation, relying on the Court of Justice of the European Union's Grand Chamber judgment in Joined Cases C-188/24 and C-190/24, known as Webgroup and Coyote. PPC Land covered that ruling when the CJEU held that platforms using algorithms to determine distribution conditions exercise control over content and cannot claim hosting protection under Article 14 of the e-Commerce Directive. The case was mostly about age verification on adult websites. Its paragraphs on hosting liability were a secondary finding, and the Frankfurt court is the first German court to apply them to a social network, according to Spirit Legal, the Leipzig law firm that represented Finflow and Kehl.

The chamber's reasoning follows the CJEU's structure closely. Knowledge and control are treated as two alternative and independent conditions. A provider that controls stored information loses the exemption even if automation means it has no knowledge of that information. Control, in the CJEU's formulation that the Frankfurt judges cite at paragraph 112, exists where an algorithm goes beyond mere categorisation and indexing and determines, in the operator's interest, under what conditions, in what way and in what order information is distributed or not. The chamber held that this reasoning transfers to Article 6 of the DSA, because Article 14 of the e-Commerce Directive is its predecessor provision.

The ad auction

For paid ads, the court worked from Meta's own description of its system. According to the judgment, Meta explained that an automated auction decides on the ranking and timing of ads created and approved by advertisers, and that a third auction component, a so-called quality score, uses automated pattern recognition to identify factors such as the amount of text in an ad image, sensational language or engagement baiting. Meta characterised this as a purely formal check serving user experience, with no qualitative assessment of reliability or accuracy, and said the advertiser decides who sees an ad by selecting a target audience.

The chamber drew the opposite conclusion from the same facts. "Merely by conducting such an 'auction' according to criteria set by the defendant, the defendant exercises a control and decision-making function over the advertisements that is superior to that of the individual advertiser," the judgment states, in a translation of the German original. Audience selection by the advertiser does not change the fact that Meta ultimately decides, even if automatically, on which specific users' screens an ad appears. Bids work the same way: an advertiser cannot know when submitting a bid whether it will win, since the outcome depends not only on competing bids but on the auction algorithm Meta has built.

The feed

For organic posts and fake profiles, the court found that it is undisputed and a matter of judicial notice that Meta steers the delivery of user content into other users' feeds through algorithms. The uploader decides to publish, but Meta's ranking algorithm decides, according to rules Meta wrote, in which feeds and at what times the content appears. In both cases, Meta also acts in its own interest: ads generate revenue directly, while algorithmic feeds pursue higher interaction rates, which in turn raise reach and advertising effectiveness.

Meta advanced several counterarguments, and the judgment addresses each. The company pointed to Recital 22 of the DSA, which says recommending information based on user profiles or preferences does not create knowledge of content. The court answered that the recital concerns knowledge only, and the CJEU has held that control is a separate ground. Meta also argued that the CJEU tied control solely to whether a provider decides if information is distributed at all. The chamber read paragraph 112 of Webgroup and Coyote differently, adding that Meta in any case decides the "whether" at the level of each individual user. A third argument, that the CJEU had simply followed the Advocate General's opinion of September 18, 2025, limiting the loss of protection to services that create their own new body of information, failed because the Grand Chamber did not adopt that point.

Where the line falls

The chamber stressed that its reading does not remove all social media services from the exemption. Services that leave the selection of displayed content essentially to users, such as classic online forums or purely chronological feeds, probably do not exercise control. The judgment names Twitter in its original form, Mastodon and Bluesky as examples of chronological models. It also suggests that algorithmically filtering out fake profiles, spam and infringing material would likely not amount to control, because such filtering serves users rather than the operator's commercial interest.

"It therefore ultimately remains up to the service provider whether, out of its own interests, it decides by means of algorithms on the conditions for displaying content and thereby assumes control over the content and, as a result, also responsibility for the content it delivers," the judgment reads, again in translation.

The chamber also placed the shift in historical context. German liability doctrine for intermediaries was built largely around file hosts, auction platforms and search engines that did not algorithmically intervene in what users saw, it noted. What has changed, according to the court, is the business model of the services under review, which now rely more heavily on advertising and interaction and use algorithms to bind users to the service.

A fallback finding on removal speed

The court did not rest its decision on the control theory alone. It added that even if Meta could invoke Article 6, it would still be liable as an indirect disturber, a German legal concept for parties who contribute to an infringement by breaching duties of care, because it failed to act expeditiously once it had knowledge.

Here the chamber drew on a ruling of the Munich Higher Regional Court dated January 20, 2026, case 18 U 2360/25, which held that a social network notified of a fake account must remove not only the reported profile but also future identical or core-identical fake accounts appearing under a different web address, without the affected person having to complain again. Earlier decisions of the Frankfurt Higher Regional Court and the Nuremberg Higher Regional Court were cited to the same effect.

Meta argued that the plaintiffs' notices did not meet the requirements of Article 16 of the DSA, because they lacked precise URLs, did not name the protected works and did not include a statement of accuracy and completeness. The court acknowledged that Article 16(2)(b) calls for precise electronic locations, but held the point irrelevant. Meta had found and deleted the reported items, which proved it had knowledge. According to the judgment, Article 16(3) says compliant notices give rise to knowledge, but that does not mean knowledge depends on compliance: any form of knowledge suffices to trigger the removal duty.

The burden then shifted to Meta to show when it gained knowledge and what it did about it. For the sample infringements in annexes K22, K24, K28, K29 and K33, Meta did not provide that detail. Even measured from the plaintiffs' own reporting dates, two items were removed too slowly: a Facebook profile named "Thomas Kehl", reported on May 30, 2025, stayed up for 20 days, and a Facebook profile named "Finanz Fluss", reported on June 5, 2025, stayed up for 14 days. "A deletion period of 14 or 20 days for such clear violations no longer constitutes expeditious action," the chamber wrote.

The judgment also records that the plaintiffs had previously uploaded reference images, reported more than 200 violations and, in a lawyer's letter dated October 1, 2024, set out precisely which combinations of photographs, account names and trademarks marked a post or profile as fake. The court described that letter as an "almost algorithmic description" of infringement cases, one that would have allowed Meta to implement it technically and detect further violations automatically.

How the impersonation operated

Finflow GmbH, based in Berlin, runs Finanzfluss, a portal with comparison calculators, product tests and consumer guides on current accounts, brokerage accounts, credit cards and savings products. The business grew out of a YouTube channel that Kehl and co-founder Arno Krieger have run for nine years, which had 1.5 million subscribers according to the judgment. At the time the claim was filed, the company's Instagram account had more than 600,000 followers and its Facebook account almost 29,000. Kehl co-wrote a nonfiction book that reached number one on the Spiegel bestseller list and is now in its 20th edition, and hosts the podcast "Marktgefluester", which has at least 149 episodes. In the language of advertising, Kehl is a finfluencer with an unusually recognisable face, which is precisely what made him useful to fraudsters.

According to the facts recorded in the judgment, accounts unconnected to the plaintiffs posted numerous ads and posts on finance topics using the Finanzfluss name, its marks and Kehl's name and image. The account names listed include Finanzfluss, Finanz Fluss, finanzfluss54, finanzfluss488, Finanzfluss-A, finanzfluss3, Thomas Kehl, Thomas-Kell, kehl6930 and Thomas von Finanzfluss, alongside borrowed institutional names such as Deutsche Kapital Management, Deutsche WertpapierService Bank AG, Frankfurter Wertpapierboerse and Fse-Dividendenkoenige. The ads were labelled "Anzeige" and distributed by Meta at the advertisers' expense, some of them booked through a Meta ad account rather than a dedicated profile. All the photographs of Kehl came from Finanzfluss's own channels. Finflow itself runs no advertising on Meta's platforms.

Users who clicked were usually routed, either directly or after filling in an online questionnaire, into closed WhatsApp groups, where specific investments were promoted with presumably fraudulent intent. Several users who suffered losses contacted the plaintiffs. The court's damages reasoning states that third parties made investments in the belief the offers came from Kehl and lost large sums.

One example stands out for its method. A Facebook profile named "Unabhaengiger Analystenclub" ran an ad containing an AI-generated deepfake video of Kehl offering supposed investment tips in a WhatsApp group. According to Meta's own figures cited in the judgment, the ad ran from June 3 to June 15, 2025, and was seen by more than 5,000 users. Measured from the plaintiffs' stated report date, the removal took 62 days, though the court's framing makes clear that this figure depends on a report Meta did not accept as proven.

A source discrepancy on the numbers

The figures published about the case do not all match, and the differences are worth setting out. The court's own press release of September 17, 2026, says the plaintiffs reported almost 260 violations in August 2024 alone, and that Meta took up to 62 days to remove the fake ads. The judgment is more precise and more cautious: it records about 256 reported violations between July 29 and August 28, 2024, and presents the deletion times as ranging from 0 to 62 days according to the plaintiffs' account, while Meta stated that undisputed reports were handled within 0 to 20 days. Elsewhere, the judgment refers to more than 200 reported violations. Kehl's own LinkedIn post, published after the verdict, cites higher totals for the full period before the lawsuit: over 1,000 fake ads reported and more than 300 fraudulent accounts identified. Those totals do not appear in the judgment.

Two years of reporting

The chronology in the judgment shows how much work fell on the rights holder. The plaintiffs used Meta's Brand Rights Protection tool, which, according to Meta's submissions, lets holders register word and figurative marks, search for infringing content by keywords, phrases or URLs, and upload up to 200 reference images. After the first wave of reports, the flagged content was removed, but identical or similar ads kept appearing. Direct contact with Meta produced no result, and the plaintiffs then hired leakshield GmbH, an agency specialised in content removal, before sending the formal warning letter of October 1, 2024.

Settlement talks followed. According to the judgment, Meta offered to enrol Kehl in its facial recognition programme, which the plaintiffs initially did not take up. They attended a Brand Rights Protection training session run by Meta. A direct reporting channel to Meta's outside counsel and a compensation payment were discussed, but no settlement was reached. The plaintiffs now employ one full-time person solely to monitor the platforms and file reports.

After the lawsuit was filed, Kehl consented to Meta's facial recognition programme by email on September 24, 2025. New infringing content using his image continued to appear almost daily afterwards, for example in November 2025, according to the judgment. That detail is significant given Meta's public claims about the technology. PPC Land reported in March 2026 that Meta said its facial recognition approach more than doubled the volume of fraudulent ads detected during testing, a figure the company itself supplied.

What Meta argued

Meta's defence, as summarised in the judgment, rested on several pillars. It said it has technical methods to detect and block fake accounts, for instance when an unusual number of accounts is created from one location, and that it provides tools including the Intellectual Property Reporting API, Rights Manager, the Brand Rights Protection tool, dedicated reporting forms and an IP help centre. It said it had reviewed and removed a large number of fraudulent ads and profiles relating to the plaintiffs promptly, that no system can detect every single infringement, and that there was no deliberate delay to generate revenue. It also argued that the disputed items were pure user content rather than ads from which it earned revenue.

On the technical question at the heart of the injunction, Meta stated that it is not technically possible to identify content "of the same meaning". It argued that a name or a company sign alone is not a sufficient indication of a fake account, since with several billion user accounts no name can be clearly assigned to one person. Accounts that refer to the plaintiffs and use their names and publicly available images are lawful, in Meta's view, as long as they do not create the impression of being the plaintiffs' own accounts. Assessing personality rights requires a difficult case-by-case balancing, it said, and a sweeping removal duty would force platforms to block lawful content to avoid liability, which would be incompatible with freedom of communication.

Meta also contested the trademarks. It argued that "Finanzfluss" is descriptive and generic for financial services and therefore not protectable, or protectable only so narrowly that the slightest deviation would fall outside its scope, making automated detection at scale unsuitable. Meta also said its generative AI ad creative tool is not available for financial advertising, and that its ranking of recommended content is automated and does not mean it adopts posts as its own.

The court was not persuaded on the technical points. For the information claim, it held that filtering is possible on an automated basis using the content descriptions the plaintiffs supplied. On the trademark question, it found the company sign "finanzfluss" originally of below-average distinctiveness because of its descriptive overtones, but held that its wide use in commerce had raised it to at least average distinctiveness. With identical services and identical or highly similar signs, the court found a likelihood of confusion. A submission Meta filed on August 6, 2026, that could be read as disputing the underlying facts came too late under the German Code of Civil Procedure.

For Finflow, the injunction rests on its corporate personality right, a German doctrine protecting a company's social standing and its right to decide how its name is used in advertising, and on its company sign under the Trademark Act. The court found that the fake profiles created the false impression that they came from Finflow, and that the creators, who undisputedly used them for fraud, had no protectable interest in that activity. Two of the challenged items, annexes K30 and K31, showed no clear connection to the company and therefore did not infringe its rights, though both did infringe Kehl's.

For Kehl, the injunction rests on his right to his own image under the Art Copyright Act and his right to his name under the Civil Code. Every challenged item contained his likeness, none was an image from the sphere of contemporary history, and he never consented. On the name claim, the court found confusion as to identity in the narrow sense: because the name is identical, the public assumes the profiles belong to Kehl.

The copyright claim failed for a reason unrelated to Meta. Finflow argued that its employees took the photographs and granted it exclusive rights. A witness, whose name is redacted, testified that most images were made by employees, some by an external photographer and one supplied by a publisher, and that there was a clear understanding the images were produced for Finflow's use. But the witness did not know what the employment contracts said. Under the purpose-of-transfer rule in Section 31(5) of the German Copyright Act, rights are granted in case of doubt only to the extent the contractual purpose strictly requires, and for social media use, simple non-exclusive rights would suffice. An invoice from the photographer listing a "transfer of usage rights" did not establish exclusivity either. Without exclusive rights, Finflow could not sue in its own name. Data protection claims under the GDPR, which the plaintiffs pleaded in the alternative, were never reached.

Because the court classed Meta as a perpetrator rather than merely an indirect disturber, damages were available. The court found Meta acted at least negligently. For Kehl's compensation claim, it concluded that the violation of his personality rights was serious, pointing to the reach of Meta's platforms, Kehl's prominence, the constant repetition of the violations, the fraudulent intent of the users and the need for prevention, both to protect Kehl and to protect other platform users who had suffered substantial financial losses.

Reaction from the plaintiffs

Spirit Legal, whose partner Dr. Jonas Kahl and senior associate Dr. Henning Fangmann handled the case, framed the ruling as a break with prior practice. "With this judgment, the Frankfurt Regional Court puts the liability of platforms such as Facebook on a new footing and, for the first time, applies the strict standards of the CJEU from the Webgroup and Coyote decision to a case heard before a German court," the two lawyers said in a statement published on September 16, 2026, translated from German. "It is a historic decision. For the first time, a German court has made clear that social networks such as Facebook are in principle directly and themselves liable for the unlawful content of their users. They can no longer rely on the argument, often successfully advanced until now, that they knew nothing of an infringement."

Kehl posted his own account on LinkedIn, displayed in English translation. "The court's reasoning is a tough one: Anyone who decides by algorithm who is shown which ad - and earns money from it - is not neutral storage space. But responsible," he wrote. His post also states that Meta will have to independently filter out fake profiles and scam ads with his name, photo or the Finanzfluss name "before they even appear". That is his reading of the injunction. The operative text prohibits publishing and distributing content of the kind shown in the listed examples and core-identical variants; it does not prescribe a specific filtering technology, though the reasoning on the information claim states that automated filtering is possible.

No statement from Meta is included in any of the documents reviewed for this article.

The broader pressure on Meta's ad business

The Frankfurt case arrives against a background that PPC Land has tracked for close to a year. Kehl's post cites internal documents reported by Reuters in November 2025, which showed that Meta projected roughly 10 percent of its 2024 revenue, about 16 billion dollars, would come from ads for scams and banned goods. The same documents described a penalty bid programme that charged suspected fraudsters higher prices rather than removing them. Meta disputed the characterisation at the time.

Meta has responded with enforcement disclosures. In December 2025, the company said it had removed more than 134 million scam ads during 2025. In February 2026, it filed lawsuits against scam advertisers in Brazil, China and Vietnam over celeb-bait and cloaking, citing a protection programme covering more than 500,000 public figures. Yet external pressure kept building. In March 2026, IAB Sweden expelled Meta over its failure to tackle deceptive ads, and in April 2026 the Consumer Federation of America filed a class action in Washington, D.C. built on the Reuters documents. An analysis by the Video Advertising Bureau in July 2026 found that Facebook banned 3.5 billion fake accounts in 2025.

German courts have also become a recurring venue for claims against Meta, though mostly on data protection. The Dresden Higher Regional Court in February 2026 awarded 1,500 euros per plaintiff over Meta's Business Tools tracking. On platform liability specifically, the Duesseldorf Regional Court held in January 2025 that Google could be liable as a disturber under the DSA for trademark violations in advertising in the Skinport case, a decision that turned on knowledge after notice. The Frankfurt ruling goes further, because it removes the notice-based shield altogether for services that rank content.

The judgment also touches another CJEU line. The plaintiffs argued that the Russmedia judgment of December 2, 2025, Case C-492/23, which PPC Land has described as the most recent joint controller precedent in the CJEU's sequence, also excluded the hosting privilege. Meta disputed that Russmedia applied. The chamber found it did not need to decide, since the Webgroup and Coyote reasoning was sufficient.

Why this matters for marketers

For advertisers, agencies and publishers, three elements of the judgment stand out.

The first is the characterisation of the ad auction. The court did not find that Meta designed its auction to favour scam ads. It found that running an auction under rules Meta sets, with a quality score Meta calculates, is itself an act of control over what gets distributed. Every major self-serve platform works that way, including Google Ads, Amazon Ads, TikTok and Microsoft Advertising, and every algorithmic feed ranks organic posts by rules the operator writes. If the reasoning survives appeal, the exemption that platforms have relied on since the e-Commerce Directive of 2000 would effectively be limited to services that do not rank, such as forums and chronological feeds. That is a much narrower group than the one that has operated under the exemption so far.

The second concerns brands and executives who are impersonated. The Finanzfluss case documents what the existing tools deliver in practice: reference image uploads, a dedicated reporting tool, a training session and eventually enrolment in facial recognition, followed by near-daily new fakes and a full-time employee dedicated to reporting them. The judgment establishes that a detailed warning letter describing the pattern of fakes, rather than item-by-item URLs, can be enough to fix a platform with knowledge of future core-identical content. For companies whose founders or spokespeople appear in scam creatives, the ruling sets out a litigation path that did not exist in this form before, although it is, as one commenter on Kehl's post noted, a path each affected party must take individually.

The third is disclosure. The information order requires Meta to report, by URL, the views and revenue attached to the fake content. The Reuters figures on scam ad revenue came from leaked internal documents; this order, if it becomes enforceable, would produce case-level figures through a court process. Whether and when that happens depends on the appeal.

What happens next

The judgment is not final. Meta can appeal to the Frankfurt Higher Regional Court, according to both the court's press release and Spirit Legal. In the meantime, the judgment is provisionally enforceable against security: 50,000 euros for each of the four upheld injunction items, 10,000 euros for the information order, 20,000 euros for the declaration of damages liability and 20,000 euros for Kehl's compensation claim, with the remainder enforceable against security of 100 percent of the amount to be enforced. The court said the full text will be published on its public legal database, lareda.hessenrecht.hessen.de.

An appeal would also give the Higher Regional Court the chance to decide whether Webgroup and Coyote, a case about adult websites and age verification, can carry the weight the Frankfurt chamber has placed on it. That question may eventually return to Luxembourg.

Timeline

Summary

Who: Finflow GmbH, the Berlin company behind the financial education brand Finanzfluss, and its co-founder and managing director Thomas Kehl, represented by the Leipzig law firm Spirit Legal, against Meta Platforms Ireland Limited, operator of Facebook and Instagram in the EU.

What: The Frankfurt Regional Court ordered Meta to stop distributing third-party ads and profiles that impersonate Finanzfluss and Kehl, under threat of fines of up to 250,000 euros per violation, to disclose views and revenue for the infringing content by URL, and to pay damages and compensation. The court held that Meta's ad auction and feed algorithms give it control over content, so it cannot rely on the hosting exemption in Article 6 of the Digital Services Act.

When: The judgment was pronounced on September 16, 2026, after an oral hearing on June 3, 2026. The court published its press release on September 17, 2026. The ruling is not final.

Where: The 6th Civil Chamber, the competition chamber, of the Frankfurt am Main Regional Court in Germany, case 2-06 O 234/25. Any appeal would go to the Frankfurt Higher Regional Court.

Why: Fraudsters used Kehl's image, his name and the Finanzfluss brand in ads and fake profiles that funnelled users into WhatsApp groups promoting fraudulent investments, and removals took up to 20 days by the court's findings and up to 62 days by the plaintiffs' account. The court applied the CJEU's Webgroup and Coyote reasoning that algorithmic control over distribution removes hosting protection, a standard that would extend to any platform that ranks ads or organic content by its own rules.