Fake Ads, Real Evidence: What the Frankfurt Meta Ruling Changes

What the Frankfurt court actually decided

On 16 September 2026, the Regional Court of Frankfurt am Main ruled in favour of the company behind the German finance portal Finanzfluss and its founder, Thomas Kehl. Unknown advertisers had used the company’s logo and Kehl’s name and image in Facebook and Instagram adverts promoting supposed investments. According to the court’s press release, people who lost money had already contacted the claimants.

The scale matters. In August 2024 alone, the claimants reported almost 260 infringements through Meta’s designated tool. Identical or materially similar adverts kept returning. Meta sometimes took up to 62 days to remove them.

The court ordered Meta to stop disseminating the adverts, found it liable for resulting damage and required information about the adverts and the revenue Meta generated from them. Its reasoning included the way Meta controls the ranking and timing of adverts and algorithmically controls what appears in feeds. The judgment, case 2-06 O 234/25, is not final and can be appealed.

This does not mean every brand impersonation case now has an automatic outcome. It does mean that businesses should stop treating evidence collection as an afterthought to the takedown form. A platform report may remove the only public copy. Before clicking send, preserve enough context to show what ran, where it led and what happened next.

A screenshot is useful. A cropped screenshot is a weak case file

Most teams begin with the creative because that is what feels offensive: the borrowed face, copied logo or synthetic voice. Keep it, but widen the frame. The identity of the advertiser, the sponsored label, caption, date, placement and destination are part of the incident. A close crop can prove that an image existed on somebody’s phone; it may not show who published it or which link a viewer was invited to follow.

Capture the advert as it appeared on both desktop and mobile when possible. Record the page URL, ad library entry or stable platform identifier, account name and account URL. Note the local time and time zone. If the platform reveals why the advert was shown or who paid for it, preserve that too.

Do not enter personal details or install software merely to map the funnel. Record the visible destination and let an authorised security analyst examine it safely. If a customer has already followed the link, preserve the address they reached, the messages received and the payment instructions without asking them to repeat the journey.

• Use the full digital-evidence preservation checklist

• Full-page screenshot showing the advert, account and platform context
• Screen recording of the advert, disclosure panels and destination preview
• Advert, account, post and library identifiers where available
• Visible destination URL and any redirects observed safely
• Collection date, exact time, time zone, device and app or browser
• Original downloaded media when lawful and technically safe
• Platform report reference, confirmation email and takedown time

Treat the repeats as one campaign, not 260 unrelated annoyances

Fraudulent adverts mutate. A new account appears, one sentence changes, the video is cropped and the landing page moves to another domain. If every report lives in a separate inbox, the organisation can miss the pattern that makes repeated conduct visible.

Give the incident a case ID and every advert its own item ID. Preserve both what stayed the same and what changed: face, logo, script, voice, call to action, payer, account, destination, domain registrar, payment method and contact number. Link customer complaints to the advert only when there is a sound basis for doing so; do not force a connection because two victims mention the same public figure.

A simple campaign table is often more useful than a folder of screenshots. It lets legal, brand, fraud and platform teams see that a removed advert returned through another account, that the same landing page served several creatives, or that reports sat unanswered for a measurable period.

• Review a sample evidence report
• Check many image creatives in one batch

• One incident record with a stable internal owner
• One row per advert or materially similar repost
• First seen, reported, acknowledged, removed and last seen times
• Creative hash or file reference, not only a pasted thumbnail
• Account, payer and destination identifiers kept in separate fields
• Customer harm and payment evidence stored with appropriate access controls

Record the report as carefully as the advert

The Frankfurt case was not just about what appeared on screen. The court’s account also records repeated notices and removal delays. For an affected business, that makes the reporting history part of the evidence.

Save the exact category selected in the platform form, the explanation submitted, the files attached and the reference number returned. Keep acknowledgement and rejection messages. When an advert disappears, record the time; when a materially similar one returns, link it to the earlier notice. Avoid rewriting old entries after the fact. Add a dated correction instead.

This record helps answer ordinary but important questions: Was the platform given enough information to locate the content? How quickly did it respond? Did the same creative return? Which customers reported harm before and after notice? Those questions are easier to answer from contemporaneous entries than from memory assembled months later.

What a media check can tell you — and what it cannot

A technical check can help sort a large queue. It may find signs associated with generated or altered imagery, compare variants, preserve file hashes and create a repeatable report. That can be useful when a campaign uses a cloned voice, an edited interview or dozens of near-identical portraits.

It cannot establish that the investment itself was fraudulent, identify the advertiser from pixels or decide who is legally liable. A genuine clip can be placed above a false caption and a malicious link. An authentic photograph can be used without permission. Conversely, a synthetic-media signal does not prove who made the file or why.

Write the finding narrowly: which file was analysed, when, with which model and settings, what signals were observed and what limitations apply. Keep an inconclusive result inconclusive. The purpose is to help a reviewer understand the media, not to turn a probability into an accusation.

• See how report-ready API results are structured

Build the handover your lawyer or platform team will need

A useful handover is short enough to read and detailed enough to verify. Start with a one-page chronology. Follow it with an inventory of adverts, preserved files, report references, customer complaints and known losses. Separate observed facts from conclusions. ‘Advert displayed at 10:14 CET’ belongs in the facts column; ‘same operator’ belongs in the assessment column unless an identifier actually connects the accounts.

Limit access to victim and employee data. Collect what the case needs, document the lawful basis and retention period, and avoid circulating unredacted payment or identity records in general chat channels. Counsel may also need a preservation request or information from a platform that a public screenshot cannot provide.

The operational goal is not to manufacture a courtroom bundle on day one. It is to avoid losing the source material, timing and notice history that specialists would need later.

The first 24 hours: a practical response

First, preserve the advert and route before requesting removal. Second, notify the platform with enough identifiers to locate the exact content and retain the receipt. Third, warn customers through channels they already trust, without repeating the live scam link. Fourth, alert brand, fraud, security and legal owners through one case record.

If money has moved, the victim’s bank or payment provider should be contacted through an official channel immediately; media analysis should not delay that step. If an account or domain is compromised, contain it through the appropriate security process. Keep the takedown work moving while technical and legal review continue in parallel.

The Frankfurt ruling is a strong reason to make this process routine. It is not a reason to wait for litigation. The best outcome is still a fast warning, a clear report and evidence that survives after the advert is gone.