Meta – Court Ruling (Germany, 2026)

A company operating a financial education portal and a YouTube channel with about 1,5 million subscribers and one of its co-founders (the plaintiffs) had repeatedly requested the operator of two large social media platforms (the defendant) to erase content posted by fake accounts. Users not associated with the plaintiffs had created profiles and posted advertisements under names resembling the plaintiffs' trade marks as well as featuring photos and deepfake videos of the co-founder. If users of the social media platforms followed the links in the posts, they were directed to groups on the defendant’s messaging app where fraudulent investment options were promoted. The plaintiffs had reported these incidents using the defendant's "Brand Rights Protection Tool", reported approximately 256 violations within a month, assigned a full-time employee to monitor the violations, and sent the defendant a formal legal warning. Erasing the infringing content took between 0 and 62 days, and more fake content appeared almost daily. Following the unsuccessful attempts to get the content removed, the plaintiffs filed a lawsuit requesting an injunction and damages. They based their claims on provisions of copyright law, data protection law, trademark law, and personality rights. The plaintiffs argued that the defendant could not invoke the liability exemption for hosting service providers under [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Article 6 DSA]. They also stated that the co-founder featured in the infringing content could base his claims on Articles 17 and 82 GDPR for the injunction and damages respectively, as the photos and videos featured in the fake content contained the co-founder’s personal data. According to the plaintiffs, the defendant was acting as a joint controller within the meaning of Article 26 GDPR with the profile owner or advertiser. The court held that the defendant was liable for fake profiles on its social media platforms under the DSA. It granted the injunction and damages claimed by the plaintiffs. As the plaintiffs' claims were already granted on other grounds, the data protection claims further asserted to support the lawsuit were no longer relevant and therefore not assessed by the court in detail. However, the court pointed out that a claim for injunctive relief could not solely be based on Article 17 GDPR or the GDPR directly. First, the court ordered the defendant to refrain from publishing and/or distributing infringing third-party content on its platforms without the plaintiffs' consent. The court based its decision to grant the injunction on the company's corporate personality rights and corporate trademark as well as the co-founders right to his own image and right to his name. It held that the defendant was directly liable for the infringing content and could not invoke the liability exemption for hosting service providers in [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Article 6 DSA]. Regarding the defendant’s direct liability, the court argued the defendant exercised control over the content and was not just a neutral, passive hosting provider. The court pointed out that the defendant's ranking algorithm makes decisions about which ad is shown to which user and when or whose feed other content than ads appears in. According to the court, this algorithmic dissemination of third-party content therefore serves the defendant's own economic interests. The court referred to the CJEU's decision in the cases the cases [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62024CJ0188 C-188/24, C-190/24 – WebGroup and Coyote System] to support its conclusion. In this judgment, the CJEU ruled that an operator exercises control over the algorithmic dissemination of third-party content if the algorithm goes beyond merely categorising and indexing information and determines how the information is broadcast.See [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62024CJ0188 CJEU - C-188/24, C-190/24 - WebGroup and Coyote System], margin numbers 109-112. This decision concerned Article 14(1) E-Commerce Directive 2000/31/EC. The court held the decision was applicable in the present case, as [https://eur-lex.europa.eu/eli/dir/2000/31/oj/eng Article 14(1) E-Commerce Directive] is the predecessor provision of [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Article 6 DSA]. Second, the court ordered the defendant to compensate the plaintiffs for the damages they have incurred and/or will incur in the future as a result of the dissemination of the infringing content. The court was able to grant damages and monetary compensation because the defendant was liable as the perpetrator, not only as an indirect infringer. Finally, the court ordered to defendant to provide the plaintiffs information on the extent to which infringing content was distributed, accessed, or made publicly available. The defendant was also obligated to provide a breakdown of the revenue generated by the dissemination of fake content.