1. Introduction
A shocking figure surfaced last year: according to internal documents unearthed by Reuters, Meta projected that 10% of its annual revenue, roughly $16 billion, came from running advertising for scams and illegal goods. Each day, Meta exposes users to approximately 15 billion scam ads. However, Meta does little to combat this: even though its internal warning systems detect much of this content, Meta only takes down a suspected scam ad if the system considers that there is a 95% chance that the content of the advertisement is fraudulent. Besides the obvious risk this poses for users of Meta platforms, this points to a problem that extends across online platforms and social media. Users of various services are increasingly affected by online scams, and the rise of AI-generated communications, including deepfakes, has made matters worse.
In the EU online platforms are required to protect their users from such scams. Specifically, the Digital Services Act (DSA) requires online platforms to keep the online environment safe for users, including through obligations pertaining to illegal content like fraudulent advertisements. This has already led to several investigations into platforms at the European level: the European Commission (the Commission) is currently investigating how Booking.com addresses fraudulent listings on its platform and how Meta addresses deceptive advertisements.
However, the DSA also grants hosting services, a category which includes online platforms, an exemption from liability for the illegal content they host where they are not aware of the relevant content’s illegal nature or act expeditiously to remove it as soon as they do become aware (the so-called ‘hosting exemption’) (see Article 6 DSA). The DSA thus protects users of online platforms on the one hand, while granting platforms a liability exemption on the other. This raises the question of whether platform operators can themselves be held liable for the fraudulent content of their users.
The Frankfurt Regional Court (the ‘Court’) recently addressed this question in its 16 September 2026 judgment (Case 2-06 O 234/25). The claimants sued under national IP and personality law for the harm caused by the fake profiles and advertisements, and Meta invoked the Article 6 hosting exemption in its defence. The Court therefore had to decide whether Meta can be held liable for the numerous scam ads posted on Facebook and Instagram imitating a financial services company and its managing director.
In our previous blog post (see here), we examined the Court of Justice of the European Union (‘CJEU’)’s increasingly narrow interpretation of the hosting exemption under the eCommerce Directive, predecessor to the DSA. We focused on three recent judgments: Russmedia (2 December 2025, Case C-492/23), WebGroup Czech Republic and Coyote System (16 June 2026, Cases C-188/24 and C-190/24, hereinafter referred to as Coyote) and AGCOM v Google Ireland (16 July 2026, Case C-421/24). Together, these cases significantly narrowed the circumstances in which platforms can rely on the exemption if they determine the order in, priority of, and conditions under which user-generated content is displayed to users.
The ruling against Meta is one of the first national judgments applying the hosting exemption to a major social media platform since the CJEU issued its judgment in Coyote. In this blog post, we will therefore discuss how this narrow conception of the hosting exemption was applied and what it could mean for social media platforms going forward.
2. The Facts
The case concerns a claim brought by a German financial education company, Finanzfluss, and its co-founder and public face, Thomas Kehl.1 Banking on Finanzfluss’s reputation, third parties set up fake profiles and advertisements on Facebook and Instagram that used the company’s name and logo and the director’s name and image to promote certain (fraudulent) investments. These fraudulent advertisements were distributed as both user-generated content and as paid advertisements. Users who clicked through were funnelled into closed WhatsApp groups promoting fraudulent investments.
After users reported the scams to Finanzfluss and Mr. Kehl, they reported the fake profiles and ads through Meta’s Brand Rights Protection Tool, flagging more than 250 infringements in one month. The claimants also sent a cease-and-desist letter to Meta setting out the features by which a fake profile or post could be recognised.
Meta ultimately took the reported content down, but new profiles and advertisements with the same or similar content kept appearing. Removal of these profiles and advertisements sometimes took weeks, and new fraudulent content surfaced almost daily. The claimants had to dedicate a full-time employee to monitoring and reporting.
In light of this, the claimants brought proceedings seeking injunctions against the further dissemination of the fraudulent content, information about its reach and the revenue it generated, and damages.
3. Meta’s defence: a ‘neutral host’
Meta’s defence relied on the familiar argument that Facebook and Instagram merely provide the technical infrastructure through which users publish content and should therefore qualify as neutral hosting service providers covered by the hosting exemption (see judgment pages 15-16). If that argument held, Meta could not be held liable for the scam ads and fake profiles unless and until it was properly notified and then failed to act (in time).
That position, however, is difficult to reconcile with CJEU case law. In Coyote (C-188/24 and C-190/24), the CJEU ruled that where a platform’s algorithm determines the conditions, manner and order in which user content is disseminated, the platform exercises control over that content and therefore falls outside the hosting exemption. With respect to the knowledge criterion, the CJEU found that a platform that examines the essential content of a channel by virtue of a revenue-sharing agreement may acquire sufficient knowledge to fall outside the exemption in AGCOM v Google (C-421/24). While these judgments were formally about the hosting exemption as set out in Art. 14(1) eCommerce Directive, the hosting exemption set out in the DSA is almost identical to that provision.
Meta nonetheless argued that it does not exercise control over user content – including the posts made by the scam accounts – through its automated ranking and recommendation systems because the platform does not itself endorse the content displayed. Meta made a similar argument in relation to advertising on its platforms, alleging that, although ads are subject to a quality review, the automated nature of that process does not give it knowledge of their content.2
4. The Court’s Ruling
The Court rejected Meta’s arguments and, in line with the recent case law of the CJEU, held that a platform which exercises a degree of control through curation or monetisation of content cannot qualify as a neutral host and benefit from the hosting provider liability exemption. It thus held Meta “directly liable for the infringement of corporate personality”3 and then explained why by the hosting exemption in Article 6 DSA would not shield Meta from that liability.
Meta is not a neutral host
The Court’s starting point regarding neutrality was the test developed under Article 14 of the e-Commerce Directive that carried over into Article 6 DSA. This test entails that a provider may rely on the hosting exemption where its role is merely technical, automatic and passive, such that it has neither knowledge of nor control over the information stored (Coyote, paras 109, 111-112).
According to the Court, it was “obvious” that the CJEU’s interpretation of the former Article 14 remains relevant under Article 6 DSA given that Article 14 eCommerce Directive was its predecessor. It therefore relied on the CJEU’s “liability framework”, set out in Coyote, and earlier cases such as YouTube and Cyando (Joined Cases C-682/18 and C-683/13), for assessing whether Meta exercised control over the content disseminated through its platforms (see page 32).
Importantly, in Coyote the CJEU established that such control may be exercised through an algorithm (paragraph 111). The automated nature of a platform’s systems does not therefore make its role neutral: the relevant question is whether the provider determines how content is organised and disseminated.
Applying that test, the Court found that Meta exercised control over both advertisement and user generated content on its platforms.
First, within the auction process used to determine which advertisement a user sees, Meta determines in what order users see the ads, as well as when they see them at all. It also allocates them a “quality score” by using an automated pattern recognition to assess features, such as the amount of text in the image, sensationalist language and engagement baiting. In the Court’s view, by imposing these criteria on the ad auction, Meta exercises a decision-making function that is “superior to that of the individual advertiser” (page 31). Although advertisers determine the content of the advertisements and choose their target audience, Meta ultimately determines whether, when and how prominently an advertisement is shown. The fact that this process is automated does not change that conclusion. Therefore, Meta is not a mere neutral host and can be held liable if advertisements contain illegal content or pertain to an illegal activity.
Second, the Court also found that Meta exercises control over user-generated content because its algorithm ultimately chooses which posts come into its users’ feeds, and in what order. Facebook and Instagram do not simply display content selected by users in chronological order: their recommendation systems determine which posts are shown to what users and when. By controlling the distribution and visibility of that content, Meta therefore plays an active role in its dissemination (page 31).
The Court also considered Meta’s commercial interest with regard to both types of content. For the advertising auction, Meta has an interest to control it because it earns ad revenue. The recommendation of user content can increase user engagement and thereby improve the reach and effectiveness of advertisements, thus also benefitting the platform’s ad revenue. The Court also explicitly addressed Meta’s argument that the above reasoning would exclude every single social media platform from the safety of the hosting exemption. According to the Court, control arises where the provider’s own algorithmic criteria determine which information is shown to which users. By contrast, traditional online forums and platforms that leave content selection primarily to users by displaying purely chronological feeds are therefore less likely to exercise the same degree of control. In that regard, the Court specifically mentioned Twitter (now known as X), Mastodon and Bluesky as examples of social media companies that would still fall under the hosting exemption.
Given that Meta exercised control over both advertisements and user generated content, the Court considered the question of whether Meta had knowledge of this content to be irrelevant, control alone was sufficient to exclude the applicability of the hosting exemption.
Even if Article 6 DSA applied, Meta would still fall outside the exemption
The Court added that, even if Meta could in principle rely on Article 6 DSA, it would nonetheless not apply in this specific case (page 35). Article 6(1)(b) protects a hosting provider only where, once it obtains knowledge of unlawful content, it acts expeditiously to remove or disable access to it. Meta had such knowledge after the claimants’ repeated notifications, but the Court found that it had not shown that it responded sufficiently promptly or effectively.
The obligation under Article 6(1)(b) is not limited to removing the specific profiles and advertisements reported by the claimants. Citing earlier German case law, the Court found that, once notified of a particular type of infringement, Meta was required to prevent identical or essentially equivalent content from reappearing without requiring a fresh complaint each time. Therefore, in the present case, Meta bore the burden of showing that it had taken the necessary measures and, according to the Court, failed to do so.
5. Key Implications
a. The exemption continues to narrow
As we argued in our previous post, courts are increasingly scrutinising how platforms organise the content they host through advertising, ranking and recommendation systems. The Court’s judgment continues that trend. Applying the CJEU’s interpretation of Article 14 of the e-Commerce Directive to Article 6 DSA, the Court confirms that knowledge and control are separate routes out of the hosting exemption under the current platform rules as well, with each potentially sufficient to prevent a platform from relying on it.
The judgment also reinforces an important point from Coyote, namely that automation does not preserve neutrality. Where a platform determines through its algorithms how and to whom content is disseminated, the fact that this process occurs automatically does not shield the platform from liability.
b. Control extends to user-generated content
Perhaps the most economically significant part of the judgment is that the Court found control not only over Meta’s advertising system, but also over user-generated content such as posts and comments. Meta argued that it could not be liable for content posted independently by users and from which it earned no direct revenue. The Court rejected that distinction, finding that Meta determined whether and in what order users would see a post or advertisements, and that for both types of content, Meta did so in pursuit of its own commercial interests.
For advertising, Meta’s commercial involvement and interest are obvious: Meta organises the auction, picks the winners, determines how advertisements are displayed and earns revenue from them. The position is less obvious for ordinary posts shared by users, which are typically understood as content that the platform merely hosts. However, once Meta uses recommendation systems to determine which content users see and when, its role goes beyond passive hosting.
In that respect, the Court’s broad interpretation of Meta’s commercial interests is sensible in light of Coyote. One of the services at issue in Coyote was an electronic navigation software that allowed users to report traffic incidents such as accidents or speed traps, which were then algorithmically rebroadcast by Coyote Systems to other users. If, however, other users disputed the reliability of these reports, Coyote Systems could remove them (AG Opinion in Coyote, paras 209-21). Coyote System’s own interest in rebroadcasting and removing these reports presumably lies in keeping its platform attractive: if reports are unreliable, then the platform is less useful to users and thus it will shed market share.
The Court framed Meta’s commercial interest in a similar manner: Meta increasingly relies on advertising and interaction and thus uses its algorithms to keep its users on its platforms. Whether Meta’s policy of permitting some of its users to scam other users actually increases engagement is another question; fraudulent content certainly doesn’t benefit its non-scammer users. Nonetheless, its algorithm in general is designed to ensure its users stay on the platform, meaning its commercial interest is similar to that of Coyote.
c. The dilemma for social media platforms
The Court’s classification of Facebook and Instagram as services to which the hosting exemption does not apply points to a dilemma for social media platforms. According to the Court, Facebook and Instagram could in principle qualify as hosting services and benefit from the exemption. However, their use of data-drive recommender systems takes them outside its scope.
Both platforms previously relied more heavily on chronological feeds before shifting towards algorithmic recommendation systems designed to maximise engagement, although users can still switch to chronological feeds. As a result of the Court’s ruling, however, Meta has in essence traded its legal protections for more engaging and therefore more profitable platforms. Given the high prevalence of scams and other forms of illegal content on its platforms, as well as the enormous task of policing 3.6 billion users, Meta may be forced to reconsider this shift.
d. Article 16 DSA makes notice-and-action central to the Article 6 exemption
The judgment also demonstrates how the liability exemption is connected to the DSA’s content moderation duties, in particular the notice-and-action mechanism in Article 16.
Article 6 DSA protects a hosting provider that lacks knowledge of illegal content, or that acts expeditiously once such knowledge is obtained. Article 16(1) DSA requires providers to implement a mechanism through which they can become aware of illegal content, namely a notice-and-action mechanism. Complementing this requirement, Article 16(3) provides that a sufficiently precise and adequately substantiated notice gives rise to actual knowledge for the purposes of Article 6 where it enables a diligent provider to identify illegal content without a detailed legal examination.
Importantly, receiving a valid notice does not remove the protection of the hosting exemption. Instead, it changes what the provider must do to retain it, namely removing or disabling access to the illegal content.
The Court rejected Meta’s attempt to rely on alleged deficiencies in the claimants’ notifications and considered that it was for Meta to prove that the notices provided by the claimants were insufficient. The claimants had gone to great lengths to convince Meta to deal with their concerns, submitting more than 250 reports and even dedicating a full-time employee to identifying and reporting scams. Meta was unable to explain why these reports were insufficient.
The claimants’ efforts highlight the imbalance the notice-and-action mechanism is meant to address. Platforms exercise extensive control over what is hosted and disseminated and are far better placed than any individual user to detect and remove illegal content, yet the burden of finding and flagging it falls on the affected user. Article 16 counterbalances this by obliging platforms to provide an effective notification mechanism, while Article 6 eliminates protection from liability where they are slow to act on what users flag. Considering that certain fraudulent ads had remained up for months, the Court’s finding that Meta had violated Article 16 DSA is not unsurprising or unreasonably strict.
The connection between the liability exemption and the notice-and-action mechanism is already visible in the Commision’s DSA enforcement against Meta. In October 2025, the Commission preliminarily found that Facebook and Instagram failed to provide sufficiently accessible and user-friendly Article 16 mechanisms and used deceptive design that could discourage users from reporting illegal content. The Commission expressly linked effective notice-and-action mechanisms to the liability regime: once a platform is made aware of illegal content, continued protection depends on taking adequate measures.taking adequate measures.
d. Private enforcement of the DSA
Finally, the judgment demonstrates the important role national courts will play in developing the DSA’s liability framework. The Court takes the CJEU’s reasoning under Article 14 of the e-Commerce Directive, treats it as applicable to Article 6 DSA and applies it directly to the design and operation of Facebook and Instagram.
It is important to note that this is not a private enforcement action under the DSA itself. The claimants sought relief under national law, including corporate personality rights, image and name rights and trademark law. Article 6 became relevant because Meta invoked the DSA’s liability exemption as a defence to those underlying claims.
This confirms that the DSA does not create the underlying liability for the unlawful content at issue here; Article 6 determines whether an intermediary can be protected from liability arising elsewhere, in this case under national personality rights and trademark law. At the same time, the DSA also imposes substantive obligations on platforms, such as the content moderation duties in Articles 14 or 16, or the fair design and transparency obligations in Articles 25, 27 and 38. As enforcement of the Regulation matures, claims founded directly on these obligations are to be expected. The Frankfurt judgment nevertheless shows how national private litigation can become an important vehicle for defining the scope of the hosting exemption, and how the CJEU’s increasingly restrictive approach has found its way to civil disputes.
e. Outlook: potential qualification of Meta’s services by the CJEU
While Meta has already announced that it will appeal the Court’s judgment, it seems likely that the CJEU will ultimately determine whether Meta’s services can benefit from the hosting exemption, as the German Supreme Court (the Bundesgerichtshof or BGH) has referred several questions about this to the CJEU. These questions arose in the context of a dispute between a member of the Bundestag, the German legislature, about memes disseminated on Facebook which were falsely attributing certain quotes to her. The politician filed a complaint with Meta about specific instances of the memes, which Meta removed. However, she also requested an injunction ordering Meta to prevent these memes from being posted again, regardless of whether she flagged the new posts and requested damages for harm she suffered. In its defence, Meta argued that it was not liable for these memes under the hosting exemption and that the requested injunction amounted to an obligation to generally monitor the content posted by its users, which is prohibited by Article 8 DSA and Article 15 eCommerce Directive. This injunction was granted at first instance and upheld on appeal. Meta appealed to the BGH, which referred several questions to the CJEU, including under what conditions Meta’s platform could enjoy the protection of the hosting exemption where it curates user generated content using an algorithm.
If the CJEU accepts the referral, it will have the opportunity to confirm whether and under what circumstances the hosting exemption applies to social media platforms, clarifying their position after the rulings in Coyote, AGCOM and Russmedia. In our view, the CJEU should accept the referral. Social media platforms operate throughout the EU and have changed drastically since the introduction of the hosting exemption in the eCommerce Directive. It is therefore necessary that the CJEU provides an EU-wide classification of these platforms to reduce the risk of diverging interpretations by national courts.
6. Conclusion
The national judgment discussed in this blog provides another important step in the narrowing of the hosting exemption under Article 6 DSA. Building on the CJEU’s reasoning in Coyote, the Court applies that framework to Meta and gives a more concrete indication of when a platform may move beyond passive hosting and become liable for the content it disseminates, whether through advertising systems or the algorithmic organisation of ordinary user-generated content. That distinction is particularly important in the context of online scams. Where a platform controls how fraudulent content is distributed and derives commercial benefit from the advertising and engagement generated on its services, it is increasingly difficult to treat the platform as a purely neutral intermediary.
The Frankfurt ruling is subject to appeal, but it is a clear sign that platforms will face increased liability for (fraudulent) content in the context of civil DSA litigation.
Leave a Reply