Polish regulator opens investigation into Meta over deepfake scam ads
Poland's data protection authority opened an administrative investigation into Meta's Facebook and Instagram operations after complaints about deepfake scam advertisements that used real people's images to defraud users. The regulator determined that personal likeness constitutes protected personal data under GDPR and requested further action from Ireland's Data Protection Commission and the European Commission.
What happened
Fraudulent advertisements featuring deepfakes and manipulated images appeared on Facebook and Instagram. These ads used images of real people, including prominent individuals, to deceive users into sending money or sharing personal data.
The Polish Data Protection Authority (UODO) opened an administrative proceeding against Facebook Poland in response to complaints. UODO requested a draft decision from Ireland's Data Protection Commission regarding Meta Platforms Ireland, which has been under investigation since July 2024.
Reported impact
Users were tricked into making payments or disclosing personal information through deepfake and scam advertisements. The incidents affected multiple users across Poland on Facebook and Instagram platforms.
Index analysis
UODO determined that a person's likeness constitutes personal data protected under GDPR. The regulator treated the complaint as notification of systemic irregularities in Meta's content moderation practices.
UODO submitted a request to the European Commission for systemic action against deepfake-based fraud schemes.
Governance controls
Meta's moderation practices and compliance with data protection obligations were under scrutiny. The platforms could not claim exemptions from liability based solely on a passive intermediary role, according to UODO's stance.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.