Germany: Hamburg police move against AI-generated "female officers" selling adult content access
Hamburg police say a wave of social media accounts is posing as female officers using AI-generated images to push paywalled adult content. Some profiles have drawn tens of thousands of followers, featuring photorealistic women in German police uniforms-images the force says show people who do not exist.
On 18 December, the force confirmed it is examining legal steps and warned that these accounts damage police credibility. Officials also stressed they do not permit private Instagram profiles for individual officers and enforce strict rules on how personnel present themselves online.
The playbook behind the accounts is simple: uniforms, authority cues, and suggestive imagery to build trust fast-then paywalls for "exclusive" content. Police have urged users to report suspected fakes directly to platforms.
Why this matters for legal teams
This isn't just image manipulation; it's impersonation, potential fraud, and misuse of protected insignia. For counsel advising public agencies, platforms, or payment providers, the exposure cuts across criminal, civil, and regulatory risk.
Key legal angles in Germany and the EU
- Criminal fraud (StGB §263): Monetizing access through deception (posing as police) may meet fraud elements if users are induced to pay based on false claims.
- Misuse of official uniforms/insignia (StGB §132a): Unauthorized use of police uniforms and badges is prohibited and can be pursued regardless of whether the "person" is real or AI-generated. Text of §132a (German)
- Misleading commercial practices (UWG §5): Suggesting endorsement, affiliation, or official capacity can trigger enforcement under unfair competition rules-relevant where accounts solicit payments.
- Use of official emblems (MarkenG/Paris Convention): Official symbols enjoy special protection; commercial use can be restricted or unlawful even without trademark registration.
- Platform obligations (EU Digital Services Act): Platforms must act on notices of illegal content and have processes for impersonation and deceptive practices. EU DSA overview
- Deepfake transparency (EU AI Act): New EU rules include disclosure duties for AI-generated content ("deepfakes"). Legal teams should track rollout dates and enforcement guidance for content providers and platforms.
- Personality and image rights (KUG/APR): If a real officer is named, referenced, or portrayed, claims under the right of personality and the right to one's image may arise, alongside injunctive relief.
Immediate steps for in-house and external counsel
- Preserve evidence: Capture URLs, timestamps, source code, payment flows, and full-screen video of signup/pay sequences.
- Issue platform notices: File impersonation and illegal content reports, request account suspension, and seek preservation of data for potential criminal proceedings.
- Criminal referral: Prepare filings for fraud and misuse of official insignia; coordinate with cybercrime units.
- Civil remedies: Send cease-and-desist letters (Unterlassung), pursue injunctions, and request orders against use of insignia or any suggestion of affiliation.
- Cut monetization: Notify payment processors, affiliate networks, and ad platforms about deceptive practices to choke off revenue and data collection.
- Brand and insignia governance: Document protected insignia, publish clear usage policies, and set up a rapid takedown protocol with platforms.
- Internal comms: Reiterate social media rules to staff: no private "officer" accounts, no uniformed content outside official channels.
Red flags investigators should log
- Uniform details that don't match current issue, inconsistent insignia, or generic patches.
- Accounts claiming "private profiles" for officers, paywalls for "exclusive" officer content, or off-platform payment requests.
- Image artifacts consistent with AI generation (hands, text on patches, backgrounds) and mismatched metadata.
What Hamburg police are asking the public to do
Report suspected fake profiles directly to the platform. Do not pay for access or share personal data. If you've already paid, keep records and report the incident.
Bottom line
These accounts are engineered to look official, convert curiosity into cash, and erode public trust. The legal toolkit is already there-fraud, misuse of uniforms, unfair competition, and platform duties under the DSA-so speed and coordination are what matter.
Want to brief your team on AI risk and compliance? See practical course collections by role: Courses by job.
Your membership also unlocks:
