Someone is using my image in Facebook ads. What should I do?

Deal with immediate harm first

An advertisement using your photograph may suggest that you endorse an investment, product or competition. The risk goes beyond an unwanted image: people may send money or disclose information because they trust you. Establish what the advertisement promises and whether anyone has already been affected before treating the incident as a routine content complaint.

Do not make a test purchase, enter credentials or install software promoted by the advertiser. Anyone who has paid or disclosed banking information should contact their bank and the appropriate authorities promptly. CERT Polska accepts reports of suspicious websites in Poland; elsewhere, use the relevant local reporting body. These steps are separate from reporting an advertisement to Meta.

Preserve context, not just your photograph

Record the publication URL, advertiser's profile URL, observation date and time zone. Keep the ad identifier where available. Capture the complete message, sponsor information and call to action. For video, a lawful screen recording with sound can preserve details that a still image misses. Record the displayed destination domain without submitting information to the site.

Keep originals unchanged and create separate redacted copies for sharing. A short evidence log should explain what each file shows and who captured it. If proceedings are likely, ask a qualified lawyer about formal preservation requirements. A screenshot is useful documentation, but should not be presented as automatically sufficient evidence in every legal setting.

Look for related campaigns in Meta Ad Library

Search the official Ad Library using the advertiser's Page name and distinctive wording from the offer. Adjust available country and category filters to the incident. Save the URLs and identifiers of matching advertisements. Paid ads may not appear as ordinary posts on the advertiser's public profile, so searching that profile alone can miss relevant material.

An empty result does not prove that no campaign exists. Available information varies with geography, category, ad status and tool access. Do not assume the library can find every use of a face. A Page name, declared payer or destination domain is a lead for documentation, not conclusive identification of the person responsible.

Report each part of the incident

Describe the actual issue: impersonation, a falsely attributed endorsement or a fraudulent offer. Select an accurate category from the current reporting options and explain your relationship to the person or brand affected. Supply precise addresses instead of asking the reviewer to investigate an entire account without identifying the problematic material.

An ad, a profile and a phishing website are different objects. Keep a separate record of reports and reference numbers for each. Use a copyright route only if you hold the relevant rights or have authority to act: being pictured does not necessarily make you the photograph's copyright owner. Legal assessment of image rights is a separate matter.

Track decisions and follow-up

An acknowledgement is not a removal decision. An advertisement disappearing from your own feed is not proof that the campaign has stopped. Record the response, last check and next action. Where an appeal is available, address the stated reason and add missing context rather than repeatedly submitting an unchanged complaint.

Avoid coordinated false reports or public accusations against an unverified individual. Technical case management can organise evidence and platform correspondence; it does not establish criminal responsibility or replace legal representation. Escalation should follow the channels actually available for that case, not a promise of privileged access to someone inside the platform.

Give your audience a practical warning

Use your official channels to identify the offer you do not endorse and explain how to verify genuine contact. There is usually no need to publish a clickable link to the suspicious site or replay the full advertisement. Ask people to send the URL, date and advertiser details privately, without engaging with the suspected operator.

Give customer-facing staff a consistent response. They should know where to forward evidence and when to advise an affected person to contact their bank. Avoid collecting unnecessary identity documents or card information. A public warning is intended to reduce confusion and harm, not to become another distribution channel for the fraudulent creative.

Check for returning variants

Monitor previously identified profiles, distinctive phrases, product names and destination domains. A changed Page name or cropped image may represent another version of the same incident, but each address still needs verification. Agree who reviews new reports and how frequently checks occur, particularly while the campaign appears active.

Distinguish confirmed removal, material not observed during a check, and content still accessible. No public monitoring process sees every placement or private conversation. The practical value lies in documented actions and earlier detection of recurrence, not a guarantee that your image will never be misused again.

Frequently asked questions

Does publishing a photograph mean consenting to advertising use?

Public availability is not blanket advertising permission. Rights, context and existing agreements matter. A qualified lawyer should assess the specific legal position.

Can MB manage the reporting process?

We can organise evidence, agreed technical actions and platform correspondence with appropriate authorisation. Some checks or declarations may still need to be completed by the affected person.

Sources and reporting routes

Reporting guidance checked on 13 October 2026. Platform options and requirements may change.

This guide covers technical and organisational steps, not individual legal advice. Rights, claims and formal evidence requirements should be assessed by an appropriate legal professional.