Citation Laundering: What a German Court Just Confirmed About AI Overviews

Entidex exists to answer one question precisely: what do AI engines say about an entity, and is it true? To do that we resolve brands, people, products and organisations to canonical, verified records, then measure how each engine perceives them. In the course of that work we caught an AI engine doing something specific and damaging. This is the case study of both halves: the incident we observed, and the ruling that confirmed why it matters.

The incident

On 6 June 2026, we ran a simple query through Google’s AI search: “What does AI say about PBD Podcast?”

Google returned a detailed, confident answer. It cited AI Visibility scores, Share of Voice percentages, Sentiment ratings, competitor mappings, and narrative divergence analysis. It described the precise gap between how the press frames the show and how the show’s own content positions itself. It even named the specific AI engines involved — ChatGPT, Perplexity, Grok — and quantified their coverage.

Every observation came from our entity page for PBD Podcast. Google’s AI Overview cited none of them back to us. Instead, the response attributed its claims to general-interest and social domains that contain no entity intelligence data, no visibility scoring, and no cross-surface Sentiment analysis. The citations were anchors bolted onto real data to give the appearance of sourcing.

This is what we call citation laundering. The reproduction had three properties that, taken together, define it:

1. Provenance stripped.The structured signal we had resolved and verified appeared in the engine’s answer with no attribution back to its actual source.
2. Restated in the engine’s own voice.The data was not quoted or linked — it was absorbed into a fluent, declarative statement presented as the engine’s own knowledge.
3. Fabricated citations attached. The engine appended source links that, on inspection, did not contain the claim being made.

What the data shows

The Entidex entity page for PBD Podcast contains live intelligence compiled from 42+ collectors across 8 signal categories. The numbers it presented were not estimates or general knowledge. They were specific, proprietary metrics from a live intelligence pipeline:

These are not numbers that exist anywhere else on the internet. They were presented as though they were common knowledge, with citations pointing to domains that have never published them.

Why this is worse than a normal error

A wrong link is recoverable — you click it, you see the source, you judge for yourself. A laundered claim removes that escape hatch. The reader has no way to tell that the citation is decorative. The confidence is manufactured at the point of synthesis, and the audit trail that would let anyone check it has already been destroyed.

This is exactly the failure mode Entidex was built to catch, because it is invisible to the entity it harms. A brand does not know an engine is misrepresenting it unless something is continuously comparing what the engine says against a verified record of what is true.

What the structured data shows

We checked our own markup after the incident. The entity page carries:

• A schema.org/Dataset block declaring Entidex as the creator, with a DataDownload distribution pointing to our API.
• A schema.org/Thing block identifying the entity, with sameAslinking the podcast’s canonical domain.
• A schema.org/BreadcrumbList for navigation context.
• Full OpenGraph and Twitter Card metadata with entity-specific descriptions.
• A canonical URL, proper meta descriptions, and robots: index, follow directives.

The structured data is not merely present — it is comprehensive. It tells any crawler, including Google’s, exactly where this data comes from, who produced it, when it was last updated, and how to access it programmatically. The AI layer ignored all of it. This suggests that Dataset JSON-LD, while useful for traditional search indexing, is not yet being honoured by AI Overview for citation attribution. Discovery and attribution are separate problems, and generative engine optimization has to solve both.

The ruling

The Regional Court of Munich issued a preliminary injunction barring Google from repeating false statements about two Munich-based publishers, whose names its AI Overviews had wrongly tied to scams, subscription traps and dubious business practices — connections that appeared in none of the cited sources.

The court’s reasoning is the part that matters. It refused to treat AI Overviews like ordinary search results:

• Ordinary search links; AI summaries author. Traditional search surfaces indexed third-party content with a title, snippet and link. AI Overviews instead evaluate and combine multiple sources into what the court called “independent, new, and substantive statements.” That makes the output Google’s own speech, not a forwarded third party’s.
• The host-provider shield does not apply. German higher-court precedent had given search engines limited liability precisely because they only made third-party content findable. The Munich court found that reasoning breaks the moment the system writes its own answer.
• “Just check the sources” is not a defence. Google argued users can dig deeper and verify. The court rejected it: the feature presents a self-contained answer, and the reader is not obliged to cross-examine it.
• Only the operator can do the check.The court observed that verifying these statements means comparing the underlying third-party sources against the engine’s own output — and that only Google is positioned to do that internally.

The court classed Google as a direct source of the false content rather than an indirect intermediary, and ordered it to stop the specific statements or face penalties.

The status, stated honestly

This is a German ruling, a preliminary injunction, and not final— Google has said it is reviewing the decision and is expected to appeal. It builds on a more cautious Frankfurt decision from September 2025 (2-06 O 271/25) that accepted AI-overview liability was possible but declined to grant relief on those facts. Munich went the further step and prohibited specific false statements.

It is not, on its own, law in the UK or US. What it is — and why it matters far beyond Germany — is the first clear judicial articulation of a principle every operator of an answer engine now has to reckon with: synthesis is authorship, and authorship carries responsibility.

Why the two halves are the same story

Read the court’s description of the mechanism against the incident we documented. They line up point for point.

The court arrived independently, through legal reasoning about one publisher dispute, at the same description of the failure mode Entidex set out to measure. That is the validation. Not that we predicted a court ruling — that the mechanism is real, repeatable, and now legally consequential enough that a court has named it.

What this means, and where Entidex sits

For brands, publishers and organisations, the practical takeaway is blunt: an AI engine’s confident misstatement about you is no longer a curiosity. It is a documented category of harm with, in at least one jurisdiction, a remedy path. But a remedy path needs evidence, and the laundering step is designed to destroy the evidence at source.

That is the gap Entidex fills. The court named a check that, inside Google, only Google can run. Entidex runs the equivalent check from the outside:

That dated record is precisely what an entity needs beforeit can act — the standing evidence that survives the laundering step, the artifact you would attach to a correction request or hand to a lawyer. In this case the Munich publishers sent a cease-and-desist and Google did not fix it; the dispute escalated because the harm was demonstrable. Demonstrability is the whole game, and it is what we produce.

It also reinforces why we publish a machine-readable verified record for every entity — an agent- and crawler-readable knowledge statement designed to close the AI knowledge gap at the point of ingestion, rather than hoping attribution survives the synthesis layer.

Frequently asked questions

Methods & sources

The incident was identified through Entidex’s standard entity-observation workflow against a verified canonical record. We do not disclose probe internals, model rotation or scoring methodology; the public methodology covers what each metric measures and how to read it.

Ruling details are drawn from contemporaneous reporting of LG Munich I case 26 O 869/26 (28 May 2026), including coverage by The Decoder, heise online and others, and the prior Frankfurt decision 2-06 O 271/25 (September 2025). Quoted phrasing of the court’s reasoning reflects published translations of the German ruling.