Meta’s ad review system approved more than 350 advertisements containing child sexual abuse material. Not user posts. Not content uploaded by bad actors exploiting a loophole. Paid advertisements that Meta’s own automated systems reviewed, approved, and ran across Facebook, Instagram, Messenger, and Threads. The company collected revenue from every single one.
An investigation by the Tech Transparency Project published September 8 documented 332 paid advertisements containing child sexual abuse material that Meta’s automated review approved. Researchers had first shared 53 of them with Wired in early August. More than 250 of the ads ran after Meta claimed it had rolled out new AI detection tools designed to catch them. The ads used AI to morph photos of real children into graphic sexual content. A young member of a European royal family, shown in an officially released photograph, was animated into a video of her performing a sex act. A 14-year-old Instagram influencer showing off her new sports club uniform was turned into a video of her performing oral sex. A preteen girl in stock photos was morphed into footage of her being molested by an adult man.
Many ran for days. The ad copy was not subtle. “I can show you more,” one read. “There are no restrictions. All the characters are real people and there are many options. This is the AI men actually use,” boasted another.
An ad system that cannot detect child sexual abuse
Meta’s entire advertising business rests on the claim that every ad is reviewed before it goes live. Meta says it reviews ads before they run to ensure they meet its advertising standards. That review process, which processes billions of dollars in advertising revenue, could not identify child sexual abuse material in the ad creative itself.
This is not a case where the content was hidden behind a click or buried in a link. The CSAM was sitting in plain sight: in the thumbnail, in the video, in the image that played automatically as users scrolled past. Meta’s systems looked at an ad showing a child being sexually abused and approved it for distribution.
When Wired first reported on 53 such ads in August, Meta’s spokesperson said most of the ads “predate new AI technology we launched recently to better detect and block violating ads at upload.” The company claimed it was constantly improving its systems. TTP then found 332 more ads, many of which ran after Meta said it deployed its new detection technology. Wired’s follow-up investigation put the cumulative total since the end of 2025 at more than 350.
So either the new system does not work, or Meta is not deploying it with the seriousness the problem demands. There is no third option.
Meta dragged its feet even after being caught
When TTP flagged the 300+ ads to Meta, the company removed about half from its Ad Library within hours. But TTP noted a telling detail: many of the removed ads were not initially labeled as violating Meta’s child exploitation policy. They were marked as violating adult content policies instead. Meta only updated the records to reflect child sexual abuse violations after TTP pointed out the discrepancy.
That matters. If Meta’s own records undercount CSAM violations, the public cannot know the true scope of the problem. And if a company this size cannot accurately categorize child sexual abuse material in its own systems after being told exactly which ads contain it, the system is not designed to catch this. It is designed to minimize the appearance of it.
It gets worse. TTP reported live ads containing CSAM through Meta’s own reporting tools, and it took Meta at least a week to review them. During that time, the ads continued running and racked up hundreds more views. On 57% of the 129 CSAM ads TTP flagged through Meta’s reporting flow, Meta responded that the ad did not violate its advertising standards. After TTP’s initial August report, Meta continued running new CSAM ads, including the one featuring the European royal family member. The company’s claim of constant improvement is contradicted by its own Ad Library data.
The Chinese reseller program Meta does not want to talk about
Several of the CSAM ads were placed through Meta’s “top tier” ad agency partners in China, known as resellers. These companies channel billions of dollars in Chinese advertising onto Facebook and Instagram despite Meta’s platforms being banned in China. One reseller, GIMC, is controlled by the Chinese government. Another, BlueFocus, was blocked by CFIUS from merging with an American firm in 2018 and works closely with the Chinese Communist Party, per TTP reporting citing Reuters.
Meta exempts these reseller companies from being punished for violating its policies and does not immediately act when their ads are flagged by automated systems. The vast majority of the CSAM ads pointed to AI apps from China, many of them “nudify” tools designed to digitally strip clothing from images of real people.
Meta built a revenue pipeline that depends on Chinese government-connected ad resellers, exempts them from enforcement, and acts surprised when those resellers flood the platform with ads containing child sexual abuse material. None of this is unintended. The system is doing exactly what it was built to do, and what it was built to do does not include protecting children.
The $18 billion settlement that changed nothing
In August 2026, Meta agreed to pay nearly $18 billion to settle claims from nearly every US state that it designed products to foster compulsive use by children and failed to warn about mental health risks. The settlement requires Meta to impose two-hour daily time limits for users under 18, block access between midnight and 6am, and mute notifications during school hours.
Florida Attorney General James Uthmeier rejected the deal, calling it “peanuts compared to the profound harms Meta’s profit-driven addictive features inflicted on kids” and “a slap on the wrist for a trillion-dollar corp that’ll pay more to lawyers than to the states.” Public Citizen said the settlement “cannot buy back public trust.”
Then Meta started pushing rivals like YouTube and TikTok to adopt the same teen safety features, positioning itself as an industry leader on child protection. While doing that, it was running ads containing child sexual abuse material on its own platforms.
Mark Zuckerberg testified before the Senate Judiciary Committee on the dangers of child sexual exploitation on social media in 2024. His company was running CSAM ads the entire time. Not after. Not before some theoretical future fix. During.
Federal law does not care about Section 230
The ads TTP found are not protected by Section 230. That shield covers user-generated content, not paid advertisements that Meta reviewed, approved, and profited from. Federal law prohibits the production, advertisement, distribution, and possession of child sexual abuse material. The DOJ has explicitly stated that AI-generated CSAM is treated identically to real CSAM under federal law.
Meta did not just host this content. Meta advertised it. Meta collected money for showing it. Meta’s systems reviewed each ad and said yes, this can run. Every single ad in the TTP investigation represents a potential federal violation by a company that knew, or should have known, what it was approving.
TTP reported all identified ads to the National Center for Missing and Exploited Children. Lawmakers told Wired they plan to investigate. They should. In its statement to the press, Meta claimed the CSAM ads collectively reached fewer than 200 impressions each and totaled under $5,000 in ad spend. TTP pushed back on that framing, noting the company declined to answer how many users the ads reached globally, how much revenue Meta actually collected, or whether it had informed law enforcement on its own.
The counterargument and why it fails
Meta’s defenders will say this is an arms race. No automated system is perfect. Bad actors constantly evolve their methods. Meta claims in its own enforcement reports to remove tens of millions of pieces of child sexual exploitation content each year, and has invested in new AI detection tools and taken legal action against nudify app developers. Some fraction of bad ads will always slip through.
But 350 ads is not “some fraction.” This is not a clever evasion that slipped past a sophisticated system. These ads contained child sexual abuse material in the ad creative itself. The images were in the thumbnail. The videos played automatically. The ad copy said “I can show you more” next to a photo of a child.
And Meta’s response was not to aggressively hunt down every instance. It was to remove the ones that were flagged, mislabel them in its own records, and then continue running new ones. The company’s new detection system, which it launched specifically to catch this kind of content, failed to stop 332 additional ads. The reseller program that placed many of them is one Meta knowingly operates with Chinese government-connected companies, exempting them from the enforcement that might have caught the problem earlier.
Setting perfection aside, the relevant gap is one Meta could close. The company built an advertising empire that processes billions of dollars in revenue and could not be bothered to build a review process that catches child sexual abuse material in the ad itself. When your ad system can identify a user’s interests, predict their purchasing behavior, and optimize delivery across two billion people, but it cannot identify a child being sexually abused in the ad creative, the problem is not technical capability. The problem is priorities.
What this means
The same automated system that approved 350 ads containing child sexual abuse material decides what billions of people see every day. It shapes political advertising, consumer behavior, and public discourse. It is the engine of Meta’s entire business. And it cannot reliably distinguish an advertisement for child sexual abuse material from an advertisement for sneakers.
Detection is not what is failing Meta here. Incentives are. Every ad that runs is revenue. Every ad that gets blocked is lost revenue. The system is designed to approve, not to reject. When the cost of a false negative is child sexual abuse material reaching thousands of accounts and the cost of a false positive is one advertiser’s campaign not running, the math is clear about what Meta’s system will optimize for.
Congress is going to investigate. They should. But the investigation should focus on the system, not the incident. The incident is a symptom. The system is the disease. And Mark Zuckerberg should be the one answering questions about why the company he runs built an advertising machine that can target ads with surgical precision but cannot stop itself from profiting from the sexual abuse of children.