An investigation by the Tech Transparency Project has documented hundreds of paid advertisements with manifestly illegal content, involving minors, approved and then monetised by a major platform between November 2025 and August 2026. We do not describe these contents, we name no service concerned and we detail no mechanism. What interests us here is the system that let them through, and what it would take for it not to happen again.
The platform in question states that the majority of these ads had limited reach and that many have been deactivated, attributing the failures to automated review. This explanation is probably accurate, and that is exactly what is problematic.
Why automated moderation fails here
Three structural reasons, and none of them is a bug.
Volume makes automation unavoidable. A platform processing millions of ads cannot have them reviewed one by one by humans. Automated review is not a cost-saving choice, it is a consequence of scale.
A classifier has a threshold. Any detection system produces false positives and false negatives, and the cursor between the two is set. A strict setting blocks legitimate ads and costs revenue. A permissive setting lets things through. That setting is an economic decision disguised as a technical parameter.
Generation produces the new. A system trained to recognise known content is structurally behind content that is fabricated. We wrote this about detecting generated text: detecting what is produced to evade detection is a losing race.
What sets this case apart from others
A platform hosting illegal content published by a third party falls under an established legal regime: it must remove it once notified.
Here, the situation differs on two points. These contents were reviewed and approved before distribution, as part of an advertising validation process. And they were monetised: the platform received a payment.
The liability regime applicable to a passive host does not cover in the same way an activity in which one validates and invoices. This is precisely the distinction European regulators have been working on for several years.
The European regulation on digital services imposes specific advertising obligations on very large platforms: assessing systemic risks, particularly for minors, putting mitigation measures in place, and submitting to independent audits. We noted regarding the Californian texts that the protection of minors came up in every piece of legislation in preparation. This type of case is exactly what these instruments target, and it constitutes a test of their real-world application.
What this says about the advertising model
There is a fundamental point that goes beyond this platform.
An automated advertising system is optimised for one thing: reducing the time between the submission of an ad and its distribution. Every hour of review is deferred revenue.
This optimisation is in direct conflict with serious review. It is not a trade-off between quality and cost, but between speed of monetisation and verification, and the first term is the one internal metrics measure.
It is the same mechanism we described in our article on what deserves to be automated: a task whose error is invisible to the person automating it will be automated, because nothing in the system signals the cost of the error.
What would be needed
Three measures, and none of them is technological.
Mandatory human review for at-risk categories. Not for everything, which is impossible, but for ads involving minors or touching on sensitive areas.
Financial liability on monetisation. A platform that has received revenue from illegal content should at the very least return it, and bear a proportionate penalty. Without financial consequences, the setting of the cursor will remain favourable to volume.
Published independent audits. The fact that this case came from an outside organisation rather than a check provided for by the framework speaks volumes. We made the same remark about the British institute's warnings: what makes progress is verification by third parties.
What to take away
Citing automated review as an explanation is not an excuse: it is an acknowledgement that the system is calibrated to let through a certain volume of errors, and that this calibration was chosen.
The question is therefore not whether automation can be perfect — it will not be — but who bears the cost of its failures. Today, that cost is borne by the people concerned and documented by associations. It appears in no income statement, and that is precisely why nothing changes.