Meta approved and displayed dozens of paid advertisements containing AI-generated child sexual abuse material (CSAM) across Facebook, Threads, Messenger, and Instagram, reaching thousands of accounts, according to a report from Wired and corroborated by Engadget.

The ads were discovered by researchers with the Tech Transparency Project (TTP), who found them in Meta's ad library. All of the ads TTP identified were posted between November 2025 and August 2026. More than 50 of them passed through Meta's ad review process, which relies on automated tools, before going live.

TTP Director Katie Paul stated that the ads made no effort to hide what they were promoting. They were reviewed, approved, and allowed to run by Meta. Several of the ads linked out to "nudify" apps — tools that use AI to create fake sexual images of real people, often women and girls, without their consent.

Meta's own advertising standards explicitly forbid ads that "contain content that sexually exploits or endangers children" and ban sexually explicit adult content from its ad system entirely. The gap between that written policy and what the automated review system actually allowed through is the core of this story.

In a statement to Wired, Meta said it works aggressively to keep sexual exploitation off its platform, that most of the ads had minimal reach, and that many were disabled before Wired shared its findings with the company. Meta also noted that it removed over 36 million pieces of child sexual exploitation content last year. The company did not, per the reporting, dispute that the ads had been approved and served.

This is not an isolated incident. The BBC reported in July that Instagram ran ads advertising child sexual abuse material in India. In April 2026, the Consumer Federation of America sued Meta for failing to deal with scam ads on its platforms. Taken together, these events point to a pattern in which Meta's automated ad review system has repeatedly failed to catch content that violates both its own policies and criminal law.

The structural problem is straightforward to describe and difficult to solve. Meta processes an enormous volume of ads, and its review system relies on automated software to decide what gets through. For years, platforms have caught known CSAM using a method called hash-based detection. Think of it like a bouncer checking IDs against a list of known offenders — if an image matches one already on the list, it gets blocked. But AI-generated CSAM is new material. It does not exist in those databases, so the blacklist approach cannot catch it. That leaves platforms dependent on a different kind of automated system — software trained to spot the visual signs of child exploitation. On the evidence here, that software failed to flag material that Paul says was not even disguised.

The commercial dimension of this failure matters as much as the safety dimension. These were paid placements. Meta's ad system not only hosted the content but actively distributed it to targeted users in exchange for advertising revenue. An ad review system that approves CSAM-linked content is not merely a moderation failure; it is a revenue pipeline that financially benefited from the distribution of illegal material. The advertisers paid Meta, and Meta served the ads.

The connection to "nudify" apps deepens the concern. These tools, which use AI to strip clothing from images, have spread rapidly and are frequently advertised on social media platforms. That several of the CSAM ads TTP found linked directly to such apps suggests the ads were not accidental violations but deliberate marketing for tools designed to create non-consensual sexual imagery.

Meta's scale makes this hard, but its resources make the failure hard to excuse. The company reported removing 36 million pieces of child sexual exploitation content in a year, a number that indicates both significant enforcement effort and the sheer volume of material it must contend with. The question TTP's findings raise is whether Meta's automated review can be made reliable enough to stop CSAM at the ad-approval stage, or whether the volume and adversarial nature of the content make that a fundamentally unattainable bar for fully automated systems.

The regulatory landscape is moving, though perhaps not fast enough for critics. The Consumer Federation of America lawsuit in April signals growing legal pressure on Meta's ad practices, though that suit addresses scam ads rather than CSAM specifically. Whether the TTP findings accelerate regulatory or legislative action on AI-generated sexual exploitation content is an open question.

For engineers and trust-and-safety professionals, the takeaway is concrete. Hash-based CSAM detection does not cover AI-generated material. Automated classifiers failed here on content that was, per the researcher's account, unambiguous and unmasked. The ad review pipeline approved and monetized that content. Each of those failure points is a separate technical and operational problem, and each will need a different solution.