Meta defends ‘Robust’ ad review after Instagram runs child sexual abuse ads

Meta’s ad review “may not catch every violation,” the company conceded in a July 7 blog post defending the same process as “robust,” days after a BBC Eye investigation found Instagram running paid advertisements promoting child sexual abuse material (CSAM) in India. The advertisements used terms such as “rape video” and “child video” and linked to Telegram channels selling the material for as little as Rs 99.

The Ministry of Electronics and Information Technology (MeitY) has issued Meta a seven-day notice to explain how the advertisements passed review and directed Instagram to disable all such advertisements and content.

How does Meta’s ad review work? Meta’s Advertising Standards set out the process:

• Every ad is reviewed against the policies: “When advertisers place an order, each ad is reviewed against our policies,” Meta states. Those policies identify child sexual exploitation as a prohibited category.
• The first check is automated: The review “relies primarily on automated tools” and “starts automatically before ads begin running.” For most ads, that automated pass is the only review they receive.
• What the system scans: The review covers “images, video, text and targeting information, as well as an ad’s associated landing page or other destinations.” The destination in this case was a Telegram link where the material was sold.
• A human enters only when the software is uncertain: The software “rejects or approves adverts, escalating cases for human review when it is uncertain,” Meta told the BBC. An ad that the automation confidently approves runs without any human review.
• Re-review happens after the ad is live: Ads “remain subject to review and re-review at all times, and may be rejected or restricted for violation of our policies at any time,” including after they begin running.

Meta told the BBC that “every advert is reviewed before being allowed on its platforms,” while standard posts “are not generally checked” until after they are published.

If the process is robust, how did the ads run? Meta’s Advertising Standards state that its “review process may not detect all policy violations.” Its July 7 post adds that “determined criminals will continue to try to exploit our platform, including through our advertising systems.” Three points in the pipeline explain the gap:

• The automated gate does not comprehend content. It matches an ad against Meta’s policies. An advertiser engineering CSAM ads to evade that check has to beat one automated pass to reach users.
• Confident approval skips human review. Because human review is triggered only when the software is uncertain, an ad that the software clears is published without any human reviewing it.
• The real catch comes after delivery. Re-review and user reports operate only after the ad is already live, meaning a CSAM ad was already delivered, paid for, and pointing users to Telegram before any correction.

The human backstop failed even when it was…