The same week most of us were heads down on Q4 planning, two Meta stories collided, and together they matter more than either does alone. On September 8, 2026, the Tech Transparency Project published findings that more than 300 ads containing child sexual abuse material ran on Facebook and Instagram. At the same time, Meta is moving ahead with a change that removes several placement controls from ad sets, limiting advertisers' ability to exclude individual placements, platforms, device types and operating systems. If you buy Meta ads for a law firm or a medical practice, your ads pass through the same review system that approved that content, and the manual levers you might use to control where your ads appear are being taken away. That deserves your attention this week, not next quarter.
What the Tech Transparency Project Report Found
The numbers in the report are specific and grim. Meta ran more than 300 advertisements on Instagram and Facebook containing suspected child sexual abuse material this year, and the ads collectively reached more than 29,000 people, typically using artificial intelligence to depict young children. Most of the 332 ads showed a photo of a child that was digitally altered with AI, and TTP identified multiple photos of real children, including a young member of a European royal family, that were used in the ads.
This was not old inventory from before Meta tightened its systems. The majority of the 332 ads, 274 of them, ran in August of this year. More than a dozen ads appeared on Meta platforms even after TTP made the company aware of its findings.
Many of the ads promoted deepfake nudify apps, which the group traced in an earlier report to app developers and a Meta advertising partner in China.
The Ad Review System Screening Your Ads Approved These
Here is the part that should concern every advertiser, whatever they sell. The failure happened after Meta said it had fixed the problem. Wired reported last month that about 50 ads running on Facebook, Instagram, and Threads contained child sexual abuse material, and Meta removed the ads and said most had been published before it introduced new AI tools intended to detect and block harmful advertising. When TTP researchers tried to verify whether the new safeguards were working, they instead found more than 250 additional ads containing child sexual abuse material on Facebook, Instagram, Threads, Messenger, and Meta's broader advertising network since the beginning of August.
Meta disputes the framing. The company told the BBC it does not tolerate nudify apps or any kind of child exploitation, real or AI generated, and said criminals constantly shift tactics to evade detection, which is why it keeps strengthening enforcement. The watchdog's response was blunt. Campaign for Accountability's executive director said that if this content gets through, "Meta's whole ad review system should be called into question".
For advertisers, the practical takeaway is about adjacency. The auction that decides where your ad appears is the same auction that placed these ads next to real users. Your firm's ad can appear one scroll away from content like this, on surfaces you never consciously chose.
Meta Is Removing Placement Exclusions From Ad Sets
Which brings us to the second story. According to a notice shown to advertisers in the Placements section of Meta Ads Manager, users will no longer be able to remove individual ad placements or exclude an entire platform, and per Meta ads strategist Jon Loomer, advertisers will also be unable to restrict campaigns to mobile or desktop devices or target specific operating systems.
The rollout has limits worth knowing. It is a test for now with plans to expand more broadly, and sensitive verticals have been excluded from the update, which presumably means special ad categories and possibly health and wellness. It currently applies only to Sales and Leads objectives, with full placement control remaining for all others. Law firm lead generation campaigns typically run on the Leads objective, so this lands squarely on our audience once it expands.
One related date is already fixed. Messenger Stories is removed as a placement on 27 August 2026, and that date is confirmed. And note that exclusions were already soft: Meta already routes up to 5 percent of an ad set budget to placements you excluded.
What Controls Remain: Value Rules and Account Settings
Control is not gone, it has moved. Advertisers can use value rules to adjust bids based on certain placements, devices and mobile operating systems, and value rules currently allow bid adjustments across seven eligible placements, with several more placement options coming to placement value rules. Understand the difference: a value rule can push a bid down sharply, but it is a discount on delivery, not a wall. Reporting on the change notes that the value rule replacing the checkboxes can cut a bid by 90 percent but cannot switch a placement off, so brand safety exclusions built at the ad set level effectively turn into a discount.
The stronger tool sits at the account level. Advertisers can make placement restrictions at the account level through Advertising Settings under Account Controls and Placement Controls. That removes placements across the whole account, which makes it a policy rather than a tactic, fine for a brand safety rule but wrong for a single three week test. For a law firm or medical practice, a policy is exactly what you want.
What Practices Should Do Now
A law firm sells judgment and discretion. A medical practice sells trust. Neither can afford a screenshot of its ad adjacent to exploitative content, and the combination of a leaky review system and disappearing exclusions raises the odds of exactly that. Here is the work for this week:
- Set account level placement controls now. Restrict the account to the surfaces you actually want, such as Facebook and Instagram feeds, Stories and Reels, and evaluate whether Audience Network belongs in your plan at all, since TTP found violating ads on Meta's broader advertising network, not just the main apps.
- Document every ad set level exclusion you rely on today, including placements, platforms, devices and operating systems, so you can rebuild the intent in value rules and account settings when the checkboxes disappear.
- Configure value rules on the eligible placements you want to suppress, and treat them as bid pressure, not as a guarantee.
- Screenshot and archive your current settings and review your delivery breakdowns by placement monthly, so you can show partners or compliance officers where firm ads actually ran.
- Brief the partners and practice leadership on the TTP findings before they read about it elsewhere, and agree in writing on which surfaces the firm accepts.
- If your campaigns sit in a sensitive vertical, confirm in Ads Manager whether the placement change has reached your account, since Meta has not confirmed a firm global rollout date and the change appears to be reaching accounts in waves, with some advertisers already reporting the option missing.
The Bottom Line
Two separate stories, one lesson. Meta's automated review approved hundreds of the worst ads imaginable in a single month, and Meta is simultaneously asking advertisers to hand over more control of where their ads run. The advertisers who come through this cleanly will be the ones who moved their brand safety rules to the account level early, kept records, and decided deliberately which surfaces carry their name. Do that this week, while the choice is still fully yours.
