Meta Publishes a Rebuttal to the Instrat Report

The arena for the dispute is Meta's advertising platform, which runs Facebook and Instagram. More precisely, it is the ad data window that platform keeps open to the outside world under the European Union's Digital Services Act: the Meta Ad Library. The foundation scraped that window for its estimate, and Meta replied that the numbers coming out of it should not be read that way. Because both sides are working from the same data, this is a story about advertising and, at the same time, a story about measurement.

The foundation put forward four numbers. Scam ads accounted on average for 10.85% of all ads served on Meta's platforms in Poland by impressions, which works out to about 2.08 million zloty a day for Meta, or roughly 760 million zloty a year. The report puts the 2025 revenue of Meta's Polish entity at 2,033,858,558.95 zloty, and states that if the arithmetic holds, scam ad revenue amounts to 37% of the Polish total. The fourth number is 41%, the share of scam ads that never appear in the Ad Library at all.

The material for that calculation came out of the limits of collection. The report notes that Article 39 of the Digital Services Act requires ad data to be made available through a searchable tool and an API, and states that in practice a single person can download only about 50,000 ads a day. Hundreds of thousands of ads run in Poland daily, so a single day's worth cannot be pulled in a single day. On top of that, the report says the November 2025 pull stopped at 386,000 records, February 2026 at 258,000 and March at 171,000, each time with an unknown error. As a result, across July and August 2026 the only days fully captured were one each from October and December 2025 and January 2026: three days.

Classification was the second ingredient. The foundation used whether Meta had removed an ad as the key for deciding which ads were scams, writing that the assumption that Meta's reviewers and software are effective at catching violating ads is the best available basis for classification. Because impressions and costs are not published for removed ads, it multiplied EU-wide reach by an assumed frequency to produce impression counts, and used 20.65 zloty, the benchmark cost per thousand impressions for all ads in Poland.

Those are exactly the three places Meta went after. The rebuttal calls the report "fiction that misleads the public," and says treating every removed ad as a scam is wrong from the start, because its systems run on a broad set of standards covering restricted goods and services, third-party intellectual property, ad quality and format, not scams alone. Reach figures for 27 member states were treated as Polish user figures, the rebuttal says; the assumption that one person sees an ad three times comes from an American company's estimate drawn from a small sample of 2,800 of its clients; and the price is an abstract number the authors themselves admit they could not derive empirically. It also notes that the three days differ from one another by as much as 80%, and that those values were averaged and multiplied out to a year.

Part two of the report is a different exercise. The foundation collected ads by hand in the official Instagram app on an iPhone, using an account on which it had deliberately built up a history of viewing and clicking scam ads. In sessions of no more than ten minutes, between 10 July and 17 August 2026, it gathered a sample of 108 ads. One case it cites is an ad using the face of a Polish businessman that led to a site impersonating the finance ministry, while the same ad appeared in the Ad Library as an advert for a pet grooming brush. Meta seized on precisely this passage, arguing that 108 ads seen on one device through an account primed to attract particular ads is not representative of what an average user experiences.

Meta also put forward numbers of its own. According to the rebuttal, between July 2025 and June 2026 it removed 137,000 scam ads in Poland, more than 88% of them before anyone reported them. Between July 2024 and June 2026, the rate at which users reported scam ads per ad impression fell by 83% in Poland. From data coming out of the same window, one side counts the 41% that is not captured and the other counts the 88% that was caught.

Newly installed measures are listed in the rebuttal as well. Poland was among the first countries in Europe to get a new AI system that limits ads impersonating public figures, and since deployment it has found and removed 50% more celebrity-impersonation ads than the previous system. Identity verification has been extended to 100% of financial services advertisers targeting Poland, and the company states a goal of having 90% of Meta's global ad revenue come from verified advertisers by the end of 2026. A scam protection centre with a Meta AI assistant that helps users report scams is also described.

Both documents carry interests. Page two of the report states that the publication was commissioned by the law firm SKP, and Meta's rebuttal argues that the report was prepared by a law firm representing someone who has sued Meta, and should be judged in that context. On the other side, Meta is a party disputing the size of its own advertising business. That neither document is a neutral observation is exactly what makes the case for third-party verification here.

So the question left standing is less who is right than who is able to count. The foundation fell back on a three-day sample not out of laziness but because of a throughput of 50,000 records a day and a retention window of one year. The report also notes that an ad can take up to 24 hours to appear in the Library, and the foundation explains that scam advertisers exploit that gap by posting a scam ad and swapping its content for something harmless a few hours later. The structure of this dispute is that the accuracy of oversight is bound to the width of a window set by the party being watched.

The foundation's own statements came under two names. Jarosław Kopeć, co-author and head of its digital economy programme, said, "Meta effectively limits access to data about these ads, but our analysis suggests that the share in Poland may be as much as three times larger." Michał Hetmański, the foundation's president and a co-author, argued, "This is not an accident at work; it is the work of organised criminal groups." The report also records that Krzysztof Gawkowski, Poland's minister of digital affairs, filed a formal request with the European Commission in August 2026 for a 250 million euro fine on Meta.

METAL has reported that the European Union designated ChatGPT as a very large search engine and tightened its regulation. METAL has also covered Meta's global launch of Meta One, which takes money by subscription instead of advertising. Both threads point to a moment in which the economics of an ad-funded platform are being shaken from the direction of regulation and pricing at once.

This dispute is more likely to end at the data window than in a courtroom. Three of the foundation's four recommendations are about fixing the Ad Library, and the fourth asks the European Commission to scrutinise compliance with the Digital Services Act. Meta's target of 90% verified advertisers and the foundation's figure of a 41% grey zone are both values that can be checked within the same year. Whose arithmetic was standing will be answered then, not by the two documents but by the window.