← Overview | Case Study

A toxic toy reaches 500,000 parents.
Then it never existed.

A counterfeit children's teething ring — manufactured with lead-contaminated plastic — is advertised on a major platform in the US. The ad runs for 36 hours, reaches half a million parents of infants, and then disappears completely. No archive. No reach data. No way to trace who saw it or who bought it.

The product

Sold for $4.99. Made with toxic plastic.

🧸

"SoftBite™ Baby Teething Ring — BPA Free, Pediatrician Recommended"

$4.99 Ships from Shenzhen Contains lead Not safety-tested Fake certifications

A counterfeit baby teething toy made from toxic PVC plastic with lead levels exceeding US safety limits by 40x. The listing features stolen product photos, fabricated "BPA Free" and "CPSC Approved" badges, and fake 5-star reviews. It ships directly from a factory in China through a disposable seller account on a cheap e-commerce platform.

The campaign

36 hours inside the black box.

Monday, 8:00 AM — Campaign launch

Ad goes live on Meta and TikTok

The seller spends $2,000 on a hyper-targeted campaign. The audience: women aged 22–38, interested in "baby products," "new mom," "infant care" — in Texas, Florida, and California. The ad features a smiling baby chewing the colorful ring, with the tagline: "Pediatrician-approved. Only $4.99 this week."

Budget: $2,000Target: new mothers, 22-38

Monday, 12:00 PM — 4 hours in

Algorithm kicks in. The ad goes viral.

Meta's optimization engine identifies that the ad performs well with first-time mothers aged 25–32. It shifts the budget toward this demographic. Engagement is high — the product is cheap, the photos look trustworthy, the fake badges are convincing.

Reach: 85,000 peopleOrders: ~200

Tuesday, 6:00 AM — 22 hours in

Half a million parents exposed.

The ad has now been served to over 500,000 people. Thousands have clicked through. Hundreds have placed orders. The product is being shipped from a warehouse overseas. No safety test has been conducted. No regulatory body has been notified.

Reach: 500,000+ parentsOrders: ~2,400

Tuesday, 8:00 PM — 36 hours

Budget spent. Campaign ends.

The $2,000 budget is exhausted. The ad stops running. The seller has already made $12,000 in revenue from a product that cost $0.30 to manufacture. The seller account is deleted. A new one will be created tomorrow.

Revenue: ~$12,000Seller account: deleted

Tuesday, 9:00 PM — Hour 37

The ad vanishes. Completely.

The ad is removed from Meta's Ad Library. It was never in TikTok's (which doesn't exist in the US). No content is archived. No reach data is saved. No targeting information is preserved. The campaign is gone — as if it never ran.

Ad content: gone Reach data: gone Targeting: gone Advertiser: gone

Two weeks later

A child is hospitalized.

A pediatrician in Houston discovers elevated lead levels in a 9-month-old. The parent mentions a teething ring bought online. They can't remember the exact ad. The product listing has been taken down. The ad that promoted it to 500,000 parents no longer exists in any public record.

The aftermath.

🇺🇸 What investigators can find

No record the ad ever ran
No reach data — was it 1,000 or 1,000,000?
No targeting info — who was shown this ad?
No advertiser identity — who paid for this?
No way to alert other parents who saw the ad
No data for a product recall investigation

🇪🇺 What the EU would have

Full ad content archived for 1 year
Exact reach: 500,000+ users, demographic breakdown
Targeting criteria: mothers, 22-38, TX/FL/CA
Payer and beneficiary identity on record
Ability to trace all exposed users for safety alerts
Evidence for regulators, lawsuits, and product recalls

In the EU, every step would be on the record.

Under the Digital Services Act, this exact campaign would generate a complete, publicly accessible paper trail.

🇺🇸 United States
Ad ends → immediately removed from Ad Library. No content, no reach, no targeting data preserved. Investigation dead end.
🇪🇺 European Union
Ad ends → archived for 1 full year. Complete content, reach data, targeting criteria, payer identity — all publicly searchable.
🇺🇸 Child hospitalized
Parent can't find the ad. Regulators can't trace it. No evidence exists that the campaign ever ran. Product recall is nearly impossible.
🇪🇺 Child hospitalized
Regulators search the ad archive, find the campaign, identify the advertiser, see exactly who was targeted. Issue a recall within days.
🇺🇸 TikTok
No ad library exists at all. Not even active ads are transparent. Total darkness.
🇪🇺 TikTok
Full DSA-compliant library. Active and historical ads, targeting, reach, engagement metrics — all on the record.

The story above is illustrative — these are not

This actually happened.

The toy above is a composite. Every case below is real, on the public record, and maps onto a beat of that scenario — with sources you can open.

Fake safety badges, weaponized at scale

US Consumer Product Safety Commission · May 2026

The CPSC launched a national crackdown on counterfeit safety labels and imitation certification marks — the exact "CPSC Approved" and "BPA Free" badges scammers fake — used to move dangerous, mostly foreign-made products into US homes through e-commerce. The regulator's own words: bad actors "are increasingly using counterfeit certification marks to evade US safety requirements."

Mirrors the storyThe fabricated "Pediatrician-approved / CPSC Approved" badges on the SoftBite listing aren't a fictional flourish — they're a documented, regulator-confirmed tactic.

Live for 48 hours. Then it vanished.

Which? · ACCC v Meta · 2025

Consumer group Which? found Facebook ads using a deepfaked video of finance expert Martin Lewis and a fake BBC page to push a crypto scam. The ads were live "for only two days" — long enough to reach victims, short enough to leave no public trace. Australia's competition regulator has taken Meta to Federal Court over the same category of celebrity investment-scam ads.

Mirrors the story"36 hours, then the ad vanishes completely" is not dramatization. Real scam ads run for exactly this long and disappear on schedule.

When investigators went looking, the data was gone

US House Intelligence Committee · 2016–2018

Russia's Internet Research Agency ran 3,519 Facebook ads seen by 11.4 million Americans. They became public only when Congress subpoenaed and released them years later. And when a researcher demonstrated Facebook had under-counted their reach, Facebook deleted the cached ad data analysts had been using — describing it as fixing "a bug."

Mirrors the story"No content archived, no reach saved, no record it ever ran" is the real aftermath of the highest-profile ad-influence case in US history — where even a hostile foreign campaign left almost nothing behind.
A $2,000 ad campaign can put a toxic product into the hands of thousands of families — and after 36 hours, there is no public record it ever happened.

This is not a loophole. This is the system working as designed.

See the platform transparency data →