From Creatives to Entities: How Meta Started Checking Gambling Ad Licences in 2026

Among media buyers there’s a comfortable axiom: Meta’s moderation looks at the picture, so the creative decides everything. Clean on review, working in-feed, and from there it’s just arithmetic — how long the ad survives before takedown, and whether the funnel recoups the spend before it goes. The autumn of 2026 shook that axiom hard. In a single week, five separate storylines landed from five different jurisdictions. On their own, none is an apocalypse. Together, they change the question the platform asks an ad: not “what’s on the creative?” but “who sits at the end of the chain, and do they hold a licence for this geo?”

Let’s sort out what here is confirmed fact, what is a one-sided claim, and what is still rumour — and, above all, what a buyer should do about it.

The week people stopped merely complaining about Meta

The late-September timeline was dense:

• Sep 24 — Florida’s attorney general sent letters to Google, Meta, Reddit, Snap and TikTok over sweepstakes-casino ads, with an October 23 response deadline.
• Sep 25 — Brazil issued provisional measure MP 1,394: new betting ads banned immediately, existing ones to be pulled by October 5.
• Sep 28 — the Dutch association of licensed online operators served Meta with a summons to the Amsterdam court under the Digital Services Act (DSA).
• Sep 29 — the lower house of the Dutch parliament passed a motion to fine the platform itself for repeatedly showing illegal ads.
• Sep 30 — at an industry summit in Lisbon, operator Paf announced a pilot with Meta in Switzerland: it will hand the platform licences and URLs of legal operators and affiliates.

So it doesn’t all collapse into the usual “Meta is shutting down gambling in the EU,” here are the statuses up front:

• The DSA lawsuit against Meta in the Netherlands — fact (the association’s own filing).
• Fines for platforms in the Netherlands — fact, but not yet law: the motion passed, but the statutory amendment still has to be written.
• The Florida AG’s letters — fact (the AG’s publication; the letter texts are in the trade press).
• The orders to platforms in Brazil — fact (data from the relevant ministries).
• The Paf–Meta pilot — a one-sided claim: Paf’s words, which Meta has not publicly confirmed.
• Mass “policy holds” on EU agency accounts — rumour: no sources, no numbers, no screenshots.

Switzerland: the Paf–Meta pilot — loudest and most fragile

Start with the loudest item, which is also the least verifiable. On a Scandinavia panel, a Paf representative said the operator had agreed a pilot with Facebook against illegal gambling advertising in Switzerland.

Paf is an operator owned by the Government of Åland and the technology partner behind the Swiss market leader. The pilot fits in a paragraph: Paf gives Meta data — licence documents and URLs — so the platform can tell who on the market is regulated and who isn’t. It covers both operators and affiliates. By Paf’s own account, it is investing “nothing” — “only time and conversations” — but wants to bring the Swiss regulator to the table and, if the model works, to scale it to other markets, up to an EU-wide precedent.

Now what we don’t know — and that matters more. Meta has not publicly confirmed the pilot; everything we have is Paf’s account relayed by the trade press. Who represented Facebook at the meeting wasn’t named. What exactly Meta will do with the URLs — block them, send to manual review, throttle reach — hasn’t been disclosed. So the honest reading of the headline isn’t “Meta checks licences” but “a licensee starts feeding Meta a whitelist.” The difference is fundamental.

Why Switzerland is obvious without explanation. It’s a closed market with a short, public list of legal brands (around ten) and an official block-list of illegal offerings that regulators maintain and providers enforce. For the platform, “is this advertiser on the list or not?” reduces to comparing two tables — no army of lawyers across dozens of jurisdictions. Even Paf’s own people acknowledge the market’s structural gaps: no payment blocking, and a lottery monopoly on betting that pushes some players offshore for better odds.

And here came the line the whole mechanics below rests on: offshore operators use creatives that slip past Facebook’s systems, and Europe’s patchwork of licences makes their claims hard to verify — “the licence could be from anywhere, and in this jurisdictional mess it’s hard to trace.” Remember it.

The Netherlands: a DSA lawsuit and a fine for repeats

The Dutch track is no longer statements but documents. The association of licensed online operators served Meta with a summons to the Amsterdam court — the final step of a process that began over the summer with a complaint to the European Commission.

The numbers from the association’s materials: over 90% of the gambling ads it checked on Facebook led to illegal sites; of the flagged illegal ads, Meta removed 11% in May and 15% in June. In a Q4 2025 sample — more than 70,000 gambling ads targeting Dutch audiences, over 95% from unlicensed operators, under 5% removed. By the association’s estimate, the country’s illegal online market is now roughly the size of the legal one — on the order of €1bn a year.

The demand is worth reading closely: the association asks the court to find that Meta is failing its DSA obligations and to order it to act so that illegal ads targeting Dutch users are prevented, not pulled after the fact. In plain terms — not “take it down on complaint” but “don’t let it in.” That’s a whitelist request, written by lawyers. The plaintiffs also point out that civil courts in France and Germany have already held Meta liable for illegal gambling ads — the EU precedents are stacking up.

The next day parliament passed a motion whose substance is to write into gambling law that an online platform which repeatedly shows illegal advertising after a takedown request is itself committing a violation, with the regulator empowered to levy a fine or an enforcement payment. Two caveats, so nobody gets ahead of themselves. First: a motion is not a law — the amendment still has to clear both chambers, which is months, more likely years. Second: the violation is specifically the repeat after notice — the first impression still costs the platform nothing.

And “repeat” is the key word. The regulator has described its routine like this: thousands of ads a month, an average life of about a day and a half, then takedown and return under a slightly different name or address. If a repeat after notice becomes Meta’s own violation, it’s no longer in the platform’s interest to define “repeat” as the same ad with the same ID. It’s in its interest to define it as the same brand, the same end domain, the same network of pages and the same payer. That’s the shift from moderating ads to moderating entities — the account-linking toolkit has long existed; what was missing was the incentive.

The mechanics: from blacklist to whitelist

Now the core — what actually changes in the check, and why the familiar creative-level defence doesn’t hold here.

How Meta looks at gambling today. On paper the rules have long been strict: to run gambling, an account gets written permission and proves the activity is licensed by a regulator in the target territory. An affiliate attaches the operator’s licence, proof of partnership and a landing URL, and declares intent before entering a new jurisdiction. A key policy line: authorisation is required even for ads whose landing page merely promotes gambling without letting you play — aggregators and affiliate sites are named explicitly. But the crucial part is that the platform expressly disclaims responsibility for how authorised accounts comply with local law. The licence is checked once at the door; after that the advertiser is on its own, and anything that bypassed authorisation is caught by content classifiers and pulled on complaint. That’s a blacklist: you’re legal until you’re caught.

The economics of grey gambling rest exactly on that gap. An ad lives about a day and a half; 11–15% of illegal ones get removed — so if the funnel recoups spend faster than the notice arrives, the model works. Cloaking is the logical tool here: it hides the real creative and real landing page from whoever’s looking at content.

What a whitelist does. It flips the presumption. The platform now has a register of licences and URLs for legal operators and affiliates in a specific geo, and the logic becomes: a gambling ad for that geo whose chain doesn’t end at a listed domain is suspect by default. The Dutch motion adds the incentive — every repeat after notice turns into a fine for the platform itself.

Why creative-level cloaking doesn’t close this. Four reasons:

1. The check asks a different question. The classifier asks “is there gambling here?” and cloaking answers “no.” A whitelist asks “who’s the advertiser, are they authorised for this geo, and is the domain where the deposit lands on the list?” You can hide the creative; you can’t swap the licence at the end of the chain. A Curaçao or Anjouan licence is a real licence — just not a Swiss or a Dutch one.
2. The signal comes from a human in the geo, not a bot. The notices are sent by regulators’ inspectors, associations’ researchers, operators’ staff. They see the ad the way a real user in Amsterdam or Zurich does, with the real landing page. And under the EU’s DSA, every ad sits in a public Ad Library with reach and targeting parameters — so any motivated competitor can audit someone else’s ads. Licensees’ motivation beats any moderator’s, and they work for free.
3. Repeats are counted by entity. If the fine lands for a repeat after notice, the platform’s interest is to remember not the ad ID but the brand, domain, network of pages and payment profile. You can rebuild a creative in an evening; you can’t rebuild an operator’s brand.
4. The mismatch itself becomes evidence. In blacklist mode, a gap between the page name and the advertised brand is a defence. In whitelist mode it’s a tell: regulators explicitly ask platforms to catch pages with hidden identity and disguised links. Cloaking, by definition, creates exactly that gap.

Hence an unwelcome conclusion for anyone treating a pre-lander as armour: an affiliate site between the ad and the operator doesn’t break the chain. Policy expressly requires authorisation for ads leading to affiliate sites, and Paf’s data covers affiliates as a separate line item. In these suits, the target isn’t abstract “illegal operators” — it includes you.

In fairness, the whitelist has limits. It works where the list is short and public. Switzerland is the ideal testbed; the Netherlands is the next candidate. Beyond that lies the “jurisdictional mess” — markets with dozens of licensees, regional licences and transitional regimes, where a whitelist is far harder to assemble.

The US and Brazil: the same vector outside Europe

Florida. The state AG sent near-identical letters to five platforms: confirm in writing by October 23 that they are not promoting sweepstakes casinos to Florida residents, and describe the measures that guarantee it. The ladder is transparent — first lawsuits against operators and their payment processors, now marketing. The key word in the letters is “facilitate”: the office promises to pursue both those who run such operations and those who help them.

For Meta the task is trivial: policy classifies sweepstakes as gambling requiring authorisation, and an online-casino licence doesn’t exist in Florida at all — nothing to check, nothing to authorise. The cheapest answer by the deadline is a Florida geo-exclusion for anything that looks like sweeps. For anyone running US sweepstakes, that’s losing the third most populous state — and not only on Meta, since there are five recipients. Add the states that have already banned the dual-currency model by law, and the US-sweeps picture isn’t cheerful. Note too that Google had, a year earlier, tightened its policy so that sweepstakes casinos no longer count as “social” — meaning they’d need full real-money gambling certification, which Florida can’t grant.

As of late October, the 23rd deadline has passed; there’s still little public, detailed accounting of each platform’s written response, but the vector doesn’t change: it’s cheaper to exclude the geo than to prove the legality of something that can’t be legal in Florida.

Brazil. Here the ban swept up all betting advertising, including licensed — so no whitelist is needed, only a blacklist. MP 1,394 of September 25 banned new betting ads immediately and gave running campaigns until October 5; from October 6, sites and apps are to be unavailable. The sweep is growing fast: authorities referred thousands of domains for blocking (by the first third of October the count passed 13,000 addresses sent for blocking), demanded the removal of thousands of pages, profiles, channels and groups, notified the app stores to pull nearly two hundred apps, and eight platforms received orders to remove betting ads.

But for a buyer, the more telling item is the agenda the authorities proposed for a technical meeting with Big Tech: mechanisms against new ads, detection of hidden-identity pages and disguised links, affiliate and influencer content, and — as a separate point — retention of data on identified advertisers. That last one isn’t moderation; it’s building an evidence base.

An important 2026 caveat: the ban isn’t final. The MP is a provisional measure that Congress must approve; industry associations have already challenged it at the Supreme Court, and some legislators want to carve sports betting out of the ban. Several outcomes are on the table — from full approval to a softened version with strict advertising limits. Meanwhile, as usually happens after bans, part of the demand flows offshore: after the MP, observers recorded a rise in searches for offshore platforms and a spike in active illegal domains. But the enforcement mechanics are identical: authorities look not at the creative but at who stands behind the page and where the link truly leads.

The pressure map: where it’s hot, and where Meta is still tolerant

The hot zone for the coming weeks is three dated points (all now past, as of late October): Brazil, Switzerland (pilot start) and Florida for sweeps. The Netherlands is hot by direction but not by date — the lawsuit and the amendment will drag on, and for now the old notice regime applies there, just under a far closer watch. Keep Australia in mind separately: from the start of 2027 it introduces a mandatory 24-hour takedown-on-notice with heavy fines.

Where is Meta still tolerant? The honest answer: almost everywhere the check still runs on a blacklist — that is, across most of the world. There the gap between launch and takedown persists, and the spend economics still pencil out the old way.

But tolerance has clear end-signs — and you can check them against your own geo:

• is there a regulator mass-sending notices to Meta;
• is there a law or mandate making the platform liable for a repeat;
• is there a strong licensee association or operator ready to litigate or to feed the platform data;
• is there a short public list of legal brands and a block-list of illegal ones.

Each tick shortens the life of a grey funnel. Switzerland needed two — a short list and a licensee willing to feed it to Meta. The Netherlands is closing on four of four. The rest of Europe is still at one or two, plus loud speeches from regulators.

Agency accounts: a scenario, not a story

In parallel, a story circulates in the community that European resellers of agency credit lines allegedly stopped issuing accounts for grey offers all at once, while moderation mass-applied “policy holds” and demanded “whiteness” documents for the product — with cascading pool blocks and money frozen on the credit line. There’s no independent confirmation: no named resellers, no numbers, no screenshots, no platform comment. So it’s rumour, not news.

But the rumour is logical, and worth treating as a scenario. If platform liability moves to the entity level, an agency with a credit line and a direct contract with Meta becomes the most visible link in the chain: one notice on a client is a risk for the whole pool. So tighter KYC at resellers is plausible regardless of whether this particular text is true. The defensive playbook is simple: don’t keep large balances on agency accounts, get hold and refund terms from your provider in writing, spread spend across two or three suppliers, and don’t live on a single credit line.

What a buyer should do right now

• Sort geos into zones. Put the hot markets in a separate basket with a hard cap on budget share. Testing new grey-brand funnels there right now is paying for the privilege of becoming the pilot’s first public case.
• Re-run unit economics on a short window. In whitelist mode, the life of a chain that doesn’t resolve to a geo licence trends toward zero. A long-hold CPA on hot geos is elevated risk: if the brand drops out of the geo, the hold becomes a cancellation.
• Check the brand, not just the creative. Before you launch, answer one question: does the operator hold this country’s licence. If the licence is “from somewhere else,” that’s exactly what whitelist mode will check.
• Diversify sources without illusions. Google with gambling certification in some countries, TikTok, push, native, SEO. But the “check the chain” logic spreads to everyone: illegal operators get caught in search results, in redirects and in messenger channels too. There’s no clean source.
• Reconsider the white branch. If you have access to brands licensed in the geo, affiliate authorisation stops being bureaucracy and becomes a pass: in whitelist mode such affiliates are on the list while grey competitors drop out of the auction. Higher entry cost, lower competition.
• Agency accounts as a scenario. Small balances, hold terms in writing, two or three suppliers, a reserve.
• Put a calendar on the wall. Track hearings in the Dutch case and the amendment’s progress, the fate of Brazil’s MP in Congress and the Supreme Court, the Swiss pilot’s development, and Australia’s rules taking effect in 2027.

Bottom line: the end of grey gambling?

No. Grey gambling out of Facebook in Europe won’t die this week, or by New Year. The Swiss pilot still exists in one person’s words from one conference, the Dutch motion isn’t yet law, and most of the world runs on the notice regime, where a day-and-a-half gap still feeds the spend model.

Something else is dying — the model in which the platform merely reacts and answers for nothing. The Netherlands is rewriting liability (repeat after notice = the platform’s violation), Switzerland is rewriting the presumption (not on the list = suspect), Brazil and Florida are rewriting the question itself (who’s behind the page, and where does the link really go). You used to compete with a classifier — and you could play hide-and-seek with it. Now you’re starting to compete with a list, and you don’t play hide-and-seek with a list: you’re on it or you’re not. If the pilot works somewhere, they’ll carry it to other markets; if it fails, they’ll rework it and try again. For grey gambling, both branches are bad. The only question is speed.