Poland Wants Meta Fined €250 Million Over Scam Ads. But What About the Victims?
In June we argued on this site that EU fines will not repay scam victims, and that a redress fund is needed. Poland’s demand of 27 August gives that argument a live test case, and this Briefing adds what the June piece did not have: the specific provisions that determine where a DSA fine actually goes, and the provision showing that the outcome was a drafting choice rather than a constraint.
Background
On 27 August 2026 the Polish Minister of Digital Affairs, Krzysztof Gawkowski, asked the European Commission to fine Meta EUR 250 million for failing to act on fraudulent advertising on Facebook and Instagram. The request followed a reporting test by CERT Polska: of 122 advertisements identified as fraudulent and reported to Meta, ten were removed, in 106 cases Meta declined removal, and in six there was no response. “We have hard evidence that the platform isn’t acting in the best interests of users, but rather in its own self-interest, which allows it to monetize deceptive advertising,” Gawkowski said. “The time has passed for us to say ‘improve yourselves’ … Now the time has come for penalties.”
Poland is not acting in isolation. On 21 May 2026, BEUC and 29 member organisations from 27 countries filed complaints with the European Commission and national Digital Services Coordinators against Meta, TikTok and Google. Between December 2025 and March 2026 the groups reported close to 900 advertisements suspected of breaching EU law across 13 countries. Platforms removed 27%; 52% were rejected or ignored. BEUC asked the Commission and the Coordinators to investigate and to impose fines for continued non-compliance.
The BEUC complaints and the Polish CERT material may add evidence and enforcement pressure. But any commission fine would ultimately have to rest on infringements established by the Commission in its own DSA proceedings. In Meta`s case those proceedings already include deceptive advertising; the Commission opened formal proceedings against Facebook and Instagram on 30 April 2024 expressly covering Meta’s policies and practices relating to deceptive advertising.
Meta told Reuters: “Scammers are persistent criminals who use increasingly sophisticated tactics. That’s why we continue to invest heavily in technologies and partnerships — with industry and law enforcement — to find, remove, and ultimately stop scammers.” To Polish media the company said it does not seek to profit from fraudulent advertising, and reported removing some 380,000 pieces of content and 137,000 advertisements in Poland for fraud-policy breaches between July 2025 and June 2026. CERT Polska’s sample is 122 advertisements and its methodology is not public; a refusal to remove is not by itself evidence that an advertisement was unlawful. On the other side of that ledger stands the figure we examined in Meta’s scam ad empire. (Reuters reported in November 2025, on internal Meta documents, that the company had projected 10% of annual revenue — some USD 16 billion — from fraudulent advertisements).
This Briefing does not assess whether a fine is warranted. It asks the narrower question the coverage has not: if the Commission imposed it, where would the money go?
The arithmetic
By the standard of the statute it is small. Article 74(1) DSA empowers the Commission to fine a provider up to 6% of total worldwide annual turnover in the preceding financial year. Meta Platforms reported revenue of USD 200,966 million for the twelve months ended 31 December 2025; 6% is approximately USD 12.06 billion. Poland’s request, reported at approximately USD 291 million, is about 2.4% of that and roughly 0.14% of one year’s revenue. The ceiling is not settled — Article 74(1) refers to the turnover of “the provider … concerned,” and the designated provider is Meta Platforms Ireland Ltd rather than the group, while the Commission has never published its fine methodology and did not explain the calculation behind the X decision. The group figure is an upper bound, not an established base.
By the standard of enforcement practice it is not small at all. At EUR 250 million it would be the largest DSA fine ever imposed. The Commission adopted its first DSA non-compliance decision against X on 5 December 2025, fining EUR 120 million; on 28 May 2026 it fined Temu EUR 200 million, the largest to date. Poland is asking for 25% above the current record.
Rafał Brzoska, the Polish businessman litigating against Meta over deepfake advertisements using his likeness, made the point from the other direction on the day of the announcement: he said he hoped the EUR 250 million was meant *per Member State*, since only multi-billion sums would change behaviour, and separately proposed a penalty set at 150% of the revenue a platform derives from scam advertising.
Neither observation touches the question that matters
Fines imposed by the Commission are paid neither to complainants nor to the Member State that complained. They enter the Union budget as non-assigned other revenue. The Commission states the consequence plainly in the antitrust context: such fines “are paid into the general EU budget. This money is not earmarked for particular expenses, but Member States’ contributions to the EU budget for the following year are reduced accordingly.
There is no DSA carve-out. And the DSA demonstrates that the legislator knew exactly how to make one. Article 43(6) provides, in terms:
The individual annual supervisory fees charged pursuant to paragraph 1 of this Article shall constitute external assigned revenue in accordance with Article 21(5) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council.
Articles 74 and 76, which govern fines and periodic penalty payments, contain no equivalent provision. So earmarking was drafted for the supervisory fee and withheld from the penalties, in the same Regulation.
The point is stronger still when the DSA is read against Union buget law. Article 21(5) of the current Financial Regulation, Regulation (EU, Euratom) 2024/2509, expressly provides that a basic act may assign the revenue for which it provides to specific items of expenditure.
And the Union legislature has since applied that technique directly to Commission-imposed fines. Article 72(4) of Regulation (EU) 2025/2643 provides that fines imposed under that Regulation “shall constitute external assigned evenue” and shall be directed to the Ukraine Support Instrument.
The objection normally raised against a victim redress fund is that Union budget law does not permit revenue to be assigned to a purpose. These provisions show that the objection, stated that broadly, is wrong.
Article 43(6) DSA shows that assigned revenue is already part of the architecture of the DSA itself. Article 72(4) of Regulation (EU) 2025/2643 goes further: it shows that the Union legislature can expressly designate Commission-imposed regulatory fines as external assigned revenue and direct them to a defined purpose.
That does not by itself answer the separate competence question for assigning DSA penalties to victim redress. It does establish a narrower but important point: earmarking Commission-imposed regulatory fines is not alien to Union law. Whether and how the technique can be transplanted into the DSA becomes a question of legal basis and legislative design, rather than an objection based simply on the principle of budgetary universality.
So if the Commission imposed the fine Poland has asked it to consider, the fine would enter the Union budget. Because the DSA contains no assignment of Article 74 fines to victims or any other compensation mechanism, no part of that mechanism can reach a person who lost their savings to an advertisement. Economically, non-assigned fine revenue reduces the amount that would otherwise have to be financed through Member State contributions. No adjustment to the size of the fine would change the absence of a victim-redress mechanism.
The victims' own right, and why it does not work
Article 54 DSA provides that recipients of the service may seek compensation, in accordance with Union and national law, from providers of intermediary services for damage or loss caused by an infringement of the provider’s obligations under the Regulation.
That right fails in the exercise. “In accordance with Union and national law” imports the whole private-international-law architecture; Article 54 contains no evidentiary presumption and no rule on the burden of proof, and the claimant carries both. Jurisdiction is governed by Brussels I bis, and in “Schrems” (C-498/16, 25 January 2018) the Court of Justice held that assigned consumer claims do not travel to the assignee’s protective consumer forum, decided on Article 16(1) Brussels I, now Article 18(1) Brussels I bis foreclosing the simplest form of aggregation. In *Stichting Right to Consumer Justice and Stichting App Stores Claims v Apple* (C-34/24, Grand Chamber, 2 December 2025) the Court held that an online store is a virtual space corresponding to the whole territory of the Member State, so damage occurs throughout it irrespective of where individual users were located: valuable, but it dissolved fragmentation *within* a Member State and expressly left open whether the reasoning extends to a pan-European claim. Article 9(3) of the Representative Actions Directive (EU) 2020/1828 then closes the remaining door, requiring consumers not habitually resident in the Member State of the court to express their wish to be represented explicitly, in a population dispersed across the Union, systematically under-reporting, and frequently unaware any action exists.
Academic commentary on the Temu fine put it precisely in June 2026: Article 54 “contains no evidentiary presumption, establishes no rules on the burden of proof,” and “a rule enforced without a remedy is, in the end, a rule enforced only halfway.“
The private route is being tested harder in the United States, on a footing Europe does not have: we have followed the lawsuits against Meta over Facebook scam ads, the Calise decision measured against the DSA, the Consumer Federation of America’s fraud-infrastructure claim and the two *Bouck v. Meta* rulings on generative-AI advertising tools. Those cases turn on Section 230 and on contract and identity-misuse theories. None of them makes a European claim any easier.
The X decision remains the cleanest illustration. In December 2025 the Commission established that a verification design had increased users’ exposure to scams, including impersonation fraud, and collected EUR 120 million. Those users are identifiable in principle. None received anything, and no mechanism existed by which they could have.
Two procedural notes
The Polish request itself has no procedural standing. Article 65(2) DSA permits a Digital Services Coordinator to request that the Commission assess a matter; it confers no entitlement and names no sum, and there is no mechanism by which a stated amount is granted. Poland’s own position is awkward: the Commission referred it to the Court of Justice on 7 May 2025 for failing to designate and empower a Digital Services Coordinator and to lay down penalty rules, and its DSA implementing legislation cleared the Senate only on 6 August 2026, three weeks before the demand. The BEUC complaint, filed through 29 organisations in 27 countries, does not share that weakness.
And the Commission is not inactive. It opened formal DSA proceedings against Facebook and Instagram on 30 April 2024, expressly including Meta’s policies and practices relating to deceptive advertising, and has since issued preliminary findings against Meta on three strands: notice-and-action mechanisms and “dark patterns” on 24 October 2025, protection of minors on 29 April 2026, and addictive design under Articles 34 and 35 on 10 July 2026. What has not happened, in 28 months, is any finding on the deceptive-advertising strand — the one opened first, and the one concerning the mechanism by which fraud victims are acquired.
The case for the current design, put fairly
There are respectable reasons why fines do not reach victims. Administrative fines are punitive and deterrent instruments, calibrated to the gravity of an infringement rather than to anyone’s loss, and imposed on a standard of proof that would not sustain a damages award. Budgetary universality exists in part to stop enforcement authorities acquiring a financial stake in the outcomes they decide: an enforcer funded by the fines it levies is a worse enforcer. Any reform connecting sanctions to compensation must answer that objection, and a design that simply divided a penalty among claimants would fail outright.
Our Assessment
That objection concerns architecture, not the case for redress. Three functions separate cleanly:
Punish the infringement. Remove the profit. Repair the harm.
Only the first is operational at Union level against enablers of online fraud. Where advertising revenue was earned from campaigns subsequently established to be fraudulent, no Union mechanism requires the intermediary to surrender the fee it charged for delivering the victim. And Article 54 states a compensation right that the private-international-law architecture makes unusable at scale for exactly the population it was written for.
EFRI is launching a European initiative under that principle and on the redress-fund argument we set out in June.
Two first objectives:
A disgorgement limb, so that revenue from advertising campaigns subsequently established to be fraudulent is not retained. Disgorgement is legally distinct from a fine, is not calibrated to the gravity of an infringement, and does not raise the earmarking objection in the same form. It is already on the table in Poland: a penalty set at 150% of scam-advertising revenue would be gain-based rather than turnover-based, comgining a disgorgement element with an additional deterrent component.
A European Fraud Victim Redress and Recovery Fund making bounded, rule-based payments to documented victims of recognised fraud episodes without requiring each victim first to win an individual case against the platform, then pursuing subrogated recovery at aggregated scale, with a defined share of qualifying DSA pecuniary sanctions as a structural funding stream. Article 43(6) DSA shows that assigned revenue is already part of the DSA architecture; Article 21 (5) of the Financial Regulation supplies the general legislative technique; and Article 72 (4) of Regulation (EU) 2025/2643 demonstrated that the Union legislature can use that technique specifically for Commission-imposed fines.
We are beginning with fraudulent online advertising on very large platforms because that is where the evidence is strongest and the enforcement is live.
Our reservations: None of this is available under current law. Assigning a share of Commission-imposed DSA fines to a redress fund requires legislative amendment and a competence and budget analysis we have commissioned rather than assumed; Article 43(6) shows the technique exists, not that the competence question is answered. A solidarity payment must create no presumption of any defendant’s civil liability. And the objection we take most seriously is not the budgetary one but the incentive one: a fund financed by enablers can become a licence fee, purchased annually, that relieves pressure for primary liability. Any such mechanism must therefore supplement and never replace individual and collective rights. Where a victim can establish liability, that claim must survive intact. No contribution buys immunity.
Surveyed during the DSA negotiations in 2021, more than 620 of approximately 1,100 victims registered with EFRI — around 57% — said they had been drawn into the fraud through advertisements on platforms including Facebook and Instagram; in our more recent work, more than 70% identified scam advertising, primarily on Facebook, as decisive in the approach that reached them. We wrote in 2022 that the DSA was a missed chance because it created obligations without an effective route to compensation. We would rather have been wrong.
Poland has opened the right argument and asked the wrong question. The question is not how large the fine should be. It is where the money goes and Article 43(6) proves the Union already knows how to answer it.
A forthcoming EFRI Case Note will examine the separate liability track whether a platform’s paid-advertising business can be characterised as hosting at all in light of the Warsaw Court of Appeal’s order of 27 March 2026 and the Court of Justice’s active-role case law.
